Privacy Policy

1. Information We Collect

To provide the InboxIQ service, we collect and process the following categories of information:

• Registration & Profile Data: Full name, email address, gender, profession, country, timezone, and preferred morning report delivery time.
• Authentication Data: User identifiers and session information provided through our authentication system.
• Subscription & Billing Metadata: Active subscription tier, payment status, currency, and renewal dates.
• Connected Google Account Metadata: Account email addresses, connection slots, and connection timestamps.
• Encrypted OAuth Tokens: Scoped OAuth refresh tokens required to access authorized Gmail services.
• Operational & Report Metadata: Timestamps of report generation, delivery logs, executive summary metadata, and error logs.
• Support Inquiries: Communications and details submitted through our contact form.

2. Gmail Data Access & Permissions

When you connect a Gmail account to InboxIQ, access is granted strictly through Google OAuth with least-privilege scopes. We never ask for, collect, or store your Gmail account passwords. InboxIQ accesses only email messages received within your active 24-hour reporting window to generate your daily briefing.

3. Purpose of Email Processing

Authorized email data is processed exclusively to:

• Identify relevant messages and filter out automated clutter or noise.
• Classify messages according to urgency and your configured profession (e.g. faculty, student, professional).
• Detect upcoming deadlines, tasks, and pending replies.
• Generate structured executive email intelligence briefings.

4. AI Models & Processing Services

InboxIQ uses modern AI models and processing services to synthesize email information into structured reports. Relevant email snippets are transmitted securely to AI processing infrastructure during scheduled report runs. Data processed by AI models is transient and used solely for generating your output—it is not used to train public models.

5. Data Storage & Minimization

InboxIQ follows strict data minimization principles. We do not permanently store or warehouse raw email message bodies in our application database. We retain only the operational metadata, summary reports, and account settings necessary to run the platform.

6. OAuth Token Encryption & Security

All Google OAuth refresh tokens are encrypted at rest on our servers using authenticated AES-256-GCM encryption. Encryption keys are managed securely on backend infrastructure and are never exposed to browser clients, frontends, or public logs.

7. Report Delivery & Retention

Generated daily briefing summaries are delivered as responsive HTML emails directly to your primary authorized Gmail inbox. We do not store full raw email archives or full email bodies in our application database.

8. Payment Information

Payment transactions are processed directly by our PCI-DSS compliant payment gateway partner (Razorpay). InboxIQ does not collect, store, or process full credit/debit card numbers or bank credentials on its servers.

9. Contact & Support Data

When you submit a message through our Contact page, the information (name, email, subject, and message) is used strictly to investigate, respond to, and resolve your support request.

10. Information Sharing & Third Parties

InboxIQ never sells, rents, or monetizes your personal data or email content. We share data with third-party service providers strictly to the extent necessary to deliver the service, including:

• Authentication and identity infrastructure.
• Cloud hosting and database infrastructure.
• Payment processing services (Razorpay).
• AI processing infrastructure for report generation.
• Email delivery and notification services.

11. User Controls & Data Rights

You maintain full control over your connected accounts and personal information:

• Disconnect Accounts: You can disconnect your Gmail accounts at any time from Settings, immediately removing stored OAuth tokens.
• Update Settings: You can adjust report schedules, timezones, and contact details in Account Settings.
• Cancel Subscriptions: You can manage or cancel your active subscription plan via the billing dashboard.
• Support Requests: You can reach out to our support team for data deletion requests.

12. Security Measures

We implement industry-standard administrative, physical, and technical safeguards—including TLS encryption in transit, AES-256 encryption at rest for secrets, strict server-side authorization checks, and row-level data isolation—to protect against unauthorized access or alteration.

13. Data Retention

We retain information for as long as reasonably necessary to provide the service, maintain security, meet operational requirements, and comply with applicable legal obligations. When an integration is disconnected, associated encrypted tokens are deleted.

14. Changes to this Policy

We may update this Privacy Policy from time to time. Any changes will be published on https://www.inboxiq.online/privacy with an updated effective date.