Acceptable Use Policy

1. Purpose and scope

Inboxy helps people manage their own email: sorting it, flagging threats, drafting replies and keeping on top of what needs attention. It is not a bulk-mailing platform, a data-collection tool or a way to get into other people’s accounts. This Acceptable Use Policy (“policy”) explains the uses that are not allowed.

The policy applies to all parts of Inboxy — the web app, desktop and mobile apps, the Slack app, the Telegram bot, our APIs and our website — and to everyone who uses them, including people using Inboxy on behalf of an organisation. In this policy, “we”, “us” and “our” mean [Nexlla Creative Agency — registered legal name], trading as Nexlla Creative Agency, and “you” means the user. Capitalised terms not defined here have the meanings given in the Terms of Service.

The examples below are not exhaustive. We may treat any use that is unlawful, harms others or threatens the security or integrity of Inboxy as a breach of this policy even if it is not specifically listed. You are also responsible for complying with the terms of the email providers and other services you connect to Inboxy. If you are unsure whether something is allowed, ask us at [email protected] before doing it.

2. Spam and bulk unsolicited mail

You must not use Inboxy to send, or to help anyone send, unsolicited or unwanted messages. In particular, you must not:

• send bulk, commercial or promotional email to people who have not agreed to receive it, or in breach of applicable anti-spam and electronic marketing laws;
• use Inboxy’s drafting, persona or template features to produce large numbers of near-identical messages for mass distribution or cold outreach campaigns;
• use purchased, rented, harvested or scraped address lists, or send to addresses generated by guessing or “dictionary” techniques;
• disguise the origin of a message, forge or manipulate headers, use misleading subject lines, or omit a working opt-out where the law requires one;
• continue to email someone who has asked you to stop, where the law requires you to honour that request;
• use Inboxy in a way that causes your connected account, or our infrastructure, to be blocklisted or to exceed your mail provider’s sending limits.

Ordinary personal and business correspondence, including replying to people who wrote to you, is of course fine.

3. Phishing, impersonation and fraud

You must not use Inboxy to deceive or defraud anyone. This includes:

• sending phishing messages or any message designed to trick recipients into revealing passwords, payment details, one-time codes or other sensitive information;
• impersonating any person, company, brand or government body, or falsely implying an affiliation with or endorsement by them — including by misusing signatures, personas, profile photos or display names;
• business email compromise, invoice or payment-redirection fraud, advance-fee scams, fake job offers, romance scams or similar schemes;
• using Inboxy to manage mailboxes used for fraud, money laundering or any other financial crime;
• misrepresenting yourself to us, for example to obtain an account after one was terminated.

4. Malware and harmful code

You must not use Inboxy to create, store, send or distribute viruses, worms, ransomware, spyware, trojans, cryptominers or any other malicious or harmful code, files or links — including links to sites hosting such material. You must not upload content to Inboxy (for example as an avatar, signature or attachment) that is designed to exploit vulnerabilities in our service, in other software or in recipients’ devices.

5. Illegal and harmful content

You must not use Inboxy to create, store, send, request or facilitate content or conduct that is unlawful or seriously harmful, including:

• Child sexual abuse material. Any content that sexually exploits or endangers children. We have zero tolerance for this material. Where we become aware of it, we will terminate the account immediately, preserve relevant information as the law requires, and report it to the competent law enforcement authorities and child-protection organisations.
• Terrorism and violent extremism. Content that promotes, supports, plans or incites terrorism or violent extremism, or that recruits for or finances such groups.
• Hate and incitement. Content that incites violence or hatred against people based on race, ethnicity, national origin, religion, disability, sex, gender, age or another protected characteristic, or that is otherwise prohibited by applicable law.
• Harassment and threats. Threats of violence, stalking, intimidation, bullying, blackmail, extortion, sharing intimate images without consent, or repeated unwanted contact intended to distress someone.
• Intellectual property infringement. Sending or distributing material that infringes copyrights, trademarks, trade secrets or other intellectual property rights. Rights holders can use our Copyright Policy to raise a complaint.
• Privacy violations. Collecting, disclosing or processing other people’s personal data unlawfully — for example doxxing, sharing someone’s confidential information without authorisation, or processing sensitive personal data in breach of applicable data protection law.
• Other unlawful activity. Promoting or facilitating the sale of illegal goods or services, illegal gambling, or any other activity that breaks the laws of the United Arab Emirates or the laws that apply to you.

