Who We Are & Scope
Inboxvio ("we", "us", "our") is a Software-as-a-Service company that operates the Inboxvio email campaign and outreach platform, accessible at inboxvio.com and its subdomains.
This Privacy Policy applies to all personal data we collect when you:
- Visit our website or landing pages
- Register for and use the Inboxvio platform
- Contact our support team
- Submit a support ticket via our Help Centre
- Make a payment or manage a subscription
For the purposes of applicable data protection law, Inboxvio is the data controller of your personal account data, and the data processor of any personal data contained in your contact lists or campaign content that you upload to the Service.
Data We Collect
Data You Provide Directly
| Category | Data Collected | When Collected |
|---|---|---|
| Account data | Full name, email address, password (hashed) | Registration |
| Billing data | Payment method details (processed by Stripe/Paystack — we do not store full card numbers), billing address | Subscription purchase |
| SMTP credentials | SMTP host, port, username, encrypted password | SMTP configuration |
| Contact lists | Names, email addresses, phone numbers, company names, and other fields you upload | Contact import |
| Campaign content | Email subject lines, body content, templates | Campaign creation |
| Support data | Name, email, message content submitted via Help Centre | Support requests |
Data We Collect Automatically
| Category | Data Collected |
|---|---|
| Usage data | Features used, pages visited, actions taken within the platform, timestamps |
| Technical data | IP address, browser type and version, operating system, device identifiers |
| Log data | Campaign send logs, delivery status, error logs, audit logs of account activity |
| Authentication data | Login timestamps, last login IP, refresh token identifiers (hashed) |
Data We Do Not Collect
- Full payment card numbers — these are handled exclusively by our payment processors
- Sensitive personal data such as health information, racial or ethnic origin, or political opinions
- Precise geolocation data
- Social media credentials
How We Use Your Data
We use your personal data for the following purposes:
| Purpose | Data Used |
|---|---|
| Providing and operating the Service | Account data, SMTP credentials, contact lists, campaign content |
| Processing payments and managing subscriptions | Account data, billing data |
| Sending transactional emails (account confirmation, password reset, billing notifications) | Account email address |
| Responding to support requests | Support data, account data |
| Improving and developing the Service | Usage data, log data (anonymised or aggregated where possible) |
| Security monitoring, fraud detection, and abuse prevention | Technical data, log data, usage data |
| Compliance with legal obligations | Account data, billing data, log data |
| Audit logging of account activity | Account data, IP address, action timestamps |
We will never sell your personal data to third parties. We will not use your contact lists or campaign content for any purpose other than providing the Service to you.
Legal Basis for Processing (GDPR)
For users in the European Economic Area (EEA), United Kingdom, or other jurisdictions with similar requirements, we process your personal data on the following legal bases:
- Contract performance — Processing your account data, billing data, and service data is necessary to provide the Service you have subscribed to (Article 6(1)(b) GDPR)
- Legitimate interests — Security monitoring, fraud prevention, service improvement, and audit logging serve our legitimate business interests and do not override your fundamental rights (Article 6(1)(f) GDPR)
- Legal obligation — We retain certain financial and transaction records to comply with applicable tax, accounting, and anti-money laundering laws (Article 6(1)(c) GDPR)
- Consent — Where we send marketing communications, we do so only with your explicit consent, which you may withdraw at any time
Data Sharing & Third Parties
We do not sell, rent, or share your personal data with third parties for their own marketing purposes. We share data with third parties only in the following circumstances:
Service Providers (Data Processors)
We use the following third-party service providers who process data on our behalf under appropriate data processing agreements:
- Stripe — payment processing and subscription management (see stripe.com/privacy)
- Paystack — payment processing for NGN transactions (see paystack.com/privacy)
- Cloud infrastructure providers — hosting and data storage
- Redis / Celery — background job processing infrastructure
Legal Disclosure
We may disclose your personal data where required by law, court order, or government authority, or where we believe disclosure is necessary to protect the rights, property, or safety of Inboxvio, our users, or the public.
Business Transfers
In the event of a merger, acquisition, reorganisation, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you by email or a prominent notice within the Service before your personal data becomes subject to a different privacy policy.
Aggregate & Anonymised Data
We may share anonymised, aggregated data that cannot reasonably be used to identify you — for example, aggregate platform usage statistics — with third parties for business or research purposes.
International Data Transfers
Inboxvio operates globally and may store or process your personal data in countries outside your own, including countries that may not have the same data protection laws as your jurisdiction.
When we transfer personal data from the EEA, United Kingdom, or Switzerland to a country that is not recognised as providing an adequate level of data protection, we rely on:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- The UK International Data Transfer Agreement (IDTA) for transfers from the UK
- Other lawful transfer mechanisms as available under applicable law
You may request a copy of the safeguards we have in place for international transfers by contacting us at the details in Section 14.
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law:
| Data Type | Retention Period |
|---|---|
| Account data (active accounts) | Duration of account + 90 days after deletion request |
| Campaign and delivery logs | 2 years from campaign date |
| Billing and payment records | 7 years (tax and accounting legal requirement) |
| Audit logs | 2 years |
| Support ticket data | 3 years from ticket closure |
| Authentication logs (IP, login times) | 90 days |
| Contact lists | Deleted within 30 days of account deletion |
When the retention period expires, data is securely deleted or anonymised. You may request earlier deletion as described in Section 9.
Security
We implement industry-standard technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These measures include:
- Encryption at rest — SMTP passwords and sensitive credentials are encrypted using industry-standard encryption (Fernet symmetric encryption)
- Encryption in transit — All data transmitted between your browser and our servers is protected using TLS 1.2 or higher
- Password hashing — User passwords are hashed using bcrypt with appropriate cost factors and are never stored in plaintext
- Access controls — Access to user data is restricted to authorised personnel with a legitimate operational need
- Authentication tokens — We use short-lived JWT access tokens (30 minutes) with secure HTTP-only refresh tokens (7 days)
- Audit logging — All significant account actions are logged for security monitoring
- Rate limiting — Login attempts are rate-limited to prevent brute-force attacks
Your Data Rights
Depending on your location, you have the following rights regarding your personal data:
Right of Access
Request a copy of the personal data we hold about you.
Right to Rectification
Request correction of inaccurate or incomplete data.
Right to Erasure
Request deletion of your personal data ("right to be forgotten").
Right to Restrict Processing
Request that we limit how we use your data in certain circumstances.
Right to Data Portability
Receive your data in a structured, machine-readable format.
Right to Object
Object to processing based on legitimate interests or for direct marketing.
Right to Withdraw Consent
Withdraw consent at any time where processing is consent-based.
Right Not to be Profiled
Object to automated decision-making that significantly affects you.
How to Exercise Your Rights
To exercise any of these rights, contact us at the details in Section 14. We will respond within:
- 30 days for standard requests (extendable by a further 60 days for complex requests)
- 72 hours for urgent security or breach-related requests
We may need to verify your identity before processing your request. We will not charge a fee for exercising your rights except in cases of manifestly unfounded or excessive requests.
Right to Complain
If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with your local data protection supervisory authority. For EU users, this is the data protection authority in your member state. For UK users, this is the Information Commissioner's Office (ICO) at ico.org.uk.
Cookies & Similar Technologies
We use a minimal set of cookies and browser storage to operate the Service. We do not use third-party tracking cookies or advertising cookies.
Cookies We Use
| Cookie / Storage | Purpose | Duration |
|---|---|---|
| Refresh token (HTTP-only cookie) | Maintains your authenticated session securely | 7 days |
| access_token (localStorage) | Stores your short-lived access token for API authentication | 30 minutes |
We do not use analytics cookies, advertising cookies, or social media tracking pixels. If this changes in the future, we will update this policy and seek consent where required by law.
Children's Privacy
The Service is not directed to, and we do not knowingly collect personal data from, individuals under the age of 18 (or the applicable age of majority in their jurisdiction). If we become aware that we have collected personal data from a child without appropriate parental consent, we will take steps to delete that data promptly.
If you believe we may have collected data from a child, please contact us immediately at the details in Section 14.
Additional Rights for EU & UK Users (GDPR)
If you are located in the European Economic Area or the United Kingdom, the General Data Protection Regulation (GDPR) or UK GDPR applies to the processing of your personal data. In addition to the rights in Section 9, you have the right to:
- Know the specific legal basis on which we rely to process your data for each processing activity
- Request that we provide a Data Processing Agreement (DPA) if you use Inboxvio as a processor of your customers' personal data
- Be informed of any sub-processors we use to process data on your behalf
- Lodge a complaint with your national supervisory authority
Additional Rights for California Users (CCPA/CPRA)
If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides you with specific rights regarding your personal information:
Right to Know
You have the right to request that we disclose what personal information we collect, use, disclose, and sell (we do not sell personal information).
Right to Delete
You have the right to request deletion of personal information we have collected from you, subject to certain exceptions.
Right to Opt-Out of Sale
We do not sell your personal information to third parties. We do not share personal information for cross-context behavioural advertising.
Right to Non-Discrimination
We will not discriminate against you for exercising any of your CCPA rights.
Right to Correct
You have the right to request correction of inaccurate personal information we maintain about you.
To exercise your California privacy rights, contact us using the details in Section 14 and indicate that you are making a CCPA request. We will respond within 45 days.
Contact Us & Data Protection
For all privacy-related inquiries, data subject requests, or concerns about how we handle your personal data, please contact us:
- Privacy email: privacy@inboxvio.com
- General support: Help Centre
- Subject line: "Privacy Request — [Your Name]"
Please include your full name, the email address associated with your account, and a clear description of your request. We will acknowledge your request within 5 business days and respond fully within the timeframes specified in Section 9.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. When we make material changes, we will:
- Update the "Last updated" date at the top of this page
- Notify active users by email at their registered address
- Display a prominent notice within the Service for at least 14 days
Where a change materially affects how we use your personal data, we will seek your consent where required by law. Your continued use of the Service after the effective date of any changes constitutes your acknowledgement of the revised policy.
We encourage you to review this policy periodically to stay informed about how we protect your data.