Privacy Policy

1. Who we are

Inboxy is a privacy-first AI email assistant. It brings your email accounts into one inbox, sorts and prioritises your mail, drafts replies in your voice, and helps you reach Inbox Zero.

Inboxy is provided by [Nexlla Creative Agency — registered legal name], trading as Nexlla Creative Agency, a [Legal form] registered under licence number [Trade licence number] with [Licence issuing authority], with its registered address at [Registered address — street, building, city, Emirate, United Arab Emirates], United Arab Emirates (“Inboxy”, “we”, “us” or “our”).

Controller

For personal data you provide to us or that we collect when you use Inboxy as an individual, we are the controller (under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and the GDPR) — the organisation that decides why and how your personal data is processed.

Privacy contacts

• Privacy team: [email protected] — for questions, requests and complaints about this policy.
• Data Protection Officer: [email protected] — you may contact our Data Protection Officer directly about any matter relating to the processing of your personal data.
• Postal address: [Nexlla Creative Agency — registered legal name], Attn: Privacy, [Registered address — street, building, city, Emirate, United Arab Emirates], United Arab Emirates.

Representatives in the EU and UK

Because we are established outside the European Economic Area and the United Kingdom, we have appointed representatives under Article 27 of the GDPR and the UK GDPR. You and supervisory authorities can contact them about any matter relating to our processing of personal data:

• EU representative: [EU representative under GDPR Art. 27 — name and address, if appointed]
• UK representative: [UK representative under UK GDPR Art. 27 — name and address, if appointed]

When we act as a processor

If an organisation (for example, your employer) provides Inboxy to you under a business agreement, that organisation may be the controller of the data processed through its accounts, and we act as its processor under our Data Processing Addendum. In that case the organisation’s own privacy notice also applies, and you should direct requests about your data to it first; we will help it respond. This policy still describes how Inboxy itself works and how we handle data we process as a controller (for example, account security records).

2. Scope of this policy

This policy applies to personal data we process when you:

• use the Inboxy web app (including the installable app at https://inboxy.nexlla.com/app/), our macOS and Windows desktop apps, and our iPhone and Android apps;
• connect email accounts, calendars or other services to Inboxy;
• use our Slack app or Telegram bot;
• visit our website at https://inboxy.nexlla.com;
• contact us for support, report a security issue, or otherwise communicate with us.

This policy does not cover services we do not control, such as Google, Microsoft, Apple, Proton, Yahoo, Fastmail, Slack, Telegram, Gravatar or any other provider you connect. Their own privacy policies govern how they process your data. Inboxy is not affiliated with, endorsed by or sponsored by any of them.

This policy should be read together with our Terms of Service, Cookie & Local Storage Policy, Security page and Sub-processors list.

Some of the people whose data Inboxy processes are not Inboxy users — for example, the people who write to you or whom you write to. Their names, addresses and messages reach Inboxy only because they are in your mailbox. We process that data on your behalf, solely to provide Inboxy to you, with the same protections described in this policy.

3. Data we collect

We collect only what we need to provide the features you use. The table below lists each category, what it includes, and where it comes from.

What we do not collect

• We do not use advertising identifiers (IDFA or Android Advertising ID), analytics SDKs, fingerprinting, tracking pixels or third-party cookies in any app or on our website.
• We do not collect precise location. IP addresses appear only in security events and transiently while a request is processed.
• We do not ask for special categories of personal data (such as health, religion or biometric data). Your mailbox may nonetheless contain such information in messages you receive or send; we process it only to provide Inboxy to you, with the same protections as the rest of your mail, and never to profile you.
• We do not collect payment card details. Inboxy is currently free. If paid plans are introduced, prices and terms will be shown before you buy, and we will update this policy to describe any payment data involved.

If you do not provide data

Account data and credentials are needed to create and secure an account. Connecting a mailbox is needed for Inboxy to do anything useful. Calendars, push notifications, integrations, Cloud AI and profile-photo publishing are optional; Inboxy works without them.

