Privacy Policy

This Privacy Policy describes how Inboxrise ("we", "us", or "our") collects, uses, stores, and shares information when you use our platform at inboxrise.com and associated services ("Service").

We are committed to protecting your privacy and handling your data with transparency. This policy applies to all users of Inboxrise, including free trial users, paid subscribers, and visitors to our website.

For users in the European Union, we act as a data processor for the personal data of your contacts, and as a data controller for your own account data. We are committed to full compliance with the General Data Protection Regulation (GDPR).

We collect the following categories of information:

Account information

• Name, email address, and password (hashed using bcrypt, never stored in plain text)
• Company name and billing information (payment card data is processed by our payment provider and never stored on our servers)
• Profile preferences and account settings
• Where you came from when you signed up: if you had visited our website earlier the same day, we note the site that referred you, any campaign tags in the link you followed, and the page you landed on. It is kept with your account, is not used to track you across days, and is deleted with your account. If you had not visited the same day, nothing is recorded.
• Referrals: your personal referral code, and, if you signed up through someone's referral link, which account referred you. When a referred account makes its first payment we record that both accounts earned a free month, and we tell the referrer your first name. It is deleted with your account.
• Free domain check: if you ask us to email your results, we keep your email address, the domain you checked and its result, and whether you chose to receive occasional deliverability tips. We send the results once and, only if you ticked the box, tips no more than twice a month, each with a way to unsubscribe.

Email infrastructure data

• SMTP and IMAP credentials you provide to connect your inboxes (encrypted with AES-256 at rest)
• Email sending logs including timestamps, recipient addresses, and delivery status
• Inbox warmup activity logs for reputation scoring
• Reply detection events and lead status updates

Contact data

• Names, email addresses, and custom fields of prospects you import into the platform
• Campaign engagement data (open events, reply events) associated with your contacts
• If you add a link to a campaign email: the address it opens. Each contact's copy of the link carries an id that identifies them within your campaign, so the destination can tell which contact opened it. We can only see that when the destination is our own website, and we record it only for campaigns Inboxrise itself sends, never for a customer's campaign (see "Website usage data" below)
• Unsubscribe and bounce records maintained for compliance purposes

Website usage data

• The pages you visit on our public website, the site that referred you, and any campaign tags in the link you followed. This is recorded on our servers as the page is sent. There is no cookie and no tracking script involved.
• We do not store your IP address with this record. Before anything is written we discard the identifying part of the address (the final block of an IPv4 address, or everything beyond the network prefix of an IPv6 address), combine what remains with your browser's user-agent string and the current date, and keep only a one-way hash of the result. That value changes every day by design. It lets us tell whether two page views in the same day came from the same visitor, and it cannot be reversed, linked to you, or matched against the following day's value.
• Your browser's name, your operating system, and whether you are on a phone, tablet or desktop, sorted into a few broad labels such as "Chrome", "macOS" and "mobile". We keep those labels and not the browser's full identification string.
• The country your request came from. We work it out on our own server from your address at the moment of the request, using an offline table, and keep only the country code. The address is not sent to anyone else for this and is not stored with the record. This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
• If you reached our website from a link in an email Inboxrise itself sent you: that link carries an id that identifies you as a contact in that campaign. When our website receives it we record the time you first opened it against that contact, and if you create an account from it we record on your account which campaign and contact it came from. This is how we count which of our emails led to a signup. No cookie is used for it. Some company mail filters open links before the recipient does, so we treat an opened link as a sign of interest, not proof of a visit. We never record this for links in emails our customers send, even when their link points to our website.
• If you use the free deliverability check: the domain you entered and the published DNS records we found for it. Those records are public information.
• If you ask Lex, the help chat on our website, a question: the text of your question and which answer Lex gave. We use it only to improve Lex's answers. It is stored without your IP address and without any link to an account, so please do not type personal details into the chat. Questions from the same conversation are grouped by a random code created in your browser tab, which is not linked to you and is forgotten when you close the tab; it lets us see when an answer missed and you asked again. Questions are deleted after 90 days.

