Privacy Policy

This Privacy Policy explains how Outbox Labs Inc., doing business as Zapmail (“Zapmail,” “we,” “us,” or “our”), collects, uses, discloses, and otherwise processes personal data in connection with our websites, applications, dashboards, APIs, communications, and related services (collectively, the “Services”).

This Privacy Policy also describes your privacy rights and choices, and how to contact us if you have questions.

By accessing or using the Services, you acknowledge that your information will be handled as described in this Privacy Policy.

1. Scope

This Privacy Policy applies to personal data we process when you:

• visit our websites or product pages,
• create an account,
• use Zapmail workspaces, mailbox tools, domain tools, Zapbox, integrations, reports, or related features,
• connect third-party services such as registrars, email providers, sequencing tools, or payment methods,
• communicate with us by email, chat, support, sales, social media, or otherwise,
• participate in surveys, promotional programs, rewards, events, or marketing activities.

This Privacy Policy does not apply to third-party websites, services, products, or platforms that you choose to connect to or access through the Services, each of which is governed by its own privacy policy.

2. Roles and Relationship to Customer Data

Depending on the context, Zapmail may act as either:

• a controller of personal data, where we determine the purposes and means of processing, such as for account management, billing, fraud prevention, product analytics, support, security, and marketing; or
• a processor or service provider on behalf of our business customers, where we process personal data submitted to the Services by or on behalf of a customer, such as mailbox data, workspace content, contact data, team-access data, and other operational data handled under the customer’s instructions.

If you use the Services on behalf of a business, agency, or other organization, that organization is generally the controller of customer-submitted data, and Zapmail acts as its processor or service provider for that data except where we act independently as a controller for our own legitimate business purposes.

If you are an end user of a customer’s workspace, mailbox, or connected system and have questions about how your data is handled, you should contact the relevant customer first.

3. Personal Data We Collect

We may collect the following categories of personal data.

3.1 Information You Provide Directly

We collect personal data you provide to us, including:

• name, email address, phone number, company name, role, and other account profile details;
• login and authentication information;
• billing details, billing contacts, payment-related information, transaction history, tax-related information, and wallet activity;
• support inquiries, chat messages, emails, survey responses, feedback, and other communications;
• information submitted when inviting users to workspaces or assigning administrative roles;
• information you provide when purchasing domains, mailboxes, subscriptions, credits, or add-ons;
• domain, DNS, registrar, mailbox, workspace, export, and configuration information you submit or authorize us to access;
• content you upload, compose, send, store, or manage through the Services, including content associated with Zapbox, signatures, tags, imports, filters, notes, and settings;
• identity or profile-related information used with bulk generation or AI-assisted workflows, including names, images, profile assets, gender-ratio preferences, and related settings;
• information you provide in connection with domain buyback requests, including domain ownership or eligibility information;
• any other information you choose to provide through the Services.

3.2 Information We Collect Automatically

When you use the Services, we automatically collect certain technical and usage data, including:

• IP address, browser type, device identifiers, operating system, language, approximate location, and referring URLs;
• login events, session activity, timestamps, clickstream data, page views, and in-app navigation patterns;
• interactions with workspaces, domains, mailboxes, reports, filters, searches, exports, logs, alerts, actions, and integrations;
• crash data, diagnostic data, performance data, and error logs;
• information collected through cookies, pixels, SDKs, local storage, and similar technologies.

3.3 Information From Third Parties and Connected Services

We may receive information from third parties, such as:

• payment processors and billing service providers;
• analytics vendors and infrastructure providers;
• identity verification, fraud prevention, or security providers;
• email providers, DNS providers, registrars, and related infrastructure services;
• sequencing platