Privacy Policy

1. Introduction

This Privacy Policy explains how [TODO: legal entity name] (“GoodInboxes,” “we,” “us”) collects, uses, shares, and protects personal information when you use the GoodInboxes website and services (the “Service”). It applies to our customers and website visitors. It does not govern how you, as a sender, process the personal data of your own email recipients — for that processing you are the controller and are responsible for your own compliance.

Our registered address is [TODO: registered business address]. For privacy questions, contact us at [TODO: confirm] support@goodinboxes.com.

2. Information we collect

We collect the following categories of information:

• Account information — your name, email address, organization name, and login credentials when you create an account.
• Billing and registrant profile — the contact and billing details you provide, which are also used as the domain registrant information when we register a domain on your behalf (as required by ICANN).
• Payment information — payments and wallet top-ups are processed by Stripe. Your full card number is entered directly with Stripe and is not stored by us; we retain limited details such as the last four digits, card brand, and transaction records needed for billing and accounting.
• Service data — the domains, inboxes, and orders in your account, and the operational status of provisioning and renewals.
• Usage and device data — log data such as IP address, browser type, pages viewed, and timestamps, collected automatically when you use the Service.

3. How we use information

We use personal information to:

• Provide, operate, and maintain the Service, including provisioning and renewals;
• Register domains and create Google Workspace mailboxes on your behalf;
• Process payments, manage your wallet, and send billing and renewal notices;
• Provide support and communicate with you about your account;
• Monitor, secure, and improve the Service and prevent abuse and fraud; and
• Comply with legal obligations.

Our legal bases (where GDPR applies) include performance of our contract with you, our legitimate interests in operating and securing the Service, your consent where required (for example, certain cookies), and compliance with legal obligations.

4. How Google Workspace inbox credentials are handled

As part of the Service we create Google Workspace mailboxes and generate their credentials so we can hand them off to you. Inbox credentials are sensitive: we store them under strict access controls — restricted to authorized service systems and never exposed to other customers — and make them available to you through your authenticated dashboard. We minimize who can access them and log sensitive access to credentials internally. You are responsible for how you store and use credentials after they are handed to you, including within any third-party sending tools you connect.

5. Sub-processors and sharing

We share personal information with service providers (“sub-processors”) that help us run the Service, under contracts that require them to protect it. Our key sub-processors include:

• Stripe — payment processing and wallet top-ups;
• Supabase — application database, authentication, and hosting of account and service data;
• Google (Google Workspace and Google APIs) — mailbox creation, licensing, and management;
• Cloudflare — DNS, domain-related infrastructure, and network security; and
• Email and automation infrastructure — providers used for transactional email and provisioning automation.

We may also disclose information to comply with law, enforce our agreements, or protect the rights, safety, and security of GoodInboxes, our customers, and the public. If we undergo a merger, acquisition, or asset sale, information may be transferred as part of that transaction. We do not sell your personal information.

6. Cookies and analytics

We use cookies and similar technologies that are necessary to operate the Service (for example, to keep you signed in) and, where applicable, to understand usage and improve the Service. Where required by law, we request consent for non-essential cookies. You can control cookies through your browser settings, though disabling essential cookies may prevent parts of the Service from working. [TODO: confirm the specific analytics provider(s) in use and add them here and to the sub-processor list.]

7. Data retention

We retain personal information for as long as your account is active and as needed to provide the Service, and thereafter as required to meet our legal, accounting, tax, and dispute-resolution obligations. Billing and transaction records are typically retained for the period required by applicable law. When information is no longer needed, we delete or anonymize it. Inbox credentials associated with a de-provisioned or terminated inbox are removed in the ordinary course once they are no longer required.

8. Your rights (GDPR and CCPA)

Depending on where you live, you may have rights over your personal information, including the rights to access, correct, delete, and export (data portability) your information, to object to or restrict certain processing, and to withdraw consent. If you are in the EU/UK, these rights arise under the GDPR; if you are a California resident, you have rights under the CCPA/CPRA, including the right to know, delete, and correct, and the right not to be discriminated against for exercising them. We do not sell or “share” personal information as those terms are defined under California law.

To exercise any of these rights, contact us at [TODO: confirm] support@goodinboxes.com. We will respond within the timeframe required by applicable law. You also have the right to lodge a complaint with your local data-protection authority.

9. International data transfers

We and our sub-processors may process and store information in countries other than the one in which you reside, including the United States. Where we transfer personal information across borders, we rely on appropriate safeguards required by applicable law, such as the European Commission’s Standard Contractual Clauses, to protect that information. [TODO: confirm the transfer mechanism(s) relied on with counsel.]

10. Security

We take reasonable technical and organizational measures to protect personal information, including encryption in transit, strict access controls that keep sensitive data such as inbox credentials restricted to authorized service systems, and internal logging of sensitive access. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

11. Children’s privacy

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us personal information, contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “last updated” date above and, where appropriate, notify you. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

13. Contact us

For any privacy question or request, contact us at [TODO: confirm] support@goodinboxes.com, or by mail at [TODO: registered business address]. [TODO: if required, name an EU/UK representative or Data Protection Officer here.]