4. How we use your data

We use personal data only for the following purposes:

1. Providing Inboxy. Creating and managing your account; syncing, displaying, searching and sending mail; applying labels and priority; tracking Needs Reply and Awaiting Reply; generating drafts and summaries; building Inbox Zero plans; bulk unsubscribe (using RFC 8058 one-click links and mailto: links only); suggesting free meeting slots and creating events; applying signatures, personas and rules; syncing your setup across devices; and delivering notifications and Slack or Telegram summaries you enable.
2. Personalisation you can see. Learning your voice profile so drafts sound like you, and using sender statistics to prioritise mail and suggest unsubscribes. This personalisation is for your own use only; it is never used for advertising.
3. Protecting you and Inboxy. Detecting phishing (brand spoofing, authentication failures, Reply-To mismatches, pressure language); authenticating you; enforcing rate limits and lockouts; detecting and investigating abuse, fraud and security incidents; and keeping an audit log you can review.
4. Operating and improving the service. Monitoring reliability and performance using server logs, fixing bugs, and improving features. We do this with logs and aggregate operational measurements, not by reading your mail.
5. Communicating with you. Sending service emails (verification, password reset, security alerts, important changes to our terms or this policy) through our transactional email provider, [Transactional email provider — confirm], and answering support requests. We do not send marketing email without your consent.
6. Legal and compliance. Complying with applicable law, responding to lawful requests, enforcing our Terms and Acceptable Use Policy, and establishing, exercising or defending legal claims.

Our commitments: we do not sell your personal data; we do not use it for advertising or build advertising profiles; and we do not use the content of your email — or any data received from Google, Microsoft or any other provider — to train artificial-intelligence or machine-learning models, ours or anyone else’s.

We will not use your personal data for a new purpose that is incompatible with the purposes above without telling you first and, where the law requires, asking for your consent.

5. Legal bases

Privacy laws require us to have a lawful ground for each use of personal data. Under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), we process personal data with your consent or, where the law allows processing without consent, because it is necessary to perform a contract with you or take steps at your request before entering into one, to comply with obligations under UAE law, to protect your vital interests, or to establish, exercise or defend legal claims. Under the GDPR and UK GDPR (Article 6), we rely on the bases shown in the table. Comparable grounds apply under the Saudi, Omani and Qatari laws described in section 14.

Where we rely on consent, you can withdraw it at any time in Settings or by contacting us. Withdrawal does not affect processing that took place before it. Where we rely on legitimate interests, we have balanced those interests against your rights and expectations, and you can object (see section 14). You can ask us for details of that balancing test.

6. AI processing and redaction

Much of Inboxy’s intelligence — labels, priority, Needs Reply detection, phishing signals, search and Inbox Zero planning — works without a large language model. For drafts and summaries, you choose one of three modes in Settings, and you can change it at any time:

• Cloud AI. Before any text leaves Inboxy, our redaction step automatically replaces personal details with placeholder tokens such as ⟦EMAIL_1⟧. It covers email addresses, phone numbers, payment card numbers (verified with the Luhn check), bank account numbers (IBANs, verified with the mod-97 check), social security and other government ID numbers, API keys, JSON Web Tokens, passwords and signed URLs. The redacted text is sent to Anthropic’s Claude API only to produce your draft or summary. The real values are restored inside Inboxy afterwards; they are never sent to the AI provider.
• On-device AI. Drafts and summaries are produced by a model running on your own computer through Ollama. Your email text is not sent to any AI provider.
• AI off. No language model is used. Labels, priority and template-based drafts still work.

Redaction is automated pattern detection. It substantially reduces what an AI provider receives, but it cannot recognise every possible personal detail (for example, a name or address written in free text). If that matters for a particular mailbox, choose On-device AI or AI off.

Our AI provider

When you use Cloud AI, Anthropic, PBC acts as our processor (sub-processor where we act as processor). Under Anthropic’s commercial terms, data submitted through its API is not used to train its models. Anthropic may retain API inputs and outputs for a limited period for trust and safety purposes before deleting them: [retention period per Anthropic’s current commercial terms] To confirm. Details are on our Sub-processors list.

Safeguards on what AI can do

• Drafts only. AI writes drafts. Nothing is sent from your mailbox until you press send.
• Guardrails. Our instructions to the model forbid agreeing to payments or sharing credentials. Automations, such as rules, never act on a language model’s output alone.
• No training. Your email content is never used to train, fine-tune or evaluate AI models — ours or anyone else’s.
• Voice profile. To make drafts sound like you, we derive statistics from your sent mail (greetings, sign-offs, formality and similar). We store the statistics, not a corpus of your sent mail, and raw sent mail is not used as a prompt library.

