The short version
- We keep this list short on purpose: hosting, an optional cloud AI provider, push notification delivery and system email.
- Anthropic only receives text when you turn on Cloud AI, and that text is redacted first. With on-device AI or AI off, no text goes to an AI provider.
- Mail providers and apps you connect (like Google, Microsoft or Slack) are not our sub-processors — you choose them and they act under their own terms.
- We give 30 days’ notice before adding a new sub-processor.
1. About this list
A sub-processor is a third party that we, [Nexlla Creative Agency — registered legal name] (trading as Nexlla Creative Agency), engage to process personal data on our behalf so that we can provide Inboxy. Each sub-processor is bound by a written agreement that requires it to protect personal data to a standard no lower than our own commitments, to use the data only to provide its service to us, and to follow our instructions.
We only share what each sub-processor needs for its specific task. Mail content, drafts and settings are stored encrypted in each user’s own vault, and the encryption keys are held separately from the data. For a full description of our safeguards, see our Security page and Annex 2 of the Data Processing Addendum. For how we handle personal data generally, see our Privacy Policy.
Where a sub-processor processes data outside the country in which it was collected, we rely on the transfer safeguards described in the Data Processing Addendum and the Privacy Policy.
2. Current sub-processors
| Sub-processor | Purpose | Data processed | Location | Status |
|---|---|---|---|---|
| [Hosting provider — confirm] | Hosting of the Inboxy service, storage and encrypted backups. | All service data, stored encrypted at rest (per-user encrypted vaults and encrypted backups); server request logs (path, time, status). | [Hosting region — confirm] | To confirm |
| Anthropic, PBC | Claude API for AI features (labels, summaries, drafts) — only when the user has turned on Cloud AI. | Email text needed for the requested task, after redaction of email addresses, phone numbers, card numbers, IBANs, government identifiers, API keys, tokens, passwords and signed URLs. Not used for model training. | United States | To confirm |
| Google LLC — Firebase Cloud Messaging | Delivering push notifications to Android, iPhone (via Apple Push Notification service) and web push. | Push token; notification text according to the user’s preview setting (none, sender and one-line summary, or subject and snippet); thread identifier or link. | United States / global | To confirm |
| Apple Inc. — Apple Push Notification service | Delivering push notifications to Apple devices registered directly with APNs (not via Firebase). | Device push token; notification text according to the user’s preview setting; thread identifier or link. | United States | To confirm |
| [Transactional email provider — confirm] | Sending account verification and password-reset emails. | Recipient email address; message content of the system email (including one-time links). | [Location — confirm] | To confirm |
3. Services you connect (not sub-processors)
Inboxy works with services that you, or your organisation, choose to connect. We exchange data with them at your direction, to provide the features you asked for. These providers act under their own terms and privacy policies with you, so they are not our sub-processors, and we have no control over how they process your data. Inboxy is not affiliated with any of them.
| Service | What it’s used for |
|---|---|
| Google (Gmail, Google Workspace, Google Calendar) | Reading, labelling and sending your mail and reading your calendar, via OAuth with the permissions you grant. |
| Microsoft (Outlook, Microsoft 365, Microsoft Graph) | Mail and calendar access via OAuth; optionally publishing your profile photo. |
| Proton Mail Bridge | Local IMAP/SMTP access to Proton Mail on your own computer. We only see the Bridge password. |
| iCloud | Mail via IMAP/SMTP with an app password; calendar via CalDAV. |
| Yahoo | Mail via IMAP/SMTP with an app password. |
| Fastmail | Mail via IMAP/SMTP with an app password; calendar via CalDAV. |
| CalDAV servers (for example, Nextcloud) | Calendar access for free-slot suggestions. |
| Slack | The Inboxy Slack app, /inboxy command and action buttons. Summaries by default, never full bodies. |
| Telegram | The Inboxy Telegram bot. Summaries by default, never full bodies. |
| Gravatar (WordPress.com) | Optionally publishing your profile photo, via WordPress.com OAuth. |
4. Change notifications
We will update this page at least 30 days before a new sub-processor starts processing personal data. If we must replace a sub-processor urgently to protect the security or continuity of the service, we may give shorter notice and will explain why.
To be told about changes by email, write to [email protected] with the subject line “Sub-processor updates”, from the address you want us to use. You can unsubscribe at any time by replying to any update.
5. Objections
If your organisation has accepted our Data Processing Addendum, you may object to a new sub-processor on reasonable data protection grounds within the notice period by writing to [email protected]. We will work with you in good faith to find a solution, such as a configuration that avoids the sub-processor — for example, using on-device AI or turning AI off instead of Cloud AI. If we cannot resolve the objection, you may end the affected part of the service as set out in section 7 of the Data Processing Addendum.
Individual users who do not want a particular optional sub-processor involved can usually avoid it through their settings: choose on-device AI or AI off to avoid Anthropic, and turn off push notifications to avoid Firebase Cloud Messaging and Apple Push Notification service.
6. Changelog
- Initial list — October 19, 2026.
Questions about our sub-processors? Write to [email protected].