Privacy Policy

Inboxjot is built and operated by Arik Chakma ("Inboxjot", "we", "us"). This policy explains how we collect and use personal data when you visit inboxjot.com, use the Inboxjot dashboard or call the Inboxjot API.

Our Role

For the data about you and your account, Inboxjot is the controller: we decide why and how it is used. For the contacts, messages and events you send through Inboxjot, you are the controller and Inboxjot is your processor. We handle that data only on your instructions, as the Data Processing Addendum describes. Questions from your contacts about their data go to you first.

Data We Collect

Data You Give Us

• Your name and email address
• Workspace names, logos and the people you invite
• Messages you send to support

Data We Collect When You Use Inboxjot

• IP address, browser and device type
• Approximate location, from a local IP database that we run ourselves
• Dashboard activity and API requests, with their responses
• Sign-in events and active sessions
• How you use our website, such as the pages you view and the actions you take, through analytics tools

Data From Sign-In Providers

When you sign in with Google or GitHub, we receive your name, email address, avatar and account ID from that provider.

Data You Send Through Inboxjot

Contacts and their properties, email content, attachments, templates, and the events for each email: delivered, bounced, opened, clicked, complained and replied. Opens and clicks are tracked only on domains where you turn tracking on.

How We Use Data

• To provide Inboxjot: deliver your email, record its events and show you the results
• To keep the service secure: detect abuse, spam and fraud, and protect sender reputation
• To support you and answer your questions
• To understand how people use Inboxjot and improve it
• To tell you about changes to your account, the service or these terms
• To meet legal obligations

We do this to provide the service you signed up for, to meet legal obligations, and because we have a legitimate interest in keeping Inboxjot secure. We do not sell personal data. We do not use the content of your email or your contacts to train AI models.

AI Assistants

Inboxjot does not send your data to an AI provider. When you connect your own assistant, such as Claude or ChatGPT, through the Inboxjot MCP server, it can read and change only what the access you grant allows. You can remove that access at any time on the MCP page of your workspace. The assistant's provider handles what it reads under its own terms.

How We Share Data

• Subprocessors. Providers that run parts of Inboxjot for us, such as hosting, email delivery and storage. The Subprocessors page lists each one.
• Analytics providers. Providers that help us understand how people use our website.
• Integrations you connect. When you connect Slack, Discord or Telegram, we send alerts to the channel you choose.
• Legal requests. When the law requires it, or to protect our users, the public or Inboxjot.
• Business transfers. If Inboxjot is merged, sold or reorganized, data moves under the same protections.

Cookies

The dashboard uses only the cookies it needs to keep you signed in and secure. Our website uses analytics cookies to understand how people use it. We do not use advertising cookies, and we do not sell cookie data. You can block or delete cookies in your browser settings.

Data Retention

• Account data stays while your account is open.
• Email content is kept for 30 days by default. You can choose 7, 30, 90 or 365 days in your workspace settings.
• Email events are kept for 395 days by default. You can choose a shorter period.
• Deleted workspaces. We delete a workspace's data within 30 days, and it leaves our backups soon after.

We keep some records for longer when the law requires it, such as billing records.

Deleting Your Account

You can delete a workspace in its settings and your account on your account page. You can also write to privacy@inboxjot.com. We then delete the data as described in Data Retention.

Security

We protect data with encryption in transit, encryption at rest in our main database and file storage, access controls and monitoring. The Security page has the details. No system is perfectly secure, and we tell affected customers without undue delay if a breach puts their data at risk.

International Transfers

Inboxjot runs in the United States. When data moves from the European Economic Area, the United Kingdom or Switzerland to the United States, we rely on the Standard Contractual Clauses in our Data Processing Addendum.

Your Rights

Depending on where you live, you can ask to see, correct, export or delete your personal data, to limit or object to how we use it, and to withdraw consent. Residents of the EEA and the UK can complain to their data protection authority. California residents have the same rights under the CCPA, and we do not discriminate against anyone who uses them.

You can change most account data in the dashboard. For anything else, write to privacy@inboxjot.com. We answer within 30 days. If you are a contact of one of our customers, please write to that customer first, because they control your data.

Children

Inboxjot is for businesses and is not meant for anyone under 18. We do not knowingly collect data from children. If you think a child gave us data, write to us and we will delete it.

Changes to This Policy

When we change this policy, we update the date at the top.

Contact

If you have questions about this Privacy Policy, write to us at privacy@inboxjot.com.