Privacy Policy
Version 1.12 · Effective October 2026
This policy is provided in English only. The English version is the legally binding version. In case of any discrepancy between this document and any translation, this English version prevails.
1. Who we are
in-boxed is operated as a sole trader registered in the Netherlands.
BonDigital (trading as in-boxed)
The Netherlands
KVK: 42079017
VAT: NL005478591B85
privacy@in-boxed.com
A Data Protection Officer has not been appointed, as this is not required for organisations of this size under Article 37 GDPR.
2. How in-boxed works
When you unsubscribe, in-boxed acts entirely from within your browser. After the scan, it reads the List-Unsubscribe and List-Id headers that senders include in their marketing email, and sends the opt-out request directly to the endpoint each sender publishes for this purpose. This is the same technical opt-out signal you would send by clicking “Unsubscribe” in Gmail or Outlook, sent to every sender at once rather than one at a time.
- For senders that support one-click unsubscribe (RFC 8058), your browser sends a single HTTP request to their published unsubscribe endpoint.
- For senders that accept unsubscribe requests only by email, or that are a mailing list (they carry a
List-Idheader) without a machine-readable unsubscribe endpoint, in-boxed prepares a pre-filled opt-out email addressed to the sender's published contact or reply address, which you send yourself. - Where that opt-out address is processed by an automated system, the prepared email also copies a contact address at the sender where a person is likely to read it: their reply or sender address if it is not a no-reply address, otherwise the privacy contact they publish.
in-boxed does not route these requests through Gmail or Outlook, and does not send anything from our own servers. Every request originates from your browser. We are a technical intermediary that automates an action you could perform manually.
3. What data we process
We process the minimum data necessary to deliver the service (Article 5(1)(c) GDPR).
| Data | Purpose | Legal basis |
|---|---|---|
| Gmail OAuth token | Grants temporary access to read email headers. Used during your session only. | Art. 6(1)(b) · Contract performance |
| Microsoft OAuth token (if you connect Outlook, Hotmail or Live instead) | Grants temporary access to read email headers via Microsoft Graph. Used during your session only. | Art. 6(1)(b) · Contract performance |
| Email header metadata (From, Reply-To, List-Id, List-Unsubscribe, List-Unsubscribe-Post) and whether each message is unread | To identify newsletters and mailing lists and send opt-out requests from your browser. The unread status is only used to show how many messages from a sender you have not opened. Read locally; never transmitted to us. The equivalent fields are used for Gmail and Outlook. | Art. 6(1)(b) · Contract performance |
| Your name and other email addresses (optional, only if you enter them before sending opt-out emails) | To sign the opt-out emails and ask the sender to remove those addresses too. Kept in your browser tab only and gone when you close it; they only leave your device inside the email you send yourself. | Art. 6(1)(b) · Contract performance |
| Entitlement cookie | Set after an individual payment or after an anonymous company seat is redeemed. Remembers for 24 hours that the reset is unlocked. It contains no email data, employee identity or access token. | Art. 6(1)(b) · Contract performance |
| Company pilot administration | Company name, commercial contact, seat allocation, anonymous redemption count and an optional PO/invoice/agreement reference. We do not store which employee redeemed a seat or connect a redemption to an inbox. | Art. 6(1)(b) · Contract performance |
| Payment confirmation via Stripe | To verify payment and unlock the service. We never see card details. | Art. 6(1)(b) · Contract performance |
| Partner discount code (only if you enter one at checkout) | To pay the partner who recommended us a commission on your purchase. We record the partner code, the amount paid and Stripe's payment reference, never your name, email address or inbox data. No cookie or link tracking is used for this. Kept until the commission is settled and then as long as tax law requires us to keep bookkeeping records. | Art. 6(1)(f) · Legitimate interest |
| Email address (optional, only if you use the feedback form) | To respond if you report an issue. Provided voluntarily; never taken from your inbox. | Art. 6(1)(a) · Consent |
| Feedback you type (optional sender reports) | If you report a missed or persistent sender, we receive only the text you enter, never inbox data. | Art. 6(1)(a) · Consent |
| PIP kindness campaign: the country where a smile is opened, and your city only if you add it | When you open a PIP smile we store the country you are in at that moment: a two-letter code that our hosting provider derives from your internet address. We do not store your internet address, your city or anything that identifies you. The country, with the anonymous hand-off, is used for the public world map and for the stamps in the Smile Passport of the person who started that smile chain. A stamp also shows the day the first smile was opened in that country (a date, never a time). If you choose to add your city, we store the name you type; only the person who started that chain sees it, in their passport, and it never appears on the public map. You can change or remove it the same way. The anonymous keys of your own PIP journey are kept in your browser's local storage; no account is needed. | Country: Art. 6(1)(f) · Legitimate interest (showing the reach of the campaign). City: Art. 6(1)(a) · Consent |