6. Misuse of AI features

Inboxy’s AI features are designed to help you with your own email. You must not:

• Generate deceptive or harmful content — such as phishing or scam emails, disinformation, content that impersonates real people, or content that would breach any other part of this policy — or use AI drafts to mislead recipients about who wrote a message where that would be unlawful or deceptive.
• Attack the service with prompt injection — crafting messages, rules, signatures, personas or other inputs intended to manipulate the AI features into ignoring their instructions, taking unintended actions or behaving harmfully, whether against your own account or to target another Inboxy user (for example by emailing them content designed to hijack their assistant).
• Try to extract data or instructions — attempting to obtain other users’ data, our system prompts, model instructions, redaction rules or other confidential configuration from the AI features.
• Circumvent safeguards — trying to bypass the protections we apply, such as redaction of personal data before cloud processing, or the rule that the AI never agrees to payments or shares credentials.
• Generate content at high volume through automation — using scripts, bots or other automated means to generate drafts, summaries or other output in bulk, or using Inboxy as a general-purpose AI service unrelated to managing your email.
• Break the AI provider’s rules — using Cloud AI in a way that would breach the usage policies of our AI provider, which we may need to enforce on its behalf.
• Build competing models — using output to develop or train AI models that compete with Inboxy or our providers.

Remember that you are responsible for every message you send, including one drafted by Inboxy. See section 8 of the Terms of Service.

7. Scraping, automation and account misuse

Unless we have agreed otherwise in writing, you must not:

• use bots, scrapers, crawlers or other automated means to access the service or collect data from it, other than the Apps and integrations we provide and their documented features;
• access or use our APIs except through the Apps, or use undocumented interfaces;
• decompile, disassemble or reverse engineer the Apps or the service, except to the extent mandatory law expressly permits this despite this restriction;
• evade, disable or work around rate limits, usage limits, account lockouts, two-factor authentication, device pairing or other access controls — for example by rotating IP addresses or creating multiple accounts;
• share your account or sign-in credentials with others, or let several people use one account;
• sell, resell, rent, lease, sublicense or otherwise commercialise access to Inboxy, or offer it as part of a service to third parties;
• create accounts in bulk, by automated means, or using false information.

8. Interfering with the service

You must not disrupt or degrade Inboxy or the experience of other users. This includes:

• denial-of-service attacks, flooding, mail bombing or sending excessive traffic or requests;
• uploading content designed to consume excessive resources — for example deliberately pathological rules or regular expressions, oversized or malformed files, or messages crafted to crash our parsers;
• using Inboxy to probe, attack or make requests to internal networks or third-party systems (for example by configuring a custom IMAP, SMTP or CalDAV server, image link or unsubscribe link that points at a system you are not authorised to test);
• circumventing or tampering with our security measures, such as content sanitisation, the image proxy or request signing;
• interfering with any connected provider’s service through Inboxy.

9. Unauthorised access to mailboxes

You may connect only mailboxes, calendars and other accounts that you own or that you are authorised to access and connect to a third-party app. You must not:

• connect someone else’s account without their permission, including a partner’s, family member’s, colleague’s or former employer’s account;
• connect an employer’s or organisation’s account where its policies prohibit third-party email clients or AI processing;
• use stolen, leaked or guessed passwords, app passwords, tokens or pairing codes;
• keep using access to an account after your authorisation has ended (for example, after leaving a job);
• use Inboxy to monitor, intercept or read another person’s communications without lawful authority.

If we receive credible information that a connected account is being used without authorisation, we may disconnect it immediately.

