Privacy Policy

1. Who we are, and our role (controller or processor)

Inboxer is operated by App Studio, a French SASU (see Legal Notice for full company details). Our role depends on the processing activity. App Studio acts as data controller (within the meaning of Article 4(7) GDPR) for account registration, billing, website analytics, security operations, and our direct communications with users. When Inboxer processes mailbox content, attachments, meeting transcripts, drafts, tasks, and workspace content on behalf of a business customer, App Studio acts as data processor and the customer acts as data controller for that content, as further described in our DPA. Contact for privacy matters: privacy@inboxer.so.

2. Personal data we process

Inboxer connects to email and, when you separately connect a meeting bot, meeting-transcription services, only after you authorise access. No calendar OAuth scope is requested today - meeting-related data comes from calendar-invite emails already in your mailbox and from meeting bot transcripts, not a live calendar connection. We process the categories of data below.

• Identity & account. Name, email address, organisation name, profile picture, timezone.
• Mailbox content. Messages, threads, subjects, bodies, attachments, drafts, labels, snippets - accessed via Gmail or Microsoft Graph under the OAuth scopes you approve.
• Meeting data. Where you connect a meeting bot to a call, its attendee list, transcript, and AI-generated summary. There is no live calendar connection - meeting details (time, location, attendees, video-call link) that appear in calendar-invite emails are covered under Mailbox content above.
• Generated content. AI-drafted replies, classifications, task and follow-up extractions, pre-meeting briefs (generated from calendar-invite emails in connected Gmail mailboxes), and embedding vectors used to answer questions in your workspace.
• Technical data. IP address, user-agent, session identifiers, audit events, error reports.
• Billing data. Subscription tier, billing email, payment method metadata (handled by Stripe - we do not store card numbers).
• Analytics. Pageviews, in-app events, device identifiers. Only set after you accept analytics cookies.

3. Why we process it (purposes and legal bases)

The legal bases below apply to the activities where App Studio acts as controller (see the role table in section 1).

Providing your account and subscription (account creation, authentication, plan management).

Performance of a contract - Art. 6(1)(b) GDPR.

Billing, fraud prevention, security event logging, audit trails.

Compliance with a legal obligation - Art. 6(1)(c) - and our legitimate interests in operating a secure service - Art. 6(1)(f).

Product analytics and aggregate usage statistics (cookies / local-storage identifiers).

Consent - Art. 6(1)(a) - obtained via the consent banner before any analytics identifier is set.

Customer support communications, transactional email about your account.

Performance of a contract - Art. 6(1)(b) - and our legitimate interests - Art. 6(1)(f).

For Customer Personal Data that Inboxer processes as processor - mailbox content and attachments, AI-generated drafts and classifications, extracted tasks, meeting transcripts and briefs, embeddings, and other workspace content - the customer, as controller, determines the purposes and the legal basis for the processing. Inboxer processes that data only on the customer's documented instructions, under the terms of our DPA.

4. Automated processing and AI (Art. 22)

Inboxer uses large-language-model providers (OpenAI, Anthropic) to classify your inbox, draft replies, extract tasks, and summarise meetings. These are processed under each provider’s API or commercial-terms contract, which prohibits training their models on your content.

No legally significant decisions are made about you solely by automated means within the meaning of Art. 22 GDPR. AI outputs are always presented as suggestions: classifications can be overridden, drafts must be reviewed and explicitly approved by a human before any outbound message is sent, and task or follow-up extractions are non-binding lists. You remain in control of every action that leaves your account.

We do not use your content to train AI models - ours or any third party’s.

5. Sub-processors

We share personal data with the sub-processors below, each bound by a written data-processing agreement under Art. 28 GDPR. We notify customers in advance of any material change to this list.

6. International transfers

Customer content (messages, drafts, tasks, transcripts) is stored in our primary database, hosted in the European Union (Ireland). Product analytics is hosted entirely on PostHog Cloud EU for every visitor, regardless of location. Some infrastructure sub-processors - the application hosting/CDN layer and error monitoring - remain located in the United States. Where personal data leaves the EEA/UK/Switzerland, transfers rely on the European Commission’s Standard Contractual Clauses (2021/914) supplemented by technical measures (TLS in transit, encryption at rest, contractual no-training commitments with our AI providers).

We perform a Transfer Impact Assessment (TIA) before introducing any new non-EEA sub-processor.

7. Retention

We retain personal data for the periods listed below, after which it is deleted or anonymised. You can request earlier deletion at any time (see “Your rights” below).

Active mailbox content (messages, drafts, threads, attachments).

Kept while your account is active. Deleted within 30 days of account deletion request.

Meeting transcripts and summaries.

Same as mailbox content.

Account, billing, and identity records.

Kept while your account is active. Some financial records retained up to 10 years where required by French commercial and tax law (Art. L123-22 C. com.).

Audit logs (security-relevant events).

Up to 12 months, or longer where required to investigate a security incident or respond to a legal request. Personal identifiers (IP, user-agent, user ID) are anonymised after account deletion.

OAuth tokens.

Encrypted at rest, deleted from our database immediately on disconnect. For Google accounts we also request revocation from Google at disconnect time; Microsoft does not offer an equivalent per-user revocation endpoint, so we delete our copy but cannot force revocation on Microsoft's side. You can revoke access directly from your provider's account console at any time, for either provider.

Analytics events (PostHog).

Aggregated event data retained 12 months. Per-user data deleted on request.

Backups.

Managed daily database backups through Supabase, encrypted and retained for 7 days. Deleted data disappears from backups once that window has passed.

8. Your rights

Under the GDPR, you have the following rights with respect to your personal data. We respond to any request within one month (extendable by two further months for complex cases, Art. 12(3)).

Requests concerning your account, billing, or other data App Studio processes as controller can be addressed to Inboxer directly. Requests concerning mailbox or workspace content processed on behalf of a business customer should normally be addressed to that customer, who acts as controller for it - Inboxer assists the customer in responding as required by the DPA.

• Right of access (Art. 15). Request a copy of the personal data we hold about you. You can export your data in machine-readable form from Settings → Your data.
• Right to rectification (Art. 16). Correct inaccurate or incomplete data - most fields are editable in-app; email us for anything you can’t edit yourself.
• Right to erasure (Art. 17). Delete your account and all associated personal data from Settings → Your data. Deletion completes within 30 days; some financial records may be retained for the periods listed in §7 where French commercial law requires.
• Right to data portability (Art. 20). Receive your data in a structured, commonly used, machine-readable format (JSON) via the export tool linked above.
• Right to restriction (Art. 18). Restrict processing while a dispute is resolved.
• Right to object (Art. 21). Object to processing based on legitimate interest, including direct marketing.
• Right to withdraw consent (Art. 7(3)). Where processing is based on consent (e.g. analytics cookies), withdraw consent at any time via the cookie preferences in the site footer. Withdrawal does not affect lawfulness of past processing.
• Right to lodge a complaint (Art. 77). You may complain to your local supervisory authority. In France that is the CNIL (cnil.fr/fr/plaintes).

To exercise any right you can’t complete in-app, email us at privacy@inboxer.so. We may need to verify your identity before responding.

9. Cookies and similar technologies

Inboxer uses cookies and local-storage identifiers strictly necessary to authenticate sessions and remember your preferences. Analytics identifiers (PostHog) are only set after you accept them via the consent banner - you can change your choice at any time from the cookie preferences in the footer.

10. Security

Application traffic is encrypted with TLS in transit. Connection tokens and other sensitive fields are encrypted at rest. Access to production data is restricted, audited, and gated behind MFA. See our Security page for our current posture.

11. Children

Inboxer is a workplace product not directed at children under 16, and we do not knowingly collect personal data from them.

12. Changes to this policy

We update this policy as our processing evolves or as sub-processors change. Material changes will be communicated in-app or by email at least 30 days before they take effect. The “Last updated” date at the top of this page always reflects the current version.

13. Contact

For privacy requests, including exercising any of the rights above, contact privacy@inboxer.so.