Privacy policy
Last updated November 8, 2026. Draft for legal review: not legal advice.
Who is responsible
Inboxed (demo company details: registration in progress), 1 Demo Street, Dhaka, Bangladesh is the controller for account data (the people who sign up and use Inboxed). For the leads and emails our customers upload and send, the customer is the controller and we act on their instructions as a processor under our Data Processing Agreement.
What we collect
Account details (name, email, password hash, two-factor settings); connected mailbox credentials (encrypted) and the campaign emails and replies needed to run your outreach (we never import the rest of your mailbox); lead data you upload; billing records; security logs (sign-in times, a hash of the network you signed in from, and your browser type); and, if enabled, cookieless page-view counts.
Cookies
We use one essential cookie to keep you signed in, and short-lived cookies during Google, Microsoft or Salesforce sign-in. No advertising or tracking cookies. If open or click tracking is turned on for a campaign, the recipient's email client loads an image or follows a link through our servers.
How we use it
To run your campaigns, warm up your mailboxes, power AI features inside your workspace, send account and security emails, and keep the platform safe.
Sharing
We use the sub-processors listed at /legal/subprocessors. We never sell your data, use your emails to train models outside your workspace, or share leads between customers. One exception protects deliverability: when an email sent with Inboxed through Gmail, Microsoft or another major provider is rejected with a code meaning the address doesn’t exist (5.1.1, 5.1.2 or 5.1.10), we keep only a keyed one-way hash of that address, a bounce count, the date last seen and keyed one-way hashes of up to five sending workspaces; we keep no address, customer name or campaign. Once at least two different customers have had such a bounce in the last 180 days, other customers’ emails to that address are skipped when they are about to be sent, with the reason “Skipped to protect deliverability”. The list is never checked at import, can’t be browsed or searched, and entries are deleted 12 months after the last bounce.
How long we keep it
Account data while your account exists. Workspaces can set automatic deletion of old leads, messages and tracking events. When you delete your account, workspaces only you belong to are deleted with their data; billing records are kept as long as tax law requires.
If you received an email sent with Inboxed
The sender is the controller. Use the unsubscribe link in the email to stop all emails from that sender, or ask the sender to erase your data; they can do it in one step. You can also report abuse at /report-abuse or write to privacy@inboxed.si and we’ll pass your request on.
Your rights
Access, export, correct or delete your data at any time from Settings, or by emailing privacy@inboxed.si. You can also complain to your data protection authority.