10. Security testing

We value the work of security researchers. You may test Inboxy’s security only in accordance with our responsible disclosure guidelines, and only within these rules:

• test only against accounts you created and own, using your own test data;
• do not access, modify, delete or retain other users’ data — if you encounter it, stop, and report it to us immediately;
• no denial-of-service, load or stress testing, and no testing that degrades the service for others;
• no social engineering, phishing or physical attacks against our staff, contractors, users or offices;
• no attacks on our third-party providers or connected services (such as Google, Microsoft, Slack or Telegram), which have their own programmes;
• no automated scanning at volumes that could disrupt the service;
• report findings promptly and privately to [email protected], and give us reasonable time to fix them before any public disclosure.

Research carried out in good faith and in line with these rules and our disclosure guidelines will not be treated as a breach of this policy. Testing outside these rules is prohibited.

11. Slack and Telegram integrations

If you link the Inboxy Slack app or Telegram bot, you must also follow Slack’s and Telegram’s own terms and policies. You must not:

• link an Inboxy account to a Slack workspace, channel or Telegram chat where people who are not authorised to see your email can read the summaries or messages delivered there;
• forward, expose or post other people’s email content into shared channels or groups without a lawful basis;
• use the integrations to send spam, automate bulk actions or bypass Inboxy’s review step, for example by scripting the Send, Edit or Archive buttons;
• forge, replay or tamper with requests to our integration endpoints, or share one-time linking codes with anyone else;
• install or use the Slack app in a workspace in breach of that workspace’s administrator policies.

12. Reporting abuse

If you believe someone is using Inboxy in breach of this policy — for example, you received spam or a phishing message sent through Inboxy, or you believe your mailbox has been connected without your permission — please tell us:

• Abuse and policy violations: [email protected]. Where possible, include the full message headers, the date and time, and a description of the problem.
• Security vulnerabilities: [email protected], following our reporting guidelines.
• Copyright complaints: follow our Copyright Policy.

We review reports promptly and treat them confidentially, sharing your identity only where necessary to act on the report or where the law requires. Please don’t send us illegal material such as child sexual abuse material; instead describe where you found it and report it directly to law enforcement. We may not be able to tell you the outcome of an investigation because of privacy or legal restrictions. Because Inboxy does not run anyone’s mailbox, you may also want to report abuse to the sender’s email provider.

13. Enforcement

We may investigate suspected breaches of this policy. Because your content is encrypted and we do not routinely read it, we rely on reports, provider notices, automated security signals and similar information, and we access content only to the extent necessary for an investigation, as described in our Privacy Policy. Depending on the seriousness and circumstances of a breach, we may take one or more of these actions:

• issue a warning and ask you to stop or remediate the issue;
• remove or disable access to content, rules, signatures, personas or integrations;
• apply rate limits or restrict specific features, such as AI features or integrations;
• disconnect a connected account;
• temporarily suspend your account;
• permanently terminate your account, as described in the Terms of Service, and refuse future registrations;
• report the matter to, and cooperate with, law enforcement or regulatory authorities where we are required to or believe in good faith that it is necessary;
• cooperate with connected providers (such as Google, Microsoft, Slack or Telegram) and with affected parties to stop the abuse, where lawful.

Where reasonable, we will tell you what we are doing and why, and give you an opportunity to respond or fix the problem first. We may act immediately and without notice where a breach is serious, puts other people or the service at risk, or where the law requires it. Our choice not to act in one case does not waive our right to act in another. If you believe we made a mistake, contact [email protected] and we will review the decision.

14. Changes to this policy

We may update this policy to address new risks, features or legal requirements. We will post the updated version here and change the “Last updated” date. If we make a material change, we will notify you in advance as described in the Terms of Service, unless the change is needed urgently to address abuse, a security threat or a legal requirement.

15. Contact

Questions about this policy can be sent to [email protected], or by post to [Nexlla Creative Agency — registered legal name], [Registered address — street, building, city, Emirate, United Arab Emirates]. For security matters, write to [email protected].

Questions about this document? Write to [email protected].