Privacy Policy

Information we process

We process account and workspace information, verified domain records, mailbox and agent metadata, API request metadata, webhook configuration, message headers, message bodies, attachments, delivery events, and operational logs needed to run the service.

We also process contact information when a user requests access, asks for support, or submits a user report.

How we use information

• Provide and secure agent mailbox, sending, inbound parsing, and webhook delivery features.
• Verify domain ownership, sender alignment, delivery state, and delivery configuration.
• Detect misuse, enforce rate limits, investigate bounces or complaints, and protect recipient trust.
• Respond to support, security, legal, delivery review, and user report requests.
• Improve reliability, debugging, and product operations without selling personal information.

Sign in with Google

When you use Sign in with Google on the console, Google provides LoftBox with an ID token containing the issuer (iss), subject (sub), and verified email address, plus basic profile fields. Requested scopes are openid, email, and profile only.

LoftBox uses the issuer and subject to bind the Google identity to your LoftBox account and to create a login session. New Google users complete the existing onboarding/signup flow; no account or organization is created implicitly. LoftBox does not request Gmail scopes and does not access Gmail message content.

Email content and recipients

LoftBox is designed for transactional and operational agent workflows. We process message content and recipient data only as needed to send, receive, route, log, inspect, and secure those workflows.

Users are responsible for having a lawful basis to send email to recipients and for honoring unsubscribe, opt-out, deletion, and compliance obligations that apply to their use case.

Service providers

We may use infrastructure, hosting, database, monitoring, email delivery, DNS, and security providers to operate LoftBox. These providers process information only as needed to provide services to us.

Retention and security

We retain operational records for as long as needed to provide the service, debug delivery, enforce report and safety controls, comply with obligations, and resolve disputes. We use access controls, secret handling, logging controls, and delivery configuration practices intended to reduce unauthorized access.

Contact

Privacy questions and user reports can be sent to [email protected].