| PIP notifications, only if you turn them on | If you ask to be notified when Pip lands, your browser gives us a notification address (an endpoint and two keys issued by your browser's push service). We keep it with the anonymous key of your own PIP journey and use it only to tell you that a smile was opened or a new passport stamp arrived. It contains no name, email address or internet address. Turning notifications off deletes it, and so does the push service rejecting it. A calendar reminder is created on your own device and sends nothing to us. | Art. 6(1)(a) · Consent |
| Anonymous usage statistics | Counts of page views (Vercel Web Analytics) and of a fixed list of product steps (PostHog, EU region), for example: a scan finished, the price was shown, a payment was confirmed. We use this to see where people get stuck and which channels bring visitors. Where a visit came from is recorded only as a category (such as search, social, or a campaign name we set in our own links) plus the first page path, never a full web address. No cookies are set for this. To link the steps of one visit, PostHog keeps a random identifier in your browser's session storage; it is deleted when you close the tab, it is not a profile, and it is never linked to your name, email address or inbox. Counts of senders are recorded only as a range such as "20-49", never as an exact number. For the details you can add to opt-out emails we record only whether something was filled in, never your name or the addresses themselves. Your inbox data, sender names and scan results are never sent to any analytics provider. | Art. 6(1)(f) · Legitimate interest |
We can’t read your emails. For Gmail, in-boxed uses Google’s gmail.metadata permission. This provides access to limited message metadata and headers, such as sender information and unsubscribe headers, but does not permit access to email bodies. Every message call made by in-boxed uses format=metadata and asks only for the sender and unsubscribe-related headers needed for the scan. For Outlook, Hotmail or Live we use delegated Mail.ReadBasic and request only the sender, reply-to and internet-message-header fields needed by the product. Our scan code does not request message bodies, subject lines or attachments, and inbox data is not sent to our servers.
4. Retention
Your email data is processed entirely within your own browser and is never transmitted to, stored on, or logged by our servers, whether you connect Gmail or Outlook/Hotmail/Live. The scan reads email headers locally on your device and keeps the results in your browser tab only. When you close the tab the data is gone; the short-lived access token (Gmail: valid for about one hour; Microsoft: similarly short-lived, no refresh token in either case) also lives only in your browser. Apart from the commission record when you use a partner discount code (see above), we operate no database and keep no logs containing personal data. The anonymous usage statistics described above are cookie-free and carry no persistent identifier: the only identifier is a random one kept in your browser’s session storage until you close the tab. They are never linked to a person or an inbox, and are stored separately from anything you connect. You can revoke access at any time from your Google Account permissions page, or, for Microsoft accounts, from account.live.com/consent/Manage.
PIP is separate from the inbox scan. For the PIP kindness campaign we store anonymous hand-offs with the country where a smile was opened and, only if the recipient added it, a city. We keep this while the PIP campaign runs and delete or anonymise it no later than 12 months after the campaign ends. You can remove a city you added at any time on the page where you opened the smile, or ask us via the contact details below. Someone who opens a smile from your journey sees only totals for that journey (how many people and how many countries) and which passport stamp it could earn next, never where it went or who opened it.
5. Data security
We protect your data first and foremost by never collecting it on our side. In addition, the following security measures apply to safeguard the confidentiality and integrity of your data, including sensitive Google and Microsoft user data:
- Encryption in transit. All connections, between your browser and our website, and between your browser and the Gmail API or Microsoft Graph API, are encrypted using HTTPS/TLS. Restricted-scope data is requested directly from Google or Microsoft over this encrypted connection and never passes through our servers.
- No server-side storage of inbox data. Your email data and access token stay in your browser, for both providers. Nothing from your mailbox reaches our servers and no server-side log contains it. If you start checkout, the browser may keep one short-lived recovery copy of the sender/route snapshot and your choices for up to 30 minutes so a bank-app return in a fresh tab does not force another scan. It never contains the OAuth token, message bodies, subjects or attachments, and is removed after payment confirmation. We operate no database and keep no server-side logs containing inbox data.
- Data minimisation. We request only email header metadata (the
From,Reply-To,List-Id,List-UnsubscribeandList-Unsubscribe-Postheaders and the unread label, or their Microsoft Graph equivalents) and never message bodies, subject lines, or attachments. - Short-lived access. Access tokens expire quickly (Gmail: about one hour) and have no refresh token, so access cannot persist or be reused after your session, for either provider.
- Secure session cookie. The only cookie we set is strictly necessary, HTTP-only, Secure, and SameSite-restricted, and it contains no email data.
- Payment security. Card payments are handled entirely by Stripe (PCI-DSS Level 1 certified). We never receive or store your card details.
Because our servers never receive your email data, the risks associated with a server-side data breach do not apply. You can revoke in-boxed’s access at any time from your Google Account permissions page or your Microsoft account’s app permissions.
6. OAuth providers and API access
We use Google OAuth 2.0 with the gmail.metadata scope, which Google describes as viewing your email message metadata such as labels and headers, but not the email body, and, if you connect Outlook, Hotmail or Live instead, Microsoft OAuth 2.0 with the delegated Mail.ReadBasic scope, which Microsoft defines as access to everything about a message except its body, preview body, attachments and extended properties. In both cases the API is called directly from your browser to Google or Microsoft; restricted-scope data never passes through our servers. Our use of Gmail data complies with the Google API Services User Data Policy, including the Limited Use requirements, and we apply the same principles to Microsoft Graph data:
- Email header data is used solely to provide the service you requested
- Email header data is not used for advertising
- No human reads your email header data
- Email header data is not shared with third parties beyond what is necessary to operate the service
7. Sub-processors
| Party | Purpose | Transfer basis |
|---|---|---|
| Google LLC | Gmail API · OAuth and header retrieval | Standard Contractual Clauses |
| Microsoft Corporation | Microsoft Graph API · OAuth and header retrieval, for Outlook, Hotmail or Live accounts | Standard Contractual Clauses |
| Stripe Inc. | Payment processing | Standard Contractual Clauses |
| Neon, Inc. | Operational database for company pilot administration and affiliate records. No Gmail or Outlook inbox data is stored there. | Contractual safeguards applicable to the service |
| Vercel Inc. | Application hosting, and cookie-free aggregate usage statistics (Vercel Web Analytics) | Standard Contractual Clauses |
| Functional Software, Inc. (Sentry) | Error monitoring (EU region). Configured to send no personal data, no IP, no Gmail or Outlook data. | Standard Contractual Clauses |
| PostHog Inc. | Anonymous product analytics (PostHog EU Cloud). Receives only a fixed list of product steps with categories such as language, device type and where the visit came from. No cookies, no persistent identifier, IP addresses discarded, no location data, no Gmail or Outlook data. | Data processing agreement; data hosted in the EU |
| Formspree, Inc. | Delivers optional sender-feedback submissions. Only what you voluntarily type. | Standard Contractual Clauses |
We do not sell data. We do not use advertisers or data brokers.
8. Your rights (Articles 15–22 GDPR)
You have the right to access, rectify, erase, restrict, and port your data, and to object to processing. For the scan these rights are fulfilled automatically, because nothing is retained after your session ends. To exercise them or ask questions, contact privacy@in-boxed.com. We respond within 30 days.
9. Supervisory authority
You may lodge a complaint with the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl) or the supervisory authority in your country of residence.
10. Cookies
We set one strictly necessary entitlement cookie after an individual payment or after an anonymous company seat is redeemed. It records only that the reset is unlocked, so you are not asked to unlock it again within 24 hours. It is signed, HTTP-only, Secure and SameSite-restricted, contains no email data and no access token, and expires after 24 hours. No tracking or advertising cookies are used. For website statistics we use cookieless analytics (Vercel Web Analytics for page views, PostHog in the EU region for a fixed, published list of product steps), so we can see where people get stuck and fix it. These tools set no cookies. PostHog keeps a random identifier in your browser’s session storage for the duration of the tab so that the steps of one visit can be counted together; it is deleted when you close the tab. We also use your browser’s session storage for the scan results and for the category of where your visit came from, and local storage to remember your language choice. None of this is sent to us together with your Gmail or Outlook data, which never reaches our servers.
11. Third-party trademarks
Gmail is a trademark of Google LLC. Outlook, Hotmail and Live are trademarks of Microsoft Corporation. in-boxed is not affiliated with, endorsed by, or sponsored by Google LLC or Microsoft Corporation. Use of these names is solely for descriptive purposes to indicate compatibility.
12. Not legal advice
References to GDPR, CAN-SPAM, or other laws on this website are for informational purposes only and do not constitute legal advice. Results depend on sender compliance. If you have legal questions, consult a qualified attorney.