Privacy Policy
Here we explain which personal data we process, why, for how long, and what your rights are. We write plainly, without small print.
Privacy contact: support@inboqo.com
1. Two roles
- As a controller we process data about our customers and visitors: sign-up, billing, support, this website.
- As a processor we process data that our customers process in their own application (emails from their customers). For that data the controller is the customer (the company), and our relationship is governed by the Data Processing Agreement. If you are a customer of a company that uses Inboqo, contact that company to exercise your rights.
2. Data we process as a controller
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Company name, name, business email, password (only as a cryptographic hash), app address, chosen plan | Opening and running the account, login | Performance of contract | For the duration of the contract + 30 days |
| Billing address, tax number, payment history (card details are processed exclusively by Stripe) | Billing and invoices | Performance of contract, legal obligation | As required by tax and accounting law (generally 11 years) |
| Messages sent to support | Answering questions | Legitimate interest, performance of contract | Up to 3 years after the last contact |
| Application usage statistics (number of inquiries, AI cost) — without email content | Plan limits, billing, capacity | Performance of contract | For the duration of the contract |
| Technical logs (IP address, access time, failed logins) | Security and abuse prevention | Legitimate interest | Up to 90 days |
We do not use analytics, advertising or marketing cookies. We only use the strictly necessary login (session) cookie and a cookie that remembers your language choice, neither of which requires consent. We do not sell data and do not send promotional emails without your consent.
3. Where data is stored and who else processes it
Applications and databases are hosted on a server in Frankfurt (Germany, EU). Backups are encrypted and stored in the EU. Sub-processors we have data processing agreements with:
| Sub-processor | Purpose | Location |
|---|---|---|
| Hostinger International Ltd. | Server (applications, databases) | EU (Germany) |
| Anthropic, PBC | AI processing of email content (categorization, reply drafts) | USA |
| Cloudflare, Inc. | DNS, receiving support emails, storage of encrypted backups (EU) | EU / global network |
| Resend (Plus Five Five, Inc.) | Sending system emails | EU (Ireland) |
| Stripe Payments Europe, Ltd. | Subscription billing | EU (Ireland) |
Transfers to the USA (Anthropic, Cloudflare) are based on the European Commission's standard contractual clauses and/or the EU–US Data Privacy Framework. Under Anthropic's commercial terms, data sent via the API is not used to train models.
4. Data from Google and Microsoft accounts
If a customer connects a mailbox with “Sign in with Google” or “Sign in with Microsoft”, we receive an access token for that mailbox only. We use it solely to read incoming email and to send replies the customer chooses to send, as described above. We do not use this data for advertising, do not sell it, and do not use it to train general AI models. Humans do not read the email except when the customer asks for support, for security purposes, or as required by law.
Inboqo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Access can be revoked at any time in the Google or Microsoft account settings, or by disconnecting the mailbox in the application.
5. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interest. Send your request to support@inboqo.com; we reply within 30 days at the latest. If you believe we are breaching the law, you may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), azop.hr, or with the supervisory authority in your country.
6. Security
Traffic is encrypted (HTTPS/TLS), passwords are stored as hashes (scrypt), and credentials and keys are stored encrypted. Each company has a separate application and database. Backups are made every night and encrypted before leaving the server. Only the provider has access to the server.
7. Changes
We will notify customers of material changes to this policy by email. The date of the last change is shown at the top of the page.