Privacy Policy

1. Who We Are

Inboxyl is an email archiving service operated by [Company name to be added]. We are committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR).

[Data Protection Officer contact and company registration details will be added upon incorporation.]

2. What Data We Collect

• Account data: Email address and password (hashed) when you register.
• Email content: Emails, attachments, and metadata from mailbox files you upload.
• Usage data: Log data, IP addresses, and browser information for security and analytics.
• Payment data: Processed by our payment provider. We do not store card details.

3. Legal Basis for Processing

• Contract performance: Processing necessary to provide the Service you signed up for.
• Legitimate interests: Security, fraud prevention, and service improvement.
• Legal obligation: Compliance with applicable laws.

4. How We Use Your Data

• To provide and maintain the Service
• To process and store your uploaded email archives
• To send transactional emails (account confirmation, forwarded emails)
• To detect and prevent fraud or abuse

5. Data Storage and Security

All data is stored in European data centers (Ireland/EU). We use industry-standard encryption in transit (TLS) and at rest. Email files are stored in Cloudflare R2 (EU region). Database records are stored in Supabase (EU region).

6. Data Sharing

We do not sell your data. We share data only with the following processors to operate the Service:

• Supabase (database and authentication)
• Cloudflare (file storage)
• Railway (email parsing infrastructure)
• Resend (transactional email delivery)
• Vercel (web hosting)

7. Your Rights (GDPR)

Under GDPR, you have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Export your data (data portability)
• Object to or restrict processing
• Lodge a complaint with a supervisory authority

To exercise your rights, contact us at privacy@inboxyl.com.

8. Cookies

We use only essential cookies required for authentication and session management. We do not use tracking or advertising cookies.

9. Data Retention

We retain your data for as long as your account is active. After account deletion, data is permanently removed within 30 days. Backups are purged within 90 days.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you by email of any material changes. Continued use of the Service after changes constitutes acceptance.

11. Contact

For privacy-related inquiries: privacy@inboxyl.com