Product usage and technical data

• Pages visited and features used inside the product while you are signed in
• Your IP address, used at the moment of the request to rate-limit our free tools and to investigate abuse or security incidents, and recorded in server error logs
• Error logs and performance data used to maintain and improve the Service

We use the data we collect for the following purposes:

• Providing the Service: Operating inbox warmup, campaign sending, IMAP monitoring, and all other core features
• Account management: Processing your registration, authentication, and subscription billing
• Customer support: Responding to your enquiries, resolving issues, and onboarding assistance
• Service improvement: Analysing usage patterns (in aggregate) to improve features and performance
• Security: Detecting and preventing fraud, abuse, and unauthorised access
• Legal compliance: Meeting our obligations under applicable laws including GDPR, CAN-SPAM, and Indian data protection law
• Communications: Sending you product updates, billing notices, and security alerts (you can opt out of marketing communications at any time)

We do not: sell your data to third parties, use your data for advertising, share your contact lists with other users, or use your email content to train machine learning models.

For users in the European Economic Area (EEA) and United Kingdom, we process personal data under the following legal bases:

• Contract performance: Processing necessary to deliver the Service you have subscribed to, including account management, email sending, and billing
• Legitimate interests: Product analytics, security monitoring, and fraud prevention, where our interests do not override your fundamental rights
• Legal obligation: Compliance with applicable laws, responding to lawful requests from authorities, and maintaining required records
• Consent: Marketing communications, where you have explicitly opted in. You may withdraw consent at any time.

For your contacts' personal data (names, email addresses you import), you are the data controller and we act as a data processor under Article 28 of the GDPR. A Data Processing Agreement (DPA) is available on request at privacy@inboxrise.com.

We share your data only in the following limited circumstances:

• Sub-processors: Third-party services we use to operate the platform (see Section 7). These providers are contractually bound to process data only on our instructions.
• Legal requirements: If required by law, court order, or a governmental authority with jurisdiction over us, we may disclose data. We will notify you where legally permitted to do so.
• Business transfers: In the event of a merger, acquisition, or sale of substantially all assets, your data may be transferred to the successor entity. You will be notified in advance.
• With your consent: In any other circumstances, only with your explicit prior consent.

We do not share, sell, rent, or trade your personal data or your contacts' data with any third party for their own marketing or commercial purposes.

When you connect a Google (Gmail or Google Workspace) mailbox to Inboxrise using "Sign in with Google", you grant access to your Google account through Google's OAuth 2.0 consent flow. This section describes exactly what we access and how we handle it.

What we access. With your explicit consent, we request the Gmail scope https://mail.google.com/, which lets Inboxrise send email on your behalf and read messages in the connected mailbox. We use this access solely to (a) send the outreach emails and follow-ups you configure, and (b) read incoming messages to detect replies, so we can pause sequences, capture responses, and surface them in your unified inbox and pipeline.

What we store. We store the OAuth access and refresh tokens Google issues, encrypted at rest. We store metadata and the content of detected replies (sender, subject, snippet, timestamps) so the product can function. We do not create or retain a copy of your entire mailbox.

Limited Use. Inboxrise's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not:

• Use Google user data to serve advertising;
• Sell, rent, or transfer Google user data to data brokers, information resellers, or other parties;
• Use Google user data to train generalized or personalized artificial-intelligence or machine-learning models;
• Allow humans to read your Google user data, except: with your explicit consent for specific messages; where necessary for security purposes such as investigating abuse; to comply with applicable law; or where the data has been aggregated and anonymized.

Your control. You can disconnect a Google mailbox at any time from the Inboxes page, or revoke Inboxrise's access directly in your Google Account at myaccount.google.com/permissions. On disconnection we delete the stored OAuth tokens for that mailbox.

We use the following third-party sub-processors to operate our Service. Each processes data under its own data processing terms:

AI on machines we operate. When you use Write with AI, Review copy, Target mode or ask Lex to draft an email or a reply, the writing is done by an AI model we run ourselves, not by a third party. Sorting the replies to your campaigns (interested, out of office, unsubscribe and so on) is also done by our own model. It runs on our application server or on a computer that Inboxrise operates directly, in India. That computer receives only what the task needs: for a draft or a review, the email copy and answers you gave for it; for Target mode, the company name, the text of that company's public homepage, and the linking lines you approved. It connects to our servers over encrypted HTTPS with a credential that can do nothing else, has no access to our database, and saves nothing about the task. Replies to your campaigns are never sent to that computer: drafting a reply and sorting replies happen only on our application server.

We review our sub-processors regularly and will update this list when changes occur. You may request notification of sub-processor changes by emailing privacy@inboxrise.com.

