Draft. This document is a pre-launch draft based on market-standard terms for email deliverability services and is being reviewed by legal counsel. Questions: welcome@roxinbox.io.
1. Who we are
RoxInbox is operated by Havik Group, with its registered seat in Utrecht, Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 98526472 (“we”, “us”). For the processing described in this policy we are the controller under the EU General Data Protection Regulation (GDPR). Contact us about privacy at welcome@roxinbox.io.
2. Scope and roles
This policy covers personal data we process as a controller: about visitors to roxinbox.io, people who use our free tools, our customers' account users, and people who contact us.
When customers connect mailboxes to RoxInbox, the personal data inside those mailboxes and the warm-up and test messages is processed on the customer's behalf. For that data the customer is the controller and we are a processor under our Data Processing Agreement. If your personal data is in a customer's mailbox, please contact that customer first.
3. Data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, work email, company, role, password hash, log-in history | You |
| Billing data | Billing contact, company address, VAT number, invoices, payment status. Card details are handled by our payment provider; we do not store full card numbers. | You, payment provider |
| Verification data | Company registration details, website, sending use case, answers to our onboarding questions | You, public registers |
| Usage data | Pages and features used, settings, device and browser type, IP address, timestamps, error logs | Our servers and app |
| Waitlist data | Email address, and optionally name, company and number of mailboxes, plus your consent to be emailed at launch and its time | You |
| Communications | Support requests, demo requests, emails and the details you include | You |
| Website data | Pages viewed and referrer, in aggregate (see section 6) | Your browser |
| Free-tool inputs | The domain names or IP addresses you check (see section 5) | You |
We do not seek to collect special categories of personal data, and we do not buy contact lists.
4. Purposes and legal bases
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Creating and running your account, providing the Service, support | Performance of a contract (6(1)(b)) |
| Billing, invoicing, tax and accounting records | Legal obligation (6(1)(c)) and contract |
| Verifying customers and preventing spam, fraud and abuse of the warm-up network | Legitimate interests (6(1)(f)): protecting the network, other customers and recipients |
| Security, logging and incident response | Legitimate interests; legal obligation where applicable |
| Improving the Service and producing anonymised statistics such as the placement index | Legitimate interests |
| Product updates and service emails to customers | Contract; legitimate interests for relevant product news, with an opt-out in every email |
| Marketing emails to non-customers | Consent (6(1)(a)), which you can withdraw at any time |
| Emailing you when RoxInbox launches (waitlist) | Consent (6(1)(a)), which you can withdraw at any time |
| Answering contact and demo requests | Steps at your request before a contract; legitimate interests |
Where we rely on legitimate interests, we have balanced them against your rights. You can ask us for details of that assessment.
5. Free tools
Our free tools run in your browser. When you check a domain, your browser asks public DNS-over-HTTPS resolvers operated by Cloudflare and, as a fallback, Google, for the domain's public DNS records. Those providers therefore receive the domain you check and your IP address, under their own privacy terms. We do not store the domains you check unless you create an account and choose to save or monitor them.
The blacklist checker may send the domain or IP you check to our own lookup service, which queries blocklist operators. We keep those lookups only in short-lived technical logs.
6. Cookies and analytics
The website does not set advertising or tracking cookies. It stores your colour theme choice in your browser's local storage. Website analytics, when enabled, use a privacy-friendly service that sets no cookies and collects no personal data beyond an anonymised count of visits, and they load only after you opt in through the cookie banner. A Global Privacy Control signal is treated as an opt-out. See the Cookie Policy for details. The web application uses strictly necessary cookies to keep you logged in.
7. Who we share data with
- Service providers that host, secure and operate the Service, process payments, send service emails, deliver website form submissions (such as the waitlist) and provide support tools, under contracts that limit their use of the data. See our subprocessor list.
- Professional advisers such as accountants, auditors and lawyers, under confidentiality.
- Authorities when the law requires it, or when needed to protect our rights, our customers or the public, for example to report abuse.
- A buyer or successor if our business is reorganised, merged or sold, under the same protections.
We do not sell personal data.
8. International transfers
We host the Service and its data in the European Union. If a service provider processes personal data outside the European Economic Area, we make sure the transfer is protected by an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework, or by the European Commission's Standard Contractual Clauses with supplementary measures where needed.
9. Retention
| Data | Retention |
|---|---|
| Account and usage data | For the life of the account, then deleted or anonymised within 90 days of closure |
| Mailbox credentials | Deleted when the mailbox is disconnected or the account is closed |
| Invoices and tax records | 7 years, as required by Dutch tax law |
| Verification and abuse records | Up to 2 years after the account closes, to stop banned senders from returning |
| Waitlist data | Until launch plus 6 months, or until you unsubscribe or ask us to delete it |
| Support communications | Up to 2 years after the last contact |
| Technical and security logs | Up to 12 months |
| Marketing consent and opt-outs | Until you withdraw consent; opt-outs kept as a suppression record |
10. Security
We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit and at rest, an encrypted vault for mailbox credentials, access on a need-to-know basis, multi-factor authentication for staff, logging and monitoring. See our Security page for more.
11. Your rights
Under the GDPR you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing (including at any time to processing for direct marketing), to data portability, and to withdraw consent without affecting earlier processing. We do not make decisions with legal or similarly significant effects about you based solely on automated processing.
To exercise a right, email welcome@roxinbox.io. We may need to verify your identity, and we answer within one month. You also have the right to complain to a supervisory authority, in the Netherlands the Autoriteit Persoonsgegevens, or the authority where you live or work.
12. Marketing
We send marketing emails to non-customers only with consent, and product news to customers only where relevant. Every marketing email has an unsubscribe link, and we honour opt-outs promptly.
13. Children
The Service is for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16.
14. Changes
We may update this policy. We will post the new version here with its effective date and, for material changes, notify customers by email or in the app.
15. Contact
Havik Group, Utrecht, Netherlands. Privacy questions and requests: welcome@roxinbox.io.