AI output may be inaccurate. Review every draft and summary before relying on it. See also our Terms on AI features.

7. Google user data (Limited Use disclosure)

If you connect a Google account, Inboxy asks for the minimum access needed, using OAuth 2.0 with PKCE. We never see your Google password. The access we request is:

• Gmail (gmail.modify) — to read, search and organise your mail, apply and remove labels, archive, move to trash, mark as read, create drafts you approve, and send messages you choose to send. We do not request permission to permanently delete your mail.
• Google Calendar (optional) — to read events and free/busy time to suggest meeting slots, and to create events you ask us to create.
• Basic profile (openid, email, profile) — to identify which Google account you connected.

Inboxy’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, for data we receive from Google APIs (including Gmail data):

• We only use it to provide and improve user-facing features that are visible and prominent in Inboxy’s interface.
• We do not transfer it to others except as necessary to provide or improve those features (for example, sending redacted text to our AI provider when you have Cloud AI turned on), to comply with applicable law, for security purposes, or as part of a merger, acquisition or sale of assets after giving you notice.
• We do not use or transfer it to serve advertisements, including retargeting, personalised or interest-based advertising.
• We do not sell it, and we do not use it to determine creditworthiness or for lending purposes.
• We do not allow humans to read it unless you give us affirmative agreement to view specific messages (for example, when you ask support for help with a particular email), it is necessary for security purposes such as investigating abuse, it is required to comply with applicable law, or the data has been aggregated and anonymised for internal operations in line with applicable law.
• We do not use it to develop, improve or train generalised or non-personalised AI or machine-learning models.

Because Inboxy uses a restricted Gmail scope, our handling of Google user data is subject to Google’s OAuth verification and an annual independent security assessment (CASA).

You can disconnect a Google account in Inboxy at any time. When you remove it, we revoke Inboxy’s Google grant and purge the synced data after the restore window described in section 12. You can also revoke Inboxy’s access directly from your Google Account permissions page.

8. Microsoft user data

If you connect an Outlook.com or Microsoft 365 account, Inboxy uses Microsoft’s identity platform with OAuth 2.0 and PKCE and requests the minimum Microsoft Graph permissions needed. We never see your Microsoft password. The access we request is:

• Mail (Mail.ReadWrite, Mail.Send) — to read, search and organise your mail, apply categories, move and archive messages, create drafts you approve and send messages you choose to send.
• Calendar (optional) (Calendars.ReadWrite) — to read events and free/busy time and create events you ask for.
• Profile and photo (User.Read, and User.ReadWrite only if you choose to publish your Inboxy profile photo to Microsoft 365) — to identify your account and, at your request, update your photo.
• offline_access — so syncing continues while you are not signed in to Inboxy.

We apply to Microsoft data the same commitments we make for Google data in section 7: we use it only to provide user-facing features; we never sell it, use it for advertising, use it for credit decisions, or use it to train AI models; we transfer it only as needed to provide those features, for security, to comply with the law, or in a business transfer after notice; and humans read it only with your agreement, for security, or where the law requires.

You can disconnect a Microsoft account in Inboxy at any time. You can also revoke access at account.live.com/consent/Manage (personal accounts) or, for work and school accounts, through the Microsoft 365 admin center or My Apps, or by asking your administrator.

The same principles apply to every other provider you connect — iCloud, Yahoo, Fastmail, Proton Mail Bridge, CalDAV servers, any IMAP/SMTP server, and WordPress.com for Gravatar.

9. Sharing and disclosure

We share personal data only in the following cases, and only as much as is needed:

• Service providers (processors and sub-processors). Companies that help us run Inboxy under written contracts that require them to process data only on our instructions, keep it confidential and secure it: hosting and storage ([Hosting provider — confirm], [Hosting region — confirm]); our Cloud AI provider (Anthropic) when you use Cloud AI, receiving redacted text only; transactional email ([Transactional email provider — confirm]) for verification and password-reset emails; and push delivery (Google Firebase Cloud Messaging, and Apple Push Notification service). The current list, with locations and purposes, is on our Sub-processors page.
• Your email and calendar providers, at your direction. To sync and send mail and events, we exchange data with the providers you connect (for example Google, Microsoft, Apple iCloud, Yahoo, Fastmail, your IMAP/SMTP server, or Proton Mail Bridge on your own computer). These providers process data under their own terms.
• Integrations you enable. If you link Slack or Telegram, we send the summaries and notifications you set up to that service. By default these contain summaries, never full email bodies. If you publish your profile photo, we send it to Microsoft 365 or Gravatar. These services are independent controllers of the data they receive.
• Unsubscribe requests. When you use bulk unsubscribe, we send the sender’s own one-click (https:) unsubscribe request or mailto: message, which reveals to that sender that your address wants to unsubscribe.
• Firebase and Google for push. Notification payloads and push tokens pass through Firebase Cloud Messaging (and, for iPhone, Apple’s APNs). See section 10.
• Legal requirements. We may disclose data if required by applicable law, regulation, court order or other valid legal process, or where necessary to protect the rights, property or safety of our users, the public or Inboxy. We review each request, push back on requests that are overbroad or not legally valid, disclose the minimum required and, where permitted, tell you before disclosing your data.
• Business transfers. If we are involved in a merger, acquisition, financing, reorganisation or sale of assets, your data may be transferred to the successor, which will be bound by this policy. We will notify you before your data becomes subject to a different privacy policy.
• With your consent. In any other case, only with your explicit consent — for example, when you ask us to share a specific message with support.

We do not sell personal data, and we do not share personal data for cross-context behavioural advertising, as those terms are defined under the California Consumer Privacy Act and similar US state laws. We have not done so in the past 12 months.

Within Inboxy, access to production systems is limited to a small number of authorised staff who need it to operate the service, under confidentiality obligations. Your vault is encrypted with your own key, and staff do not read mailbox content except as described in section 7.

10. Push notifications

If you allow notifications on a device, we use Firebase Cloud Messaging (provided by Google) to deliver them to Android, to iPhone (through Apple Push Notification service, relayed by Firebase) and to browsers using web push. We may also deliver directly through Apple Push Notification service.

• Push token. Your device gives us a push token. We store it encrypted in your vault and delete it when you sign out on that device, turn notifications off, or the token becomes invalid.
• Content levels. You choose what a notification contains in Settings:
  • None — generic text only (for example, “New email”), with no sender or content;
  • Summary (default) — the sender and a one-line AI summary;
  • Full — the subject and a short snippet of the message.
• Payload. Every notification also contains a thread identifier or link so tapping it opens the right conversation.
• Who sees it. Notification content passes through Google’s and, for Apple devices, Apple’s push infrastructure, and appears on your lock screen according to your device settings. Choose “None” if you prefer that no message details leave Inboxy in notifications.
• Turning it off. Change the content level or disable notifications in Inboxy’s Settings, revoke notification permission in your device or browser settings, or sign out of the device.

11. International transfers

We are based in United Arab Emirates. Our servers are hosted by [Hosting provider — confirm] in [Hosting region — confirm]. Some of our service providers — for example our AI provider (Anthropic) and Google Firebase — are based in, or process data in, the United States and other countries. Your data may therefore be processed outside the country where you live.

Whenever personal data is transferred across borders, we put appropriate safeguards in place:

• From the UAE. Under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), personal data may be transferred abroad to countries whose laws provide an adequate level of protection, as determined by the UAE Data Office, or, where no adequacy decision exists, under the other conditions the law allows — including contracts that bind the recipient to protection standards equivalent to the PDPL, your express consent where appropriate, or where the transfer is necessary to perform our contract with you (for example, to connect to the email provider you chose).
• From the EEA. We rely on European Commission adequacy decisions where available (including the EU–US Data Privacy Framework for certified recipients) and otherwise on the Standard Contractual Clauses adopted by the Commission, with supplementary measures where needed.
• From the UK. We rely on UK adequacy regulations (including the UK Extension to the Data Privacy Framework) or on the International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses.
• From Saudi Arabia, Oman, Qatar and other countries. We follow the cross-border transfer rules of those laws, including transferring only the minimum data needed, using appropriate contractual safeguards and, where required, obtaining consent or regulatory approval.

