Privacy Policy

This policy explains what Postbox collects and how we handle it. Postbox is operated by Postbox, Inc. ("Postbox," "we," "us"), 2261 Market Street, STE 46197, San Francisco, CA 94114, USA.

Two roles matter here. For the mail your application routes through us, Postbox acts as a processor: we handle that content on your behalf and under your instructions, and our Data Processing Agreement governs it. For your own account and billing information, we act as a controller, and this policy describes how we handle it.

What we collect

Account data: your name, email, and authentication details when you sign up, and your organization and project settings. Payment data: billing contact and subscription details; card details are collected and stored by our payment provider, Stripe, not by us. Mail content: messages, attachments, and metadata you send, receive, or store through the Service (processed on your behalf). Usage data: API logs, delivery, bounce and complaint events, and diagnostics needed to operate and secure the platform.

How we use it, and our legal bases

We use this data only to provide, secure, and improve the Service: to route and store your mail, manage deliverability, meter usage for billing, prevent abuse, and support you. We do not sell your data, and we do not read your mail content except as needed to operate the Service, prevent abuse, or comply with law.

Where the GDPR or similar law applies, we rely on these legal bases: performance of a contract (to provide the Service you sign up for and bill you); legitimate interests (to secure the platform, prevent abuse, and maintain deliverability); legal obligation (to meet tax, accounting, and lawful-request requirements); and consent where we ask for it. For mail content processed on your behalf, your instructions and your own legal basis as controller govern the processing.

Sharing and sub-processors

We share data with vetted infrastructure and service providers who process it on our behalf under data-protection terms, listed on our sub-processors page (for example, our email-delivery, storage, database, and payment providers). We may also disclose data to comply with law or a valid legal request, to enforce our terms, or to protect the rights and safety of Postbox, our customers, and the public. We do not sell personal data, and we do not share it for cross-context behavioral advertising.

Infrastructure, data location, and transfers

Postbox runs on reputable third-party cloud and email-infrastructure providers under contractual data-protection terms. You can pin a project to the EU for data residency; by default, processing occurs in the region you select for each project. Where data is transferred internationally (for example, to providers in the United States), we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

Retention

Mail is stored for the retention period you configure per mailbox, and you can delete mailboxes and their contents at any time. Account and billing records are kept while your account is active and for a limited period afterward to meet legal, tax, and operational needs, then deleted or anonymized.

Security

Data is encrypted in transit and at rest. Access is scoped by project-level API keys, and mailbox tokens are short-lived and limited to a single inbox. We restrict internal access to what is needed to operate the Service. Report a suspected exposure to [email protected] so keys can be rotated.

Data breach

If we become aware of a personal-data breach affecting your data, we will notify you without undue delay and provide the information you reasonably need to meet your own notification obligations, as detailed in our Data Processing Agreement.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to restrict or object to certain processing, to withdraw consent, and to lodge a complaint with your data-protection authority. You can access, export, or delete much of your data directly in the dashboard, or contact us to exercise any of these rights. Where the mail in question was processed on a customer's behalf, we will refer a data subject's request to that customer.

EU and UK representative

Where legally required, individuals in the EU or UK may contact our representative for data-protection matters at [email protected].

Children

Postbox is a developer product not directed to children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us personal data, contact us and we will delete it.

Changes

We may update this policy as the Service evolves. Material changes will be posted here with a new "last updated" date.

Contact

Privacy questions or requests: [email protected]. Postbox, Inc., 2261 Market Street, STE 46197, San Francisco, CA 94114, USA.