Skip to content

Privacy policy

Last updated: 3 November 2026

This policy explains which personal data inbox0 handles, why, for how long, and what your rights are. We keep it short and in plain words.

Who we are

inbox0 is run from Waversesteenweg 136, 2500 Lier, Belgium, VAT BE1010.281.922 (“we”). Questions about your data: send them through our contact form, or write to [email protected].

Two roles

  • We decide (controller) for the data of visitors of this website, people who contact us or join the waiting list, and the people who use inbox0 (their account and billing).
  • We work for our customers (processor) for the emails in the mailboxes they connect. A company that uses inbox0 decides which mailboxes it connects and what happens to its emails. We only store and process them on its behalf, under a data processing agreement that is part of our terms.

Visitors of this website

We measure how this website is used with EventsLake, our own analytics tool: which pages are read, where visitors come from (like a search engine or a campaign), their country and device, and which buttons and forms they use. It sets one first-party cookie on inbox0.eu to recognise a returning visitor. No advertising cookies, and nothing is shared with advertisers. Our servers also keep short technical logs (like the IP address and the page asked for) to keep the site safe and working. They are deleted after about two weeks.

The contact form and the waiting list

Your first and last name, email address, company and message, to answer you or to let you in. To keep spam out, the forms use Cloudflare Turnstile, which checks that a person is sending them, and we keep the IP address of the sender. We keep messages as long as needed to help you, and at most two years. You can leave the waiting list at any time.

People who use inbox0

  • Your name and email address, to log you in with a code or link by email (we never use passwords) and to send you the notifications you chose.
  • One cookie in the dashboard that keeps you logged in. No advertising or tracking cookies.
  • How you use inbox0 (like creating an inbox or a rule, accepting a suggestion or running an automation), with your name and email, so we can see what works, help you when something goes wrong and improve the product. We use our own analytics tool, EventsLake, for this. It never receives the contents of emails or the details of the people who write to you: only counts, ids and statuses.
  • When you pay: your company name, address and VAT number for the invoice. Card details go straight to Stripe; we never see them.

The emails in your mailboxes (on behalf of our customers)

  • When a company connects a Gmail mailbox, we read and store its emails and attachments (senders, recipients, subjects, contents) to sort them, show them in the dashboard and run the company’s rules and automations.
  • The connection with Google is encrypted. The access tokens are stored encrypted, and a company can disconnect a mailbox at any time, which stops all access.
  • Our use of data from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. We don’t use it for advertising, we don’t sell it, and we don’t let people read it, except with the company’s permission, for security, or when the law requires it.
  • Automations only send emails or fields to the tools a company has chosen, like a task manager, a CRM or an accounting tool. From there, that tool’s own terms apply.

AI: it suggests, a person decides

  • What the AI reads: the email, the earlier emails in the conversation with that person, and the company’s inbox descriptions, templates and instructions.
  • What it does: it suggests an inbox, a next step or a reply draft, or reads fields from an email for an automation the company set up. Replies are written in the language of the person who wrote.
  • What it never does: it doesn’t send a reply or take a decision about a person on its own. The Assistant’s suggestions are accepted or declined by a person. So there is no automated decision-making in the sense of article 22 of the GDPR.
  • Protection: emails can’t give the AI orders. Text in an email that tries to steer the AI is flagged and ignored.
  • Where it runs: with Google Cloud (Vertex AI) in the EU, under a data processing agreement. Google doesn’t use it to train its models, and neither do we.

Who helps us (subprocessors)

  • Amazon Web Services: our servers, database and file storage, in Paris (France).
  • Google: the Gmail connection, and the AI (Vertex AI, in the EU).
  • Cloudflare: protects our websites, makes them fast and checks our forms for spam.
  • Twilio SendGrid: sends our own emails, like login codes and notifications (United States, with EU standard contractual clauses).
  • Expo: delivers push notifications to the phone app (United States, with EU standard contractual clauses). Only a short notification text, never a whole email.
  • Stripe: payments and invoices.
  • EventsLake: our own analytics tool for this website and the dashboard, hosted in the EU. Never the contents of emails.

We never sell personal data, and we don’t use your emails to train AI.

How long we keep data

  • Account data: as long as you use inbox0, and up to 30 days after you leave.
  • Emails: as long as the mailbox is connected and the company keeps them. When a company disconnects a mailbox or closes its account, its emails are deleted within 30 days, and from our backups within 30 more days.
  • Contact messages and the waiting list: at most two years.
  • Invoices: as long as Belgian accounting law requires (7 years).

Security

Everything travels encrypted (HTTPS). Mailbox tokens are stored encrypted. Every project only sees its own data, and inside a project people only see the inboxes they have access to. We make a backup every night, kept for 30 days. Only a few people on our team can reach the servers, and only to keep inbox0 running.

Your rights

You can ask to see, correct, move or delete your data, or object to how we use it. Send your request through our contact form or to [email protected], and we answer within a month. Did someone write to a company that uses inbox0? Then that company decides about your email: ask them, or ask us and we pass it on. You can also complain to the Belgian Data Protection Authority (dataprotectionauthority.be).

Changes

When we change this policy, we update the date at the top. Important changes are announced by email to our customers at least 30 days ahead.