Our encryption design adds protection that travels with your data: mailbox content is stored encrypted with your own data key, and only redacted text is sent to our Cloud AI provider. You can request a copy of the relevant safeguards by writing to [email protected] (commercially sensitive terms may be redacted).

12. How long we keep data

We keep personal data only as long as needed for the purposes described in this policy, then delete it or make it anonymous. The table sets out our standard periods.

Legal holds. We may keep specific data longer where we are required to by law, or where it is needed to establish, exercise or defend a legal claim or to investigate a security incident or abuse. We keep such data only for as long as that need lasts, and only the data that need covers.

Deleting data in Inboxy does not delete it from your email or calendar provider. Mail that remains in your Gmail, Outlook or other mailbox is governed by that provider.

13. Security

We protect personal data with technical and organisational measures appropriate to the risk, including:

• Per-user encrypted vaults. Each user’s data lives in an isolated vault encrypted with AES-256-GCM using a data key unique to that user; user keys are wrapped by a master key held outside the database in a secret manager. Ciphertext is bound to the user, table and column, and keys can be rotated.
• Tenant isolation. No API accepts a user identifier from the client; requests for other users’ data return “not found”; we test against cross-tenant attacks.
• Strong sign-in. scrypt password hashing with per-user salts and a common-password check, passkeys, TOTP two-factor authentication with single-use recovery codes, lockouts with exponential backoff, and re-authentication for sensitive actions.
• Sessions. Random 256-bit tokens stored only as hashes, __Host- HttpOnly Secure SameSite=Strict cookies on the web, CSRF checks, and short-lived access tokens with rotating refresh tokens in the iOS Keychain or Android Keystore.
• Safe mail handling. Email HTML is sanitised and shown in a sandboxed frame with a strict Content Security Policy; remote images load through a proxy that blocks tracking pixels and strips cookies and referrers; outbound requests are guarded against SSRF.
• Minimised logs. Logs record request paths only — no query strings, bodies, tokens, cookies or email addresses — and sender and login addresses are stored as keyed hashes for lookups.
• Transport and backups. HTTPS/TLS in transit; encrypted nightly backups copied off-host, with the master key stored separately.

Read more on our Security page, and report vulnerabilities as described in How to report a vulnerability. No system is perfectly secure; you also play a part by using a strong, unique password, enabling a passkey or two-factor authentication, and keeping your devices secure.

14. Your rights

Depending on where you live, you have some or all of the following rights over your personal data. We extend the core rights below to all users, wherever they live, unless the law prevents us.

• Access — to know whether we process your data and to receive a copy. You can download most of it yourself from Settings (JSON plus your mail in mbox format; connection secrets are never exported).
• Correction — to correct inaccurate or incomplete data. Most account data and settings can be edited directly in Inboxy.
• Deletion — to have your data erased. You can remove individual mail accounts, or delete your whole Inboxy account at Settings → Security → Delete Inboxy account (also available on the web).
• Portability — to receive data you provided in a structured, commonly used, machine-readable format, and to have it sent to another controller where technically feasible.
• Restriction — to ask us to limit how we use your data while a concern is resolved.
• Objection — to object to processing based on legitimate interests, and at any time to direct marketing.
• Withdrawing consent — at any time, for processing based on consent (for example, notifications, integrations or Cloud AI), without affecting earlier processing.
• Automated decisions — not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects (see section 18).
• Complaint — to complain to a data protection authority (see section 20).

How to exercise your rights

Use the tools in Settings, or email [email protected] (or our Data Protection Officer at [email protected]) from the address linked to your account, telling us which right you want to exercise. You will not be charged a fee, unless a request is manifestly unfounded or excessive, where the law allows us to charge a reasonable fee or decline.

Verification

To protect you, we verify your identity before acting on a request — normally by asking you to sign in, or to confirm the request from the email address on your account, and for sensitive requests (such as deletion) to re-authenticate. We will not ask for more information than we need, and we use information provided for verification only for that purpose.

Response times

We acknowledge requests promptly and respond within the time the applicable law requires: generally within 30 days under the UAE PDPL and within one month under the GDPR and UK GDPR (extendable by up to two further months for complex requests), within 45 days under the CCPA (extendable by a further 45 days), and within the periods set by the other laws below. If we need longer, or cannot fulfil a request, we will tell you why and how to challenge our decision.

