Privacy Policy

This policy explains how Brand My Inbox handles personal information on its public site, accounts, domain workflows, support, and future billing. For account administration, sales, security, and product operations, Brand My Inbox generally acts as controller. For organization-directed routing configuration, Brand My Inbox may act as a processor and the customer remains responsible for lawful instructions.

We collect account identity and contact details; organization, role, and invitation data; submitted domains and destination addresses; DNS and provider configuration; aliases and routing settings; website source text, logos, images, generated concepts, edited site content, and legal-page drafts; support and lead-form content; consent choices; security, audit, incident, backup, and usage records; device and request information needed to operate and protect the service; and billing details supplied to SUMIT when you make a payment. If you join the partner programme we also hold the information described in section 5a.

Mail you SEND through the relay or the API is not stored: bodies and attachments pass through in memory and are never written to our database or logs. There is one exception, and it exists because you asked for it: a message you WRITE OR REPLY TO from the Received-mail screen is kept, encrypted, for the same period as the mail you receive, so that a conversation reads as a conversation rather than as half of one. That is the only outbound mail we keep, it is deleted on the same clock as the received message it belongs to, and the screen says so where you write. Mail you RECEIVE is different again, and only if you switch it on. Creating an inbound address tells us to accept mail sent to it, and we then store the complete original message, its parsed body, its attachments and its authentication results so that you can read it, download it, reply in thread and call it from the API. It is off until you create an address, it stops when you delete the address, and the retention period is in section 7. Providers involved in delivery process email as necessary to route it under their own roles and terms.

There is one place, and only one, where a readable network address is stored: the optional record of who opened received mail. It is OFF for every workspace and stays off until an administrator switches it on and accepts, in writing and by name, that doing so records which of their own people opened which message, when, and from which address. When it is on, that record is kept for 90 days and then deleted automatically. Switching it off stops new records; the ones already taken run out their 90 days rather than being erased, because a record that can be deleted by the person it might implicate is not an audit trail. For this record the customer organisation is the controller and Brand My Inbox is the processor: they decide it happens, they owe notice to the people it covers, and we hold it on their instructions and for no other purpose. It is never used by us for analytics, for security scoring, or for anything else. At sign-up we also derive one-way salted hashes of the connecting network address and browser identification. The readable values are not stored. These hashes answer exactly one question — whether two free accounts were opened from the same place — which is how the one-free-account-per-person rule in the Terms is checked, and every match is reviewed by a person before anything is done.

Information comes from you, authorized organization administrators, public DNS, connected providers, security and service logs, and optional integrations you choose to authorize. We do not knowingly purchase consumer profiles.

We use information to provide contracted services; verify authority and destinations; secure accounts; perform requested DNS and routing operations; monitor health; maintain backups and audit evidence; provide support; process payments; comply with law; prevent abuse; improve reliability; send service communications; and invite customers to publish an independent review of the service.

Review invitations are sent to the account email, either by us or by a review platform acting on our instructions, and carry only the name, email address, and account or transaction reference needed to issue and deduplicate the invitation. Participation is voluntary and refusing has no effect on the service. Where GDPR applies we rely on legitimate interests in obtaining honest feedback about a service already supplied, or on consent where local law requires it; you can object or unsubscribe at any time. We do not select who is invited based on expected sentiment and offer nothing in exchange for a review. See section 15 of the Terms of Use.

Where GDPR applies, bases may include contract, legitimate interests in secure and reliable operations, legal obligation, and consent for optional analytics or marketing. Consent can be withdrawn without affecting prior lawful processing.

Data is shared with Hetzner Online GmbH, which hosts the service and stores received mail and uploaded files on servers in Germany (Falkenstein), and, separately, with our upstream sending provider for outbound email delivery — currently Oracle Cloud Infrastructure Email Delivery, in Oracle’s Jerusalem region. Amazon Web Services remains listed as a sub-processor: its Simple Email Service is retained as a standby sending route and can be enabled without a code change, so we name it here even though no customer mail is routed to it at present. A list that omits a vendor which could receive your data is worth less than one that is cautious. Data is also shared with Neon for the database, Cloudflare for DNS, SUMIT for payment processing, Anthropic where you use the site builder, OpenAI or Google's Gemini API where you switch on an AI agent (what a visitor writes to the assistant and the content you gave it, kept on the contact's timeline for 30 days or 7 years where a person marks it as an agreement; with your own key they process it under your agreement with them), Meta where you connect your own WhatsApp Business Account (which Meta bills to you directly), Google Analytics and Microsoft Clarity for website measurement if you accept the Analytics cookie category, and Google when you connect a Google service yourself. The content of mail you SEND through the relay or the API is not shared with anyone, because it is not stored; a reply you write from the Received-mail screen is stored on Hetzner Object Storage in Germany on the same terms as your received mail, and is disclosed to nobody else. The content of mail you RECEIVE on an inbound address is stored on Hetzner Object Storage in Germany on our instructions, and is disclosed to nobody else: not sold, not used to train anything, and read by a person here only where you ask us to look at a specific message or where the law requires it.

The record of who opened received mail, where a workspace has switched it on, is disclosed to nobody at all — not to our own support staff, who cannot see it, and not to any third party. It is readable only by the owners and managers of the workspace that created it. Brand My Inbox does not sell personal information. It does not use cross-context behavioural advertising at launch. If that changes, this policy and consent controls must be updated before deployment.

If you join the partner programme we hold your application, the channels you told us about, the commission terms agreed with you, your payment method and the account details for it, and the tax-verification status required for your jurisdiction. The account details you give us for payment are stored encrypted and are never displayed on any screen, including to our own staff; they are decrypted only when a payment is made.

Visits through a partner link are recorded so that partners can see whether a channel works and so that we can detect abuse of the programme. What is stored for each visit is the partner code, the time, the page landed on, the country, and one-way hashes of the visitor's IP address and browser identification. The addresses themselves are hashed at the edge and never reach our systems in readable form. The only question these hashes are ever used to answer is whether two visits came from the same place, which is what identifies a partner referring themselves.

Partners never receive the identity of a customer they referred. A partner dashboard shows the date, the plan, and the amount earned. It does not show a name, an email address, a domain, or an organisation. This is a protection for the customer, who did not agree to have their purchase reported to a third party, and it is enforced in the system rather than left as a policy.

Where GDPR applies, we rely on legitimate interests in running a referral programme honestly and in preventing fraud within it. Partner records are kept while the partnership continues and afterwards for the period required by tax and accounting law.

Your account data and email metadata are processed in the EU (Frankfurt). Three transfers leave the EEA and are named rather than implied: SUMIT in Israel for payments, which is covered by a European Commission adequacy decision; Anthropic in the United States for website generation, which happens only if you use the site builder and only with the material you supply for it; OpenAI in the United States or Google for an AI assistant's conversations and voice, which happens only if you switch on an AI agent, and, with your own key, under your own agreement with that provider; Meta for WhatsApp delivery, which happens only if you connect your own WhatsApp Business Account; and Google Analytics in the United States for website measurement, which happens only if you accept the Analytics cookie category and is covered by the EU-US Data Privacy Framework.

Mail received on an inbound address is kept for 30 days by default. The period is a setting on the address, bounded by your plan, and when it expires the stored original, its parsed body and its attachments are deleted together. Messages you write or reply to from that screen follow the same 30-day clock and are deleted by the same hourly sweep. Deleting a message deletes them immediately; so does deleting the address. Where a workspace has switched on the record of who opened received mail, each entry is kept for 90 days from the moment of the opening — its own clock, not the message’s. A message deleted after seven days therefore leaves the record of who read it standing for the full 90, which is the point: who saw a message we no longer hold is exactly the question an audit trail exists to answer. Account and configuration data is retained while needed for the service and a documented offboarding period. Audit, security, tax, dispute, and backup records may be retained longer where necessary or legally required. Consent records are refreshed at least every 180 days in the current implementation. Final retention periods must be documented in a production retention schedule.

Brand My Inbox uses role-based access, restricted provider credentials, private backups, time-limited downloads, pre-change snapshots, provider read-back checks, audit logs, and monitoring. No system is perfectly secure. Material incidents will be assessed, contained, documented, and notified as required by applicable law, including Israeli data-security obligations.

Depending on location, you may request access, correction, deletion, restriction, portability, objection, withdrawal of consent, or information about disclosures. Israeli law, GDPR/UK GDPR, and applicable US state laws provide different rights and exceptions. Identity and authority may be verified before fulfillment.

Unsubscribing from marketing applies to every channel. If you receive marketing from a business that sends through Brand My Inbox or EmailPro and you unsubscribe — through the link in an email, the link in a text message, a reply on WhatsApp, or by writing to the sender — the unsubscribe covers all channels at once, not only the one you used: no further marketing email, SMS or WhatsApp messages from that sender. Your address or number is placed on that sender's suppression list, and messages you have asked for yourself, such as an order confirmation or an appointment reminder, are not affected. You are never re-subscribed automatically: coming back requires a request from you that a person at the sender reviews and approves, and that decision is logged with who made it and when. Under section 30א of the Israeli Communications Law this is the recipient's right, and the platform enforces it on the sender's behalf.

California users may exercise applicable rights to know, delete, correct, limit, and opt out of sale or sharing without unlawful discrimination. Brand My Inbox honors Global Privacy Control for marketing sharing. Because Brand My Inbox does not sell or share personal information for cross-context behavioural advertising at launch, the opt-out is also reflected in the consent system.

Essential storage supports authentication, security, service delivery, and consent memory. Optional preference, analytics, and marketing categories remain off until selected. Google Analytics is the one optional analytics technology in use and is not loaded until the Analytics category is accepted. Choices can be changed from Cookie settings in the footer. See the Cookie Policy for the current inventory.

Direct individual accounts are not intended for people under 18. Schools or institutions serving minors must establish the required authority, notices, contracts, data-minimization controls, and parental or guardian permissions before providing access. Brand My Inbox does not knowingly target behavioural advertising to children.

To exercise any of these rights, or to raise a concern, write to [email protected]. We answer within one month, and tell you sooner if the request is complex enough to need longer. You may also complain to the competent privacy authority, including Israel’s Privacy Protection Authority or an EU/UK supervisory authority where applicable.

We will date updates and provide additional notice for material changes where required. Prior versions and consent evidence should be retained. Contact details remain a launch blocker in this draft.