Privacy Policy

1. Who we are

Inboks is owned and operated by Lunik L.L.C. This policy explains how we handle personal information collected through our website, app, account registration, plan requests, and related communications.

Customer businesses generally decide how conversation, customer, booking, and team data in their workspace is used. Inboks processes that workspace content on their behalf. Lunik L.L.C. is responsible for account administration, service operation, security, support, and its direct business relationships.

Questions and privacy requests can be sent to info@inboks.app.

2. Information we collect

When you visit the website, use the app, create an account, or purchase a subscription, we may collect:

• Your name, business name, and email address.
• The communication channels you connect and information provided during signup.
• Workspace membership, authentication identifiers, customer/contact details, messages, notes, tags, and booking, appointment, inventory, order, and payment records used by your workspace.
• Photos, videos, audio recordings, and documents you choose to attach or upload.
• Notification settings and device/installation identifiers needed to deliver optional mobile push notifications and bind them to the right account, workspace, and session.
• Language, approximate country, time zone, browser preferences, and the registration page.
• UTM parameters and advertising click identifiers included in your registration link.
• Pages viewed, approximate location, device details, and signup, trial, or purchase activity when you allow optional analytics.
• Plan requests, billing contacts, invoices, and non-sensitive payment references.
• Technical information needed to run, secure, and troubleshoot the website and forms.

3. How we use information

We use this information to:

• Create and manage your Inboks account and workspace.
• Review plan requests, issue invoices, reconcile confirmed payments, and provide paid access.
• Send account, billing, product, and service-related communications.
• Understand how businesses use Inboks and improve the product.
• Measure campaign performance, prevent abuse, and maintain the security and reliability of the service.
• Comply with applicable legal obligations and respond to valid requests.

As permitted by law, we rely on consent, the need to provide the service, and legitimate interests such as product planning, security, and communication measurement.

4. Google services and Gmail data

When a workspace administrator connects Gmail, Inboks requests the Google account email, read-only Gmail access, and permission to send Gmail messages. We use this only to identify the connected mailbox, import recent Inbox and Sent threads, show them to authorized workspace members, retrieve attachments they open, and send replies or forwards they start in Inboks.

Imported message bodies, headers, participant addresses, timestamps, thread identifiers, and attachment metadata are stored in the customer workspace so the shared inbox can work. Google access and refresh tokens are encrypted at rest. Gmail data is not sold, used for advertising or creditworthiness, or used to train generalized artificial intelligence models. It is shared only with authorized workspace members and confidential service providers needed to operate and secure Inboks.

A workspace administrator can disconnect Gmail at any time. This removes stored Google tokens and imported Gmail conversations and messages from that workspace. Users can also revoke Inboks access in their Google Account permissions. Inboks's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

5. AI data sharing with OpenAI

AI reply drafts, previews, and automatic agent responses share selected workspace context with OpenAI only after a workspace administrator explicitly allows it in Settings → AI agent. Depending on the feature and selected sources, this can include customer and sender names, recent conversation text, a preview question, saved replies, and relevant booking, appointment, room, availability, business, or inventory details. Requests are limited to the current workspace and the context bounds of each feature.

We record the permission version, time, administrator, and language. Sharing can be withdrawn in AI settings to block future requests, including queued work. Data already sent and requests already in progress cannot be recalled. Without permission, these AI features do not generate responses and manual messaging remains available. Social Shop uses a separate permission for its own data sharing. OpenAI processes requests under its applicable service terms; disabling response storage does not mean that no data is shared.

6. Service providers and advertising tools

We use service providers to host the website and app, process registrations and plan requests, and send email. This includes Cloudflare and Resend, which process information under their contractual and security obligations.

The app also uses hosting, database, monitoring, authentication, and connected-channel services. Information is shared as needed to operate those services, follow the customer workspace's instructions, protect Inboks, or meet a legal obligation. Connected messaging providers exchange the account and message data needed to authenticate channels and receive or send messages. Apple processes optional iOS push notification delivery.

Paddle is the authorized reseller and merchant of record for paid subscriptions. It may process contact, billing, transaction, device, fraud-prevention, and tax information to complete orders, manage subscriptions, issue receipts or invoices, prevent fraud, support buyers, and meet legal obligations. Paddle may share limited order and customer information with Inboks for service fulfilment, reconciliation, fraud prevention, and support. Paddle acts under its own privacy notice. Card details are entered through Paddle Checkout and are not collected or stored by Inboks.

With your approval, we may use Google Tag Manager, Google Analytics, PostHog, Ahrefs Web Analytics, and advertising tools to measure visits, registrations, trials, purchases, and which homepage version helps visitors sign up. These browser-based tools load only after you allow analytics, and you can change that choice in Privacy choices. Campaign parameters in a link may be stored with an account or transaction record even when browser-based measurement is off.

With your analytics consent, PostHog measures website visits and signup link clicks. An anonymous first-party identifier can connect your website visit to a completed account signup in the app. Website session recordings and automatic capture of page interactions are disabled. You can withdraw analytics consent in Privacy choices.

When configured, the app also sends server-side product measurement to PostHog. These events can include an account user identifier, workspace identifier, role, and session identifier. They use bounded product milestones and exclude names, email addresses, and conversation content. Browser analytics choices do not control this server-side measurement; essential service, security, and billing records also operate independently of browser measurement.

We do not sell personal information.

7. Retention and security

We keep account, attribution, and plan-request information while needed to manage access, communicate with you, keep required business records, reconcile payments, and meet legal or security requirements. We delete or anonymize information when it is no longer needed, subject to limited backups and legal retention periods.

We use reasonable technical and organizational measures to protect information, but no online service can guarantee absolute security.

8. Your choices and rights

You may ask to access, correct, delete, or restrict the use of your information, or withdraw consent where applicable. Rights vary by location and may be subject to legal exceptions.

Personal account deletion is available in the app's Danger zone settings. It removes reusable account/session/device access and anonymizes former-member attribution; workspace-owned shared records can remain for the customer business. Closing a workspace has a broader data scope and handles paid-subscription cancellation before deletion. Authentication, sole-owner/admin safeguards, provider-revocation processing, backups, and required legal or billing retention can affect how deletion is completed.

See our Data Deletion Instructions or email info@inboks.app.

9. International processing and children

Our service providers may process information in countries other than your own. Where required, we use appropriate safeguards. Inboks is for business users aged 18 or older.

10. Changes to this policy

We may update this policy as Inboks changes. The date at the top shows the latest version. We will communicate material changes where required.