United Arab Emirates (our home law)

We are established in the UAE, and UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and its implementing regulations apply to our processing. Under it you have the right to: receive information about the data we process, its purposes, recipients and retention; request a copy of your data and have it transferred; correct inaccurate data; have data erased where it is no longer necessary, consent is withdrawn, or processing is unlawful; restrict processing; object to processing, including for direct marketing and profiling; withdraw consent; and object to decisions based solely on automated processing that have legal consequences or seriously affect you. You may submit a complaint to the UAE Data Office if you believe your data has been processed in breach of the law. If you are in a free zone with its own data protection regime (such as the DIFC or ADGM), you may also have rights under that regime.

European Economic Area and United Kingdom (GDPR and UK GDPR)

If you are in the EEA or the UK, you have all the rights listed above under the GDPR or UK GDPR, which apply to us because we offer Inboxy to people there. Our legal bases are set out in section 5. You can contact our representatives ([EU representative under GDPR Art. 27 — name and address, if appointed] in the EU; [UK representative under UK GDPR Art. 27 — name and address, if appointed] in the UK) and complain to your local supervisory authority — for example the authority in the country where you live or work — or, in the UK, the Information Commissioner’s Office (ico.org.uk).

California (CCPA as amended by the CPRA)

This section supplements this policy for California residents. In the past 12 months we have collected the categories of personal information below, for the business purposes described in section 4.

The sources of this information and our retention periods are described in section 3 and section 12. As a California resident you have the right to:

• Know and access the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of recipients.
• Delete personal information we collected from you, subject to legal exceptions.
• Correct inaccurate personal information.
• Opt out of sale or sharing. We do not sell personal information or share it for cross-context behavioural advertising, and we have no actual knowledge of selling or sharing the personal information of consumers under 16. There is nothing to opt out of, but you may still contact us.
• Limit the use of sensitive personal information. We use sensitive personal information only for purposes permitted by Cal. Code Regs. tit. 11, § 7027(m) — to provide the service you request, to secure it, and to prevent fraud — and not to infer characteristics about you. The right to limit therefore does not need to be exercised.
• Non-discrimination. We will not deny you service, charge different prices, or provide a different quality of service because you exercised your rights.

Authorised agents. You may use an authorised agent to make a request on your behalf. We will require written, signed permission from you and may ask you to verify your identity directly with us, unless the agent holds a valid power of attorney.

Shine the Light (Cal. Civ. Code § 1798.83). We do not disclose personal information to third parties for their own direct marketing purposes.

To make a request, email [email protected] with the subject “California privacy request”.

Other US states

Residents of states with comprehensive privacy laws — including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia — may have rights to confirm, access, correct, delete and port their personal data, and to opt out of targeted advertising, sale and certain profiling. We do not engage in targeted advertising, sale of personal data or profiling with legal or similarly significant effects. Where your state law provides a right to appeal a decision on your request, reply to our decision with the subject “Privacy appeal”; we will respond within the period required by law, and if you are not satisfied you may contact your state Attorney General. We process sensitive data only to provide the service you request and, where state law requires consent for such processing, you give it by connecting your mailbox.

Saudi Arabia (Personal Data Protection Law)

If you are in the Kingdom of Saudi Arabia, the Personal Data Protection Law (Royal Decree M/19 of 1443H, as amended) and its implementing regulations give you the right to be informed, to access your data, to obtain a copy, to correct it, and to request its destruction when no longer needed, as well as to withdraw consent. We transfer data outside the Kingdom only in line with the law’s transfer regulations. You may submit a complaint to the Saudi Data & AI Authority (SDAIA).

Oman (Personal Data Protection Law)

If you are in the Sultanate of Oman, the Personal Data Protection Law issued by Royal Decree No. 6/2022 and its executive regulations give you rights including to withdraw consent, to access and receive a copy of your data, to correct, update or erase it, to be notified of a breach affecting you, and to object to processing for direct marketing. You may complain to the competent ministry (the Ministry of Transport, Communications and Information Technology).

Qatar (Law No. 13 of 2016)

If you are in the State of Qatar, Law No. 13 of 2016 on the Protection of Personal Data Privacy gives you the right to withdraw consent, to object to processing that is not necessary for the stated purposes, to request erasure or correction, to be notified of processing and of inaccurate disclosures, and to access your data. You may submit a complaint to the National Cyber Governance and Assurance Affairs at the National Cyber Security Agency.

