Privacy Policy

Inboxly ("Inboxly", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website or use our customer support platform services. By accessing or using our services, you agree to the terms of this Privacy Policy. If you do not agree, please discontinue use immediately.

We may collect the following categories of personal data: • Account Information: name, email address, phone number, company name, and job title when you register or contact us. • Usage Data: pages visited, features used, session duration, IP address, browser type, and device identifiers. • Communication Data: messages, support tickets, and chat history processed through our platform on behalf of your customers. • Payment Information: billing address and payment method details (processed securely through our payment provider; card numbers are never stored by us). • Cookies and Tracking Data: see our Cookie Policy for details.

We use your personal data for the following purposes: • To provide, operate, and maintain our platform and services. • To process transactions and send related billing information. • To respond to your inquiries and provide customer support. • To send administrative notices, product updates, and marketing communications (you may opt out at any time). • To analyze usage trends and improve platform performance and features. • To detect, prevent, and address fraud, security breaches, and technical issues. • To comply with applicable legal obligations under Thai law and the PDPA.

Inboxly offers an AI assistant that account owners can choose to enable. When enabled, conversation content — including messages from your end customers — is sent to a large language model (LLM) provider to draft replies or summarise conversations. Two modes are available: • Bring your own key (BYOK): you supply your own API key, so the contractual relationship is directly between you and the AI provider. • Managed: Inboxly sends the data to the provider on your behalf using its own key. Providers that may receive this data: Anthropic (Claude), whose servers are located outside Thailand. What is sent: recent messages in the conversation and the knowledge base you configure. Payment details and passwords are never sent. If you do not enable the AI features, no conversation content is sent to these providers.

Your data is stored on secure cloud infrastructure located in Europe. We implement industry-standard security measures including: • TLS 1.3 encryption in transit, and AES-256-GCM encryption at rest for connected-channel credentials and two-factor authentication secrets. • Role-based access controls and tenant data isolation. • Access fronted by Cloudflare (WAF and DDoS protection), with the origin server never exposed directly to the public internet. The retention period for messages and attachments depends on your subscription plan — see the next section, "Data Retention Periods", for details.

We rely on third-party providers to operate the platform. They access only the data necessary for their function and are bound by confidentiality obligations: • Contabo GmbH (France) — server, database and file storage infrastructure • Doppler (United States) — storage and delivery of system secrets • Meta Platforms (United States) — Facebook Messenger, Instagram and WhatsApp connectivity • LINE Corporation (Japan) — LINE Official Account connectivity • Telegram, TikTok, Shopee, Lazada, Shopify, Freshchat — connectivity for the channels you choose to enable • Anthropic (United States) — AI assistant features, only when you enable them • Google (United States) — sign-in with a Google account, only if you choose to use it • Browser push providers (Google, Mozilla, Apple) — delivery of push notifications, only when you enable them • Stripe (United States) — payment processing • Resend (United States) — system email delivery • Sentry (United States) — application error monitoring • Cloudflare (United States) — DNS, network protection, and human-verification (Turnstile) on contact forms International transfers: some providers are located outside Thailand, so using our service involves transferring personal data abroad under Section 28 of the PDPA. We select providers that maintain adequate data protection standards. Our role: for end-customer data that a business manages through our platform, that business is the data controller and Inboxly acts as a data processor following its instructions. For the account data of platform users themselves, Inboxly is the data controller. This list may change; we will update this policy when a material change occurs.

In line with PDPA's data-minimization principle, we retain messages and attachments for 30 days across all subscription plans: • Messages: 30 days. • Images and files: 30 days. The system automatically deletes data older than these windows daily at 10:00 AM Bangkok time (03:00 UTC). Daily aggregate statistics (message counts, conversation totals) are preserved before deletion so historical analytics dashboards remain functional. You may export all data via the "Download data" button in Billing settings before deletion. Account records, billing data, and audit logs are retained for longer periods as required by Thai law and applicable tax obligations.

Under Thailand's Personal Data Protection Act B.E. 2562 (PDPA), you have the following rights regarding your personal data: • Right to Access: request a copy of the personal data we hold about you. • Right to Rectification: request correction of inaccurate or incomplete data. • Right to Erasure: request deletion of your personal data, subject to legal obligations. • Right to Restriction: request that we restrict processing of your data in certain circumstances. • Right to Data Portability: receive your data in a structured, machine-readable format. • Right to Object: object to processing based on legitimate interests or for direct marketing. • Right to Withdraw Consent: withdraw consent at any time without affecting prior processing. To exercise any of these rights in relation to your own account data, contact us at [email protected]. We will respond within 30 days. If you are an end customer who contacted a business that uses Inboxly, your messages and data are controlled by that business, not by us. Please contact them directly. If you contact us, we will forward your request to them to action.

We use cookies and similar tracking technologies to enhance your experience on our platform. You can manage your cookie preferences through our Cookie Consent Banner or by adjusting your browser settings. For full details, please read our Cookie Policy.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: Data Controller for account data BUNGFAI TECH Co., Ltd. (บริษัท บั้งไฟ เทค จำกัด) operator of the Inboxly platform Juristic person registration no. 0105569112366 245/60 Moo Ban Sin Poem, Pracha Ruam Jai Road Sai Kong Din Tai, Khlong Sam Wa, Bangkok 10510, Thailand Email: [email protected] We take all privacy concerns seriously and will respond promptly.