This policy explains what personal data BotInbox handles, why, where it is stored, who helps us process it, and the choices you have. The short version: we collect what we need to run email inboxes for your agents, we do not sell data, and we keep analytics free of message content and recipients.
01Who we are and our role
Nolatech Ltd ("BotInbox", "we") operates botinbox.dev and the BotInbox service. Our postal address is 7 Florinis Street, 1065 Nicosia, Cyprus.
- For account and website data (for example, your email address, billing details and how you use the dashboard), we are the controller.
- For Customer Data, meaning the email your agents send and receive through BotInbox, including messages from third parties who write to your inboxes, we act as a processor on behalf of our customer, who is the controller. If you emailed an address that ends in @mail.botinbox.dev or a customer's custom domain and have questions, please contact the organization that operates that address. We will help them respond.
02What we collect
Information you give us
- Waitlist: your email address.
- Account: email address, and optionally your name. We sign you in with one-time email links; we do not store passwords.
- Billing (paid plans): handled by Stripe. We store a Stripe customer ID and subscription status, not card numbers.
- Support: whatever you include when you contact us.
Customer Data processed for you
- Email messages sent and received by your inboxes: addresses, headers, subject, body, attachments and raw MIME, plus threads, labels, drafts and delivery events (for example bounces and complaints).
- Configuration: inboxes, custom domains, webhooks, allow/block rules and, on plans that support it, your own SMTP settings (credentials are encrypted with AES-256-GCM).
Collected automatically
- API keys: stored only as SHA-256 hashes, with the last-used time.
- Security and audit records: sign-ins, key and domain changes, administrative actions, and IP addresses associated with them.
- Usage counts used for plan limits and billing, such as sends per day and per month.
- Analytics: see section 5.
03How we use it
- To provide the Service: create inboxes, deliver and store email, run webhooks and the API. This is necessary to perform our contract with you.
- To keep the Service safe: detect and prevent spam, abuse and fraud, maintain suppression lists, enforce limits, and investigate security incidents. This is our legitimate interest in protecting recipients, customers and our email reputation.
- To bill paid plans and meet tax and accounting obligations. This is contract and legal obligation.
- To send service emails: sign-in links, waitlist and invite emails, and account, security and billing notices. We do not send marketing email without your consent.
- To understand and improve the product using aggregated usage analytics. This is our legitimate interest.
We do not sell personal data, do not use it for advertising, and do not use message content to train AI models.
04Access to message content
Message content is available to you and your agents through the dashboard and API. BotInbox personnel access it only when needed to provide support you request, to investigate suspected abuse or security issues, or to comply with law. Our operations tools hide content by default; revealing content requires a stated reason and is recorded in an audit log.
05Analytics and cookies
- Essential cookies: a session cookie that keeps you signed in. It is required for the dashboard to work.
- Vercel Web Analytics and Speed Insights: cookieless, aggregated page-view and performance metrics. We remove URL query strings before they are sent.
- PostHog product analytics: records product events, such as a page view, joining the waitlist, signing in, creating an inbox or API key, sending a message or starting a subscription. When you sign in, these events are linked to your account: your user ID, your account email address, your plan, account type and role. Events themselves carry IDs, plans and counts. We never send message content, recipient lists, the addresses your agents email, or API keys to PostHog, and on-screen text is masked. PostHog stores an identifier in a first-party cookie or local storage. It honors your browser's Do Not Track setting, and session recording is off.
You can block analytics with your browser settings or content blockers; the Service keeps working.
07Where data is stored and international transfers
Data is stored and processed primarily in the United States. If you are located elsewhere, including the EEA, UK or Switzerland, your data is transferred to the United States. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and our providers' data processing terms.
08Retention
- Account data: kept while your account is active and deleted or anonymized after closure, except records we must keep for legal, tax or security reasons.
- Customer Data: kept until you delete it or close your account. Plan-based retention periods, shown on the pricing page, apply as those controls roll out. Raw inbound messages are stored so attachments remain downloadable.
- Waitlist entries: kept until you join, ask us to remove you, or we close the waitlist.
- Suppression entries (addresses that bounced or complained): kept as long as needed to avoid emailing them again.
- Audit and security logs: kept for up to 2 years.
09Security
We use encryption in transit (TLS), encryption at rest provided by our infrastructure providers, hashed API keys, scoped credentials, signed webhooks, access controls, audit logging and automated abuse protections. No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you as required by law.
10Your rights
Depending on where you live, including under the GDPR, UK GDPR and California law, you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent. We do not sell or share personal data for cross-context behavioral advertising.
To exercise these rights, email privacy@botinbox.dev from your account email address. We may need to verify your identity. You also have the right to complain to your local data protection authority. For Customer Data, we will direct your request to, or assist, the customer who controls it.
11Children
The Service is not directed to children and is not intended for anyone under 18.
12Changes
We will post updates here with a new "last updated" date and notify account owners of material changes by email or in the dashboard.
13Contact
Privacy questions: privacy@botinbox.dev. General support: hello@botinbox.dev. See also our Terms of Service and Acceptable Use Policy.