GDPR
Where GDPR applies, individuals may have rights to access, correct, erase, restrict or object to processing, and to data portability. Rights depend on the circumstances and applicable law.
Make a privacy request →European Commission guidance ↗Your email. Your data.
Know where you stand.
A clear view of how InboxIt handles data, protects access and keeps you informed.
Ask a security question Last updated 24 October 2026Control who gets in.
Server-enforced workspace permissions, scoped and revocable API keys, and HttpOnly authentication cookies help protect access.
Backed up. Separately.
Encrypted backups run daily and are copied off-server. Dedicated access policies protect the backup storage.
Limits, in plain sight.
Mailbox retention is seven days on Free and 30 days on Build and Scale. Backup erasure has a separate lifecycle.
Where your data goes
- Application database
- Supabase Ireland regional pooler (eu-west-1).
- Application and mail services
- Namecheap VPS; provider-published location: Phoenix, United States.
- Encrypted recovery archives
- Supabase Storage in the configured project. No blanket region-exclusive processing guarantee.
POPIA
InboxIt is operated by DIGIGAP TECHNOLOGIES in South Africa. Contact us about access, correction, deletion or objections concerning your personal information.
Contact our privacy team →Information Regulator guidance ↗These are data-protection information links, not certification seals. InboxIt does not claim SOC 2 or ISO 27001 certification. Provider contractual review, physical backup pruning and a complete operational retention schedule remain outstanding. See our security page for details.
The details behind the promise.
Questions deserve answers.
For security reports, privacy requests or a customer data-processing agreement, contact hello@inboxit.wtf. Please do not include passwords or API keys.
Contact us ↗View service status ↗