Other countries

If you live elsewhere — for example in Bahrain, Kuwait, Egypt, India, Brazil, Canada, Switzerland, Singapore or Australia — you may have similar rights under local law. Contact us and we will respond in line with the law that applies to you.

15. Children

Inboxy is not intended for anyone under 16, and you must be at least 16 (or the age of digital consent where you live, if higher) to create an account. We do not knowingly collect personal data from children under that age. If we learn that we have, we will delete the account and the data. If you believe a child has given us personal data, contact [email protected].

16. Cookies and local storage

Our website sets no cookies; it stores only your theme preference in your browser’s local storage, which is never sent to us. The web app uses only strictly necessary storage: a __Host- session cookie, a CSRF token, local storage and IndexedDB for preferences and an offline cache, and a service worker for the installable app. Our native apps keep refresh tokens in the iOS Keychain or Android Keystore. We use no analytics, advertising, tracking or third-party cookies anywhere. Full details are in our Cookie & Local Storage Policy.

17. Personal data breaches

We maintain an incident response process for suspected personal data breaches. If a breach occurs, we will contain it, assess the risk, and:

• notify the UAE Data Office as required by UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and its implementing regulations, and notify affected users where the breach could harm their privacy, confidentiality or security;
• notify the competent supervisory authority under the GDPR or UK GDPR without undue delay and, where feasible, within 72 hours of becoming aware of a breach likely to result in a risk to people’s rights and freedoms, and inform affected users without undue delay where the risk is high;
• notify the authorities and individuals required under the Saudi, Omani and Qatari laws and US state breach-notification laws, within the periods those laws set;
• notify business customers for whom we act as processor without undue delay, as set out in our Data Processing Addendum.

Notifications will describe what happened, the data involved, the likely consequences, what we are doing about it, and steps you can take to protect yourself. Because your vault is encrypted with your own key, many incidents involving stored data would not expose readable content; we will still assess and notify as the law requires.

18. Automated decision-making

Inboxy uses automated processing to help you manage your mail: it assigns labels, priority scores, Needs Reply and Awaiting Reply status, and phishing warnings, and it suggests unsubscribes and meeting times. These are organisational aids for you. They do not produce legal effects or similarly significant effects on you, and we do not use them to make decisions about you — for example, about access to services, credit, employment or pricing.

You stay in control: “Why this label?” explains each label, you can change any label or priority, write your own rules, and switch AI off. Phishing warnings never delete mail. If you have concerns about any automated processing, contact us and a person will review it.

19. Changes to this policy

We may update this policy to reflect changes in Inboxy, our providers or the law. If we make a material change — for example, a new purpose for using your data or a new category of recipient — we will notify you in the app or by email at least 30 days before it takes effect, and ask for your consent where the law requires it. The date at the top of this page shows when it was last updated. Earlier versions are available on request.

20. Complaints

If you have a concern about how we handle your data, please contact us first at [email protected] or our Data Protection Officer at [email protected], so we can try to resolve it. You also have the right to complain to a data protection authority at any time, including:

• United Arab Emirates: the UAE Data Office;
• EEA: the supervisory authority in your country of residence or work, or where the alleged infringement took place;
• United Kingdom: the Information Commissioner’s Office;
• Saudi Arabia: the Saudi Data & AI Authority (SDAIA);
• Oman: the Ministry of Transport, Communications and Information Technology;
• Qatar: the National Cyber Security Agency;
• California: the California Privacy Protection Agency or the California Attorney General; and the Attorney General in other US states.

21. Contact us

• Privacy questions and requests: [email protected]
• Data Protection Officer: [email protected]
• Security issues: [email protected]
• General support: [email protected]
• Post: [Nexlla Creative Agency — registered legal name] (trading as Nexlla Creative Agency), Attn: Privacy, [Registered address — street, building, city, Emirate, United Arab Emirates], United Arab Emirates
• EU representative: [EU representative under GDPR Art. 27 — name and address, if appointed]
• UK representative: [UK representative under UK GDPR Art. 27 — name and address, if appointed]

Questions about this policy? Write to [email protected].