We retain different types of data for different periods based on the purpose for which they were collected:

• Account data: Retained while your account exists. Deleting your account in Settings removes it immediately. If a trial or subscription ends and you do not choose a plan, the account is paused, and 30 days later it is deleted with everything in it (inboxes, contacts, campaigns and their logs). We email you at least 7 days before that happens; choosing a plan before then keeps everything.
• Contact lists and campaign data: Retained while your account exists; deleted immediately when you delete your account.
• Email sending and warmup logs: Retained while your account exists, for deliverability analysis and troubleshooting; deleted with your account or your inbox.
• Billing records: Retained for 7 years as required by Indian accounting and tax law
• Security logs: Retained while your account exists; deleted with your account.
• Website measurement data: Retained for 90 days, then automatically deleted. This is the cookieless page record described in Section 02; it contains no IP address and no identifier that persists beyond a single day.
• Free deliverability check results: The domain checked and its published DNS records are retained for 1 year, then automatically deleted
• Suppression lists (unsubscribes, bounces): Retained for as long as your account exists, to honour opt-outs and prevent future unwanted contact; deleted with your account.

You may request early deletion of your data at any time (subject to legal retention obligations) by contacting privacy@inboxrise.com.

We take data security seriously and implement the following technical and organisational measures:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher
• Encryption at rest: SMTP and IMAP credentials are encrypted using AES-256. Passwords are hashed using bcrypt with a high work factor and never stored in plain text.
• Access controls: Production systems are accessible only to authorised personnel via SSH key authentication. No password-based access.
• AI worker machines: A computer that runs our AI model for you (see Section 7) connects over HTTPS with a single-purpose credential, cannot reach our database, and keeps no copy of the text it writes from.
• Database security: Row Level Security (RLS) is enforced at the database level, ensuring each user can only access their own data
• Monitoring: We monitor for unusual access patterns and potential security incidents 24/7
• Vulnerability management: We apply security patches promptly and conduct periodic security reviews

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and relevant supervisory authorities within 72 hours of becoming aware, as required by GDPR Article 33.

To report a security vulnerability, please email support@inboxrise.com. We take all reports seriously and respond within 48 hours.

Depending on your location, you have the following rights regarding your personal data. We respond to all valid requests within 30 days.

To exercise any of these rights, email privacy@inboxrise.com with your request. We may need to verify your identity before processing. If you are unhappy with our response, you have the right to lodge a complaint with your local supervisory authority (e.g., the ICO in the UK, or your national DPA in the EU).

We use two cookies, and both are strictly necessary:

• Sign-in cookie: Keeps you logged in after you sign in, for up to 30 days or until you sign out. Your browser sends it only to inboxrise.com, and the scripts on our pages cannot read it. Blocking it means you cannot stay signed in.
• Google sign-in cookie: Set only while you sign in with Google, so we can match Google's response to your request. It expires after 24 hours. Blocking it prevents Google sign-in from completing.

Everything else we keep in your browser is local storage, which is not a cookie. It stays on your device and is never sent to us automatically:

• A note that you are signed in, with your account's id. It is not your login and cannot be used to sign in.
• Interface preferences: the list you last opened, sort order, saved snippets and similar. Clearing your browser data removes these; you lose nothing but the preference.

We use no analytics cookies, no advertising cookies, and no third-party trackers. There is no Google Analytics on this site, no advertising pixel, and no third-party script of any kind.

We do measure traffic to our public website, but we do it on our own servers as the page is sent to you, with no cookie, no tracking script, and nothing stored on your device for that purpose. Section 02 describes exactly what that record contains.

We do not place tracking pixels in emails we send on your behalf without your explicit configuration to do so.

Inboxrise is headquartered in India. Our primary database infrastructure is hosted in South Asia (Mumbai). Some sub-processors are located in the United States or European Union.

For transfers of personal data from the EEA, UK, or Switzerland to countries without an adequacy decision, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission. Our sub-processors in the USA have signed SCCs or are covered by equivalent safeguards.

You may request a copy of the relevant transfer mechanisms by contacting privacy@inboxrise.com.

The Service is not directed at children under the age of 16 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from children.

If you believe we have inadvertently collected data from a child, please contact us at privacy@inboxrise.com and we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the Service. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Send an email notification to all active account holders at least 14 days before changes take effect
• Display a prominent notice within the platform for the first login after the updated policy is published

We encourage you to review this policy periodically. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please contact us:

• Privacy enquiries: privacy@inboxrise.com
• Security issues: support@inboxrise.com
• General contact: inboxrise.com/contact
• Postal address: Inboxrise, Bengaluru, Karnataka, India

We respond to all privacy-related enquiries within 30 days. For complex requests involving data access or erasure, we may take up to 3 months and will notify you of any extension within the initial 30-day period.