Privacy Policy
Last updated: 9 October 2026
This Privacy Policy explains how Lifecycle Innovations Limited ("InboxAssist", "we", "us") collects, uses, and protects personal data when you use inboxassist.ai. It replaces previously published third-party legal pages that are no longer active.
Controller: Lifecycle Innovations Limited, Unit 4005, 40/F Singga Commercial Centre, 144-151 Connaught Road West, Hong Kong; US office: 111 NE 1st St, 8th Floor STE 89079, Miami, FL 33132, United States. Contact: [email protected].
1. Data we process
- Account data — name, email address, and authentication identifiers from Clerk when you create an account.
- Gmail access — OAuth tokens that let InboxAssist read and act on your Gmail or Google Workspace inbox (categorize, label, draft, unsubscribe, or cancel) with your permission. Tokens are encrypted at rest (AES-256-CBC).
- Email content and operational records — message subjects, bodies, sender details, and metadata are processed to provide the service. Email content can be retained in job results and training-card caches. User feedback, analytics, drafts, and derived preferences may also be stored to support the features you use.
- Consent records - account or email-subscriber identifier, server timestamp, purpose, grant or withdrawal, notice version and text, source, and request IP address and browser user-agent where available.
- Billing data — Stripe customer and subscription identifiers. We do not store raw card numbers.
- Product analytics and diagnostics — Amplitude events and Sentry error reports. Email content is excluded from error telemetry where technically feasible.
2. Why we process it
We process personal data to:
- provide the InboxAssist service (contract — GDPR Art. 6(1)(b));
- bill subscriptions and operate the 7-day free trial (contract);
- keep the product secure and debug failures (legitimate interests — Art. 6(1)(f));
- understand product usage in aggregate, using consent for non-essential analytics where required; and
- meet legal obligations such as tax and accounting records.
2a. Optional learning and email marketing
Per-account learning from draft edits, label changes, snoozes and feedback requires a separate affirmative, current-version training consent. Fetching sent Gmail messages to derive your writing tone requires an additional, optional tone-learning consent. Both choices default off. You can withdraw them in Settings. Withdrawing tone consent stops sent-mail learning and reuse and removes sent-mail learning examples and derived learned profiles. Withdrawing training consent also disables tone learning and deletes collected training signals. Manually entered settings are preserved.
Product tips, updates and offers by email require separate affirmative marketing consent. Free toolkit downloads do not require email marketing enrollment. You can unsubscribe through the link in lifecycle marketing messages.
These optional activities rely on consent (GDPR Art. 6(1)(a)). We retain versioned records of genuine grants and withdrawals to demonstrate your choices and honor withdrawals. Legacy settings are not treated as new consent, and consent evidence is not inferred or backfilled.
3. Gmail and AI processing
InboxAssist connects to Gmail and, with your permission, Google Calendar via Google OAuth. Gmail modify access supports reading messages, applying labels, creating drafts, and moving messages to Trash. Calendar event access supports reading and creating events; Calendar settings access supports timezone lookup. We do not request Google Drive or Contacts access. Email content and relevant context are sent to AI inference providers for categorization and drafts. Research features can send sender information or an email subject and body excerpt to Tavily, our search provider. URLs found in emails can also be sent to Tavily to extract and summarize the linked pages. You can revoke Google access at any time. Revocation stops future Google access but does not automatically delete existing product records.
3a. Google user data and Limited Use
InboxAssist's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- We use Gmail and Google Calendar data only to provide the features you see in InboxAssist: sorting and labeling mail, writing drafts, sending replies you approve, moving mail to Trash, reading and creating calendar events, and showing times in your timezone.
- We share this data only with the sub-processors that run those features (hosting, AI inference and research, as listed in section 4), for security, to comply with law, or as part of a merger or sale after asking for your explicit consent.
- We do not sell Google user data, use it for advertising, or use it to decide credit or lending.
- We do not use Google user data to train generalized AI or machine learning models. Draft personalization based on your own mail stays scoped to your account.
- People at InboxAssist do not read your mail unless you ask us to for a specific message, it is needed to investigate a bug or abuse, it is required by law, or the data is aggregated for internal operations.
4. Sub-processors
We use vetted processors listed on the Sub-Processor Registry. Enterprise customers can request a Data Processing Agreement.
5. Retention
- Account and billing records: for the life of the account, then as required by law.
- After you delete your account: personal data is removed within 30 days except records we must keep (for example invoices).
- OAuth tokens: deleted when you disconnect Gmail or delete your account.
6. Your rights
If GDPR, UK GDPR, or similar law applies, you may request access, correction, deletion, restriction, portability, or objection. Use Settings → Privacy in the app or email [email protected]. California residents may also request to know, delete, or correct personal information; we do not sell personal information.
7. International transfers
InboxAssist is operated by Lifecycle Innovations Limited, a Hong Kong company, and hosted in the United States. Transfers outside the EEA use Standard Contractual Clauses or another lawful mechanism.
8. Chrome extension
If you install the InboxAssist Chrome extension, it can read Gmail UI context needed to show labels, drafts, and actions in the browser. The extension does not sell data, does not use it for advertising, and does not keep a local archive of raw message bodies. You can remove the extension at any time from Chrome.
9. Cookies
See our Cookie Policy for cookies, analytics, and how to manage consent.
10. Children
InboxAssist is not directed at children under 16. We do not knowingly collect their data.
11. Changes
We will update this page when the policy changes. The date at the top is the latest revision. Related documents live on /legal.
