Data Processing Addendum

This addendum is part of Inboxy's Terms of Service. It applies to all personal data Inboxy processes on a merchant's behalf when the merchant uses the service, including data received from Shopify, Salla, Zid, WooCommerce and any other store the merchant connects.

The merchant is the controller of its customers' personal data. Inboxy is the processor and processes it only on the merchant's instructions. Those instructions are the merchant's settings in the service (connected channels, automations, AI, campaigns) and any further written instructions we agree.

• Purpose: A unified inbox for customer conversations, automated and AI replies, order confirmations and updates, campaigns the merchant sends, and reports.
• Data subjects: The merchant's customers and people who message the merchant, and the merchant's team members who use Inboxy.
• Categories of data: Name, phone number, email address and address; message content and media; orders and ordered products; channel identifiers. We do not ask for special categories of data, and merchants should not send them through the service unless necessary.
• Duration: For as long as the merchant's account is active, then until deletion under section 8.

We process only the minimum data needed to provide the service. We do not sell personal data, and we do not use the merchant's customer data to train AI models or for any purpose of our own.

Only Inboxy staff who need merchant data to run and support the service can reach it, and they are bound by confidentiality. Staff accounts need strong passwords and mandatory two-factor authentication. Every staff view of merchant data in the admin panel, and every request made while signed in to a merchant's account for support, is logged with the staff member and time; signing in to a merchant's account needs a written reason.

• All traffic is encrypted with HTTPS/TLS.
• Access tokens and channel and store credentials are encrypted in the database (AES-256-GCM); media and backups stored in Amazon S3 are encrypted (AES-256).
• Each merchant's data is isolated from other merchants on every request, and test and production data are kept separate: production data is never copied to developer machines or test environments.
• Server access with SSH keys only, and a firewall that opens only the ports the service needs.
• Strong passwords for every account, mandatory two-factor authentication for Inboxy staff, and sessions ended when a password changes.
• Daily encrypted off-server backups, error and uptime monitoring, access logs, and a written security incident response policy.

The merchant authorises Inboxy to use the sub-processors below. Each is bound by data protection terms no less protective than this addendum, and Inboxy remains responsible for them. We update this list and email merchants 14 days before adding a new sub-processor of customer data; the merchant may object or end the service.

Channels and stores the merchant connects itself (such as Telegram, TikTok, Shopify, Salla, Zid and WooCommerce) receive data on the merchant's instructions and under their own terms with the merchant.

Inboxy hosts data in Germany. When the service needs to send data to a sub-processor outside the merchant's country (for example an AI provider), we send only what is needed, under the transfer safeguards that sub-processor offers, such as Standard Contractual Clauses.

We help merchants answer requests to access, correct or delete personal data. Requests go through our data deletion page or support@inboxy.chat, and we complete them within 30 days. For the Shopify app we handle the privacy requests Shopify sends (customer data request, customer erasure, shop erasure). If a merchant's customer contacts us directly, we pass the request to the merchant.

• We keep data for as long as the merchant's account is active, unless the merchant deletes it sooner.
• When a store app is uninstalled, its access tokens are cleared and syncing stops at once. For the Shopify app, customer records copied from the store are erased when Shopify's shop erasure request arrives, or after 30 days if it does not. For other stores, conversation and order history stays in the merchant's account until the merchant asks for it to be deleted.
• When the account ends or deletion is requested, we delete the merchant's and its customers' data within 30 days; encrypted backups that may still hold it expire within 90 days.
• The merchant may ask for a copy of its data before deletion.

If we become aware of a security incident affecting the merchant's or its customers' data, we tell the merchant without undue delay and within 72 hours at most, with what we know about the affected data, what we have done and what the merchant should do, and we help the merchant meet its own obligations to its customers and regulators. For data received from Shopify we also notify Shopify within 24 hours.

We answer reasonable security and privacy questionnaires from the merchant, provide the information needed to show we meet this addendum, and help with data protection impact assessments where needed.

Data protection questions: support@inboxy.chat. See also our Privacy Policy and Terms of Service.