Privacy Policy

1 Information We Collect

1.1 Information You Provide Directly

We collect information you voluntarily provide when registering for the Service, including:

1.2 Information Collected Automatically

When you use the Service, we automatically collect:

• Device Information: IP address, browser type, operating system, device identifiers
• Usage Data: Pages viewed, features used, click patterns, session duration
• Log Data: Access times, error logs, referring URLs
• Performance Data: Load times, system performance metrics

1.3 Information from Third Parties

We receive information from third-party services you connect:

• WhatsApp (Meta): Incoming messages, delivery statuses, phone numbers, message metadata
• Google Calendar: Calendar events, availability, event details (when you connect)
• Microsoft Outlook: Calendar events, availability, event details (when you connect)

1.4 Information About Your Customers

When you use the Service to communicate with your customers via WhatsApp, we process:

• Customer phone numbers
• Customer names (as provided by you or extracted from messages)
• Message content between you and your customers
• Message delivery and read status
• AI-generated analysis (intent, sentiment, interests)

2 How We Use Your Information

2.1 Service Delivery

• Provide, maintain, and improve the Service
• Process and deliver WhatsApp messages on your behalf
• Manage your account and provide customer support
• Process payments and billing
• Sync appointments with connected calendars

2.2 AI-Powered Features

• Analyze message content for intent and sentiment
• Calculate lead temperature scores
• Generate automated chatbot responses
• Provide smart reply suggestions
• Detect appointment booking requests

2.3 Service Improvement

• Understand how users interact with the Service
• Identify and fix technical issues
• Develop new features and functionality
• Conduct research and analytics

2.4 Security and Compliance

• Detect, prevent, and address fraud and abuse
• Enforce our Terms of Service
• Comply with legal obligations
• Protect the rights and safety of users

3 Legal Basis for Processing

For users in the European Economic Area (EEA), United Kingdom, Brazil, and other jurisdictions requiring a legal basis for processing, we rely on:

You may withdraw consent at any time by contacting us or adjusting your account settings.

4 How We Share Your Information

4.1 Service Providers

We share information with third-party service providers who perform services on our behalf. All service providers are contractually obligated to protect your information and use it only for specified purposes.

4.2 WhatsApp (Meta)

To deliver WhatsApp messages, we share recipient phone numbers, message content, and media files. This sharing is governed by WhatsApp's Business API terms.

4.3 Legal Requirements

We may disclose information if required by law or in good faith belief that such action is necessary to:

• Comply with legal obligations or valid legal process
• Protect and defend our rights or property
• Prevent or investigate possible wrongdoing
• Protect the personal safety of users or the public

4.4 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your information becomes subject to a different privacy policy.

5 Third-Party Service Providers

5.1 Cloud Infrastructure

5.2 Artificial Intelligence

AI Data Practices:

• AI providers process data to generate responses in real time
• We configure AI provider APIs to minimize data retention
• Message content is not used to train AI models without explicit consent
• AI providers may retain limited data for a short period under their own terms (for example, abuse monitoring) unless a zero-retention agreement is in effect

5.3 Communication Services

5.4 Calendar Integrations

6 International Data Transfers

6.1 Data Location

Your data is primarily stored in the United States: application data, databases, and cache are hosted on Railway, and media files are stored in Amazon Web Services (AWS) S3 in the us-east-2 region.

6.2 Cross-Border Transfers

Some of our service providers operate in countries outside your jurisdiction. When we transfer data internationally, we ensure appropriate safeguards:

• Standard Contractual Clauses (SCCs): EU-approved contractual terms with service providers
• Adequacy Decisions: Transfers to countries with adequate data protection
• Binding Corporate Rules: For providers with approved BCRs
• Consent: Where other mechanisms are not available

7 Data Retention

7.2 Deletion

When you delete your account or request data deletion:

1. Active data is marked for deletion immediately
2. Soft-deleted data is permanently purged after 90 days
3. Backup copies are purged within 30 days of backup rotation
4. Some data may be retained as required by law

8 Your Privacy Rights

Depending on your jurisdiction, you may have the following rights:

How to Exercise Your Rights

To exercise your rights, you may:

1. Self-Service: Use account settings to access, correct, or delete data
2. Email: Contact us at privacy@inboxxit.com
3. Written Request: Send a request to our mailing address

We will respond to requests within 30 days (or as required by applicable law).

9 California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the CCPA:

9.1 Right to Know

You may request disclosure of categories and specific pieces of personal information collected, sources, purposes, and third parties with whom we share data.

9.2 Right to Delete

You may request deletion of personal information we collected, subject to exceptions.

9.3 Right to Non-Discrimination

We will not discriminate against you for exercising CCPA rights.

9.4 Categories of Information

10 Brazilian Privacy Rights (LGPD)

If you are located in Brazil, you have rights under the Lei Geral de Proteção de Dados (LGPD):

• Confirmation: Confirm whether we process your data
• Access: Access your personal data
• Correction: Correct incomplete, inaccurate, or outdated data
• Anonymization: Request anonymization, blocking, or deletion of unnecessary data
• Portability: Receive your data in portable format
• Deletion: Delete data processed with consent
• Information: Know about entities with whom we share data
• Revocation: Revoke consent

You may file complaints with the Autoridade Nacional de Proteção de Dados (ANPD) at www.gov.br/anpd.

11 Data Security

We implement technical and organizational measures to protect your data:

Incident Response

In the event of a data breach, we will notify affected users within 72 hours (or as required by law) and notify relevant supervisory authorities as required.

12 Children's Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@inboxxit.com. If we discover we have collected information from a child, we will delete it promptly.

13 Channel and Plugin Data Practices

The Service reaches your customers through several channels — WhatsApp, our hosted web chat widget, and our WordPress plugins. Data practices differ by channel, as described below.

13.1 WhatsApp

Our Service integrates with WhatsApp Business API provided by Meta. By using WhatsApp features:

• You agree to WhatsApp's Business Terms of Service
• You agree to WhatsApp's Business Policy
• Messages are transmitted through WhatsApp's infrastructure

Your Obligations

As a user of our Service to communicate via WhatsApp, you must:

• Obtain appropriate consent from your customers before messaging them
• Comply with WhatsApp's messaging policies and the 24-hour window rule
• Honor opt-out requests from your customers promptly
• Not send spam, unauthorized promotional messages, or messages to purchased contact lists

Data Retention for WhatsApp Conversations

WhatsApp message content, metadata, and AI analysis are retained for up to 5 years to provide the Service and meet legal obligations. You may request deletion at any time through your account settings or by contacting us.

Prohibited Data Collection

In compliance with WhatsApp Business Policy, you agree NOT to use our Service to collect, store, or transmit the following categories of sensitive information through WhatsApp:

• Payment card numbers (credit/debit card details, CVV, PIN)
• Government-issued identification numbers (passport, driver's license, national ID, Social Security Number)
• Financial account credentials (bank account numbers, login passwords)
• Protected health information (PHI) as defined by HIPAA or equivalent regulations
• Biometric data (fingerprints, facial recognition data)
• Information about minors under 13 (or higher age where applicable)

Our Service includes content filters to detect prohibited data, but you remain responsible for compliance. We reserve the right to remove prohibited content and suspend accounts that violate this policy.

Meta Reporting Obligations

We may share aggregated, non-personally-identifiable usage statistics with Meta as required by the WhatsApp Business API terms. This includes message volume, delivery rates, and quality metrics. We do not share individual message content with Meta beyond what is necessary to deliver messages.

13.2 Web Chat Widget and Connected Plugins

Our hosted web chat widget and connector plugins — which you install on your website, including WordPress — send visitor messages to our servers so they appear in your inbox and can be answered, scored, and tracked. This data is handled the same way as other Service data described in this Policy. As with WhatsApp, you are responsible for obtaining any consent required from your website visitors.

13.3 Standalone "Chat Lite" Plugin (Bring Your Own Key)

Our standalone Chat Lite WordPress plugin runs entirely on your own website using your own AI provider key (for example, OpenAI or Anthropic). In this mode, visitor conversations are processed directly between your website and your chosen AI provider under your account — they are not transmitted to or stored on Inboxxit's servers. For those conversations you are the data controller, and your AI provider's terms and privacy policy apply. We provide the plugin software and may collect limited license, activation, and diagnostic information (such as your site URL and plugin version), but not the content of your visitor conversations. If you later connect Chat Lite to your Inboxxit account, the "Web Chat Widget and Connected Plugins" practices above apply.

14 Artificial Intelligence and Automated Processing

14.1 AI Features

Our Service uses AI to provide:

• Temperature Scoring: Analyze lead readiness to purchase (OpenAI GPT-4o-mini)
• Intent Analysis: Understand customer message intent (OpenAI GPT-4o-mini)
• Chatbot Responses: Generate automated replies (Anthropic Claude)
• Smart Replies: Suggest response options for agents (Anthropic Claude)
• Booking Detection: Identify appointment requests (OpenAI GPT-4o-mini)

14.2 Automated Decision-Making

Our AI systems assist with lead prioritization, chatbot responses, and appointment status updates. You have the right to:

• Request human review of automated decisions
• Opt out of automated processing where legally required
• Understand the logic behind automated decisions

14.3 AI Data Practices

• Message content is sent to AI providers for real-time processing
• AI providers may retain limited data for a short period under their own terms (for example, abuse monitoring) unless a zero-retention agreement is in effect
• Your data is not used to train AI models without explicit consent

15 Cookies and Tracking Technologies

You can control cookies through browser settings or account settings (analytics opt-out). Note: Blocking essential cookies may prevent access to the Service.

We do not use third-party advertising trackers.

16 Changes to This Privacy Policy

We may update this Privacy Policy periodically. Changes will be effective when posted, and the "Last Updated" date will be revised.

For material changes, we will:

• Notify you via email (if provided)
• Display a prominent notice within the Service
• Obtain consent where required by law

Continued use of the Service after changes constitutes acceptance of the updated Privacy Policy.

17 Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: