Privacy Policy

1. Who we are

Mailboxx, Inc. ("Mailboxx," "we," "us," or "our") provides a rewarded-email platform that lets readers earn payouts for opening promotional messages and lets verified businesses send paid promotions. This Privacy Policy explains what personal information we collect, how we use and share it, and the choices you have. By creating an account or using the Mailboxx mobile app, website, or services (collectively, the "Service"), you agree to the practices described in this policy.

2. Information we collect

Information you provide

• Account information: name, email address, password, phone number, profile photo, and category preferences.
• Identity verification (KYC): for withdrawals, our payment partner Stripe collects legal name, date of birth, address, government-issued ID, and the last four digits of your tax ID, where required by law.
• Payout details: bank account, debit-card details, or Mailboxx Card details necessary to send or receive funds.
• Business / sender information: for advertiser accounts, business name, EIN or local equivalent, billing address, and authorized-signatory details.
• Communications: messages you send to us, support tickets, survey responses, and feedback.

Information we collect automatically

• Usage data: promotions opened, viewed, clicked, saved, archived, blocked, or skipped; reading time; follow/unfollow actions; balance and transaction history.
• Device data: device model, operating system, app version, mobile network, language, time zone, IP address, and crash diagnostics.
• Approximate location: derived from IP address or, with your permission, coarse device location used for category targeting (e.g., showing a promotion from a local business).
• Cookies and similar technologies: used on our website for sign-in, security, and basic analytics. See Section 6.

Information from third parties

• Sign-in providers (e.g., Google) if you choose to use them — we receive your name, email, and profile photo.
• Payment partners (Stripe) confirm identity verification status and transaction outcomes.
• Fraud-prevention providers may share signals about suspicious devices or accounts.

3. How we use your information

We use your personal information to:

• Operate and improve the Service, personalize promotions to the categories and senders you follow, and surface the most relevant local businesses.
• Process payouts, fund transfers, the Mailboxx Card, and refunds; calculate balances, fees, and tax reporting.
• Verify identity, prevent fraud, detect abuse, and protect the integrity of payouts and promotion analytics.
• Send transactional messages (e.g., payout confirmations, security alerts) and, with your consent, product updates.
• Respond to your support requests and conduct research, analytics, and product development.
• Comply with legal obligations and enforce our Terms of Service.

4. How we share information

We share personal information only as described below, never for advertising other companies' products outside the Mailboxx promotions feed.

• Senders / advertisers: when you open or click a promotion, the sender receives aggregate analytics (counts, CTR, region) and not your identity, email address, or device ID, unless you click a link inside their promotion that takes you to their own website — at which point that sender's own privacy policy applies.
• Service providers: Stripe (payments & KYC), cloud-hosting (AWS), email-delivery (SES), analytics (privacy-respecting first-party tooling), and customer support — all bound by confidentiality and limited-use obligations.
• Compliance & safety: to comply with valid legal process, enforce our terms, protect the rights, property, or safety of Mailboxx, our users, or the public.
• Corporate transactions: in connection with a merger, acquisition, financing, or sale of assets, subject to standard confidentiality protections.

5. Payments & identity verification

All payouts and fund movement are handled by Stripe. Stripe is an independent controller of the personal data necessary to provide regulated payment services and is responsible for its own use of that data under the Stripe Privacy Policy. We receive only the verification status and transaction outcomes needed to credit your balance, withdraw funds, or fund a promotion. We never receive or store your full debit-card or bank-account number on our servers.

6. Tracking, analytics & advertising

We use first-party cookies and similar local-storage technologies to keep you signed in, remember your preferences, and measure basic Service performance. We do not use third-party advertising trackers on the Service, and we do not allow senders to embed their own tracking pixels in Mailboxx promotions.

On iOS, Mailboxx complies with Apple's App Tracking Transparency framework. The Mailboxx app does not track you across other apps or websites for advertising purposes.

7. Data retention

We retain personal information for as long as your account is active and for a reasonable period after to comply with legal, tax, accounting, anti-fraud, and dispute-resolution obligations (typically up to 7 years for financial records). You can request deletion of your account at any time — see Section 9.

8. Security

We protect personal information using industry-standard administrative, technical, and physical safeguards including TLS encryption in transit, at-rest encryption of sensitive fields, hardware-backed credential storage on mobile devices, strict employee access controls, and continuous security monitoring. No method of transmission or storage is 100% secure, but we work hard to keep your data safe.

9. Your rights & choices

Depending on where you live, you have rights to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Delete your personal information (subject to legal retention obligations such as financial records).
• Port your information to another service in a structured, machine-readable format.
• Object to or restrict certain processing.
• Withdraw consent where processing is based on consent.
• Opt out of "sale" or "sharing" of personal information — which we do not do, but California residents may submit a request as a formality.
• Lodge a complaint with your local data-protection authority.

To exercise any right, write to privacy@mailboxx.app. We will verify your identity before fulfilling your request, and respond within the timeframes required by applicable law (typically 30 days).

10. Children

Mailboxx is intended for adults only. You must be at least 18 years old (or the age of majority in your jurisdiction, whichever is higher) to create an account, because the Service involves financial transactions. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us personal information, contact us and we will promptly delete it.

11. International users

Mailboxx is operated from the United States. If you access the Service from outside the U.S., your personal information will be transferred to, stored, and processed in the U.S. and other jurisdictions where our service providers operate. We rely on appropriate safeguards (including the EU Standard Contractual Clauses where applicable) for such transfers.

If you are in the European Economic Area, United Kingdom, or Switzerland, the legal bases for our processing are: performance of the contract with you, our legitimate interests in operating and securing the Service, compliance with legal obligations, and consent (where required).

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the app or by email at least 14 days before the changes take effect. The "Last updated" date at the top reflects the most recent revision.

13. Contact us

If you have questions about this Privacy Policy or our privacy practices, contact us at:

Mailboxx, Inc.
Privacy Team
privacy@mailboxx.app
548 Market St, PMB 91234, San Francisco, CA 94104, USA

For EU/UK residents, our representative under Article 27 GDPR can be reached at eu-rep@mailboxx.app.