1. DATA MINIMIZATION & ZERO RETENTION

inboxscore processes email metadata (headers, timestamp metrics, response latencies) strictly to deliver visual intelligence reports. Message contents are never stored on our persistent database nodes.

Specifically, the platform analyzes:

• Header metadata — sender, recipient, subject line length, and thread identifiers.
• Temporal signals — timestamps, response delays, and timezone activity windows.
• Structural patterns — thread depth, forward counts, and reply distribution.
• Volume metrics — message counts per sender, cluster, and time window.

We never read, index, or retain the body text, attachments, or inline content of your emails. This is not a policy promise—it is an architectural constraint. The system cannot see what it does not ingest.

2. ENCRYPTION STANDARDS

All data transit utilizes TLS 1.3 encryption. Metadata tokens are encrypted at rest using AES-256 cryptographic keys.

Additional safeguards include:

• Client-side processing — Most metadata analysis runs entirely within your browser, never touching our servers.
• Sandboxed execution — Any server-side processing occurs in ephemeral, isolated environments destroyed within minutes.
• Key rotation — Encryption keys are rotated on a 30-day cycle and stored in hardware security modules.
• Zero-knowledge tokens — OAuth tokens are stored in hashed form. We cannot reconstruct your session credentials.

We conduct quarterly third-party security audits. Reports are available to enterprise customers on request.

3. GDPR & CCPA RIGHTS

Users maintain the absolute right to export or delete connected inbox tokens at any time through account settings.

Depending on your jurisdiction, you also have the right to:

• Access — Request a full disclosure of any personal data we hold.
• Correction — Request correction of inaccurate stored information.
• Deletion — Request permanent erasure of all associated metadata.
• Portability — Export your data in a machine-readable format.
• Restriction — Limit how your data is processed without deleting it.
• Objection — Object to processing based on legitimate interest.

All rights requests are fulfilled within 30 days. Most are fulfilled within 48 hours. There is no fee for exercising any right.

4. THIRD-PARTY PROCESSORS

We use a limited set of infrastructure providers to operate the platform. Each is bound by a Data Processing Agreement and subject to the same privacy standards we impose on ourselves.

• Cloud hosting — Ephemeral compute and storage with no persistent data retention.
• Email delivery — Transactional alerts only. No marketing lists are shared.
• Analytics — Self-hosted, privacy-first analytics. No Google Analytics, no third-party tracking pixels.
• Payment processing — PCI-DSS compliant providers. We never see or store card details.

We do not sell, rent, or share personal data with advertisers, data brokers, or marketing platforms. Ever.

5. DATA RETENTION POLICY

Because we do not store message contents, our retention surface is minimal by design:

• Account credentials — Retained while your account is active.
• OAuth tokens — Retained in hashed form until you disconnect or revoke access.
• Metadata snapshots — Retained for up to 30 days for dashboard rendering, then permanently deleted.
• Audit logs — Retained for 12 months for security and compliance purposes.
• Billing records — Retained as required by tax and accounting law.

Upon account deletion, all personal data is purged within 7 days. Metadata snapshots are destroyed immediately.

6. CHILDREN'S PRIVACY

inboxscore is not directed at individuals under the age of 16. We do not knowingly collect personal information from children. If such data is discovered, it will be deleted promptly.

7. INTERNATIONAL DATA TRANSFERS

Our infrastructure is hosted in data centers across North America and the European Union. When data crosses borders, we rely on Standard Contractual Clauses approved by the European Commission and equivalent legal mechanisms in other jurisdictions.

Enterprise customers with data residency requirements can request regional deployment. Contact our team for details.

8. CHANGES TO THIS POLICY

We may update this privacy policy periodically to reflect changes in law, technology, or our practices. The "Last Updated" date at the top of this page will always indicate the most recent revision.

Material changes will be communicated by email to all active account holders at least 14 days before they take effect.

9. CONTACT & DATA PROTECTION OFFICER

For questions regarding this privacy policy or the handling of your personal data, contact our Data Protection Officer directly:

privacy@inboxscore.org

All privacy-related inquiries receive a response within 7 business days. Formal rights requests are processed within 30 days as required by GDPR.

1. ACCEPTANCE OF TERMS

By registering or utilizing inboxscore services, you agree to comply with all acceptable usage policies and platform security guidelines.

If you are entering into these terms on behalf of a company or other legal entity, you represent that you have the authority to bind that entity. If you do not agree with any part of these terms, you must discontinue use of the platform immediately.

2. SERVICE AVAILABILITY

We commit to maintaining a 99.9% platform availability SLA for enterprise tier subscribers.

Specifically, the SLA covers:

• Uptime commitment — 99.9% monthly availability, excluding scheduled maintenance.
• Incident response — Critical incidents acknowledged within 15 minutes, 24/7.
• Service credits — Automatic credits applied for any monthly uptime below the committed threshold.
• Status transparency — Real-time status updates published at status.inboxscore.org.

Scheduled maintenance windows are announced at least 7 days in advance and are performed during low-traffic hours. Free and pro tier subscribers receive best-effort availability without contractual guarantees.

3. ACCEPTABLE USE POLICY

You agree to use inboxscore only for lawful purposes and in ways that do not infringe on the rights of others. Prohibited activities include:

• Attempting to reverse-engineer, decompile, or extract source code from the platform.
• Using automated systems to scrape, harvest, or bulk-collect data.
• Introducing malware, viruses, or any harmful code.
• Impersonating inboxscore, its team, or other users.
• Interfering with the proper functioning of the platform or its infrastructure.
• Using the service to harass, threaten, or harm others.
• Reselling or sublicensing access without written permission.

Violation of these policies may result in immediate account termination without refund.

4. ACCOUNT & SECURITY RESPONSIBILITIES

You are responsible for maintaining the confidentiality of your account credentials and for all activity that occurs under your account.

Your responsibilities include:

• Using strong, unique passwords that are not shared across services.
• Enabling two-factor authentication wherever available.
• Notifying us immediately of any unauthorized access or suspected breach.
• Ensuring all users added to your account comply with these terms.

We are not liable for losses caused by unauthorized access resulting from your failure to maintain credential security.

5. INTELLECTUAL PROPERTY

All platform code, design, editorial content, frameworks, and documentation are the exclusive intellectual property of inboxscore and are protected under international copyright law.

You are granted a limited, non-exclusive, non-transferable license to use the platform for its intended purpose. You may not:

• Copy, modify, or distribute any part of the platform.
• Use our trademarks, logos, or brand assets without written permission.
• Create derivative works based on our code or design systems.
• Remove or obscure any copyright, trademark, or attribution notices.

6. BILLING & SUBSCRIPTION TERMS

Paid subscriptions renew automatically at the end of each billing cycle unless cancelled beforehand.

Key terms:

• Cancellation — Available at any time from your account settings. No notice period required.
• Refunds — Pro-rated refunds available within 14 days of purchase for annual plans.
• Price changes — Communicated at least 30 days in advance for existing subscribers.
• Failed payments — Accounts are suspended after 7 days of failed retry attempts.

7. LIMITATION OF LIABILITY

inboxscore shall not be liable for any indirect, incidental, special, consequential, or punitive damages arising from your use of the platform.

This includes, but is not limited to:

• Loss of business, revenue, or anticipated profits.
• Loss of data, even where caused by platform failure.
• Business interruption or operational downtime.
• Decisions made based on information surfaced by the platform.

Our total cumulative liability is limited to the amount you have paid us in the 12 months preceding the claim.

8. TERMINATION

We reserve the right to suspend or terminate accounts that violate these terms, at our discretion, with or without notice.

You may terminate your account at any time. Upon termination:

• All access to the platform ceases immediately.
• All personal data is purged within 7 days.
• Outstanding invoices remain payable.

9. GOVERNING LAW & DISPUTE RESOLUTION

These terms are governed by the laws of the State of Delaware, United States, without regard to conflict-of-law principles.

Any disputes arising from these terms or your use of the platform shall be resolved through binding arbitration in Wilmington, Delaware, except where prohibited by law. Both parties waive the right to a jury trial.

10. CHANGES TO TERMS

We may update these terms periodically. The "Last Updated" date at the top of this page will always indicate the most recent revision.

Material changes will be communicated by email at least 14 days before they take effect. Continued use of the platform after changes are posted constitutes acceptance of the updated terms.

11. CONTACT

For questions about these terms or your account, contact our team:

legal@inboxscore.org

All legal inquiries receive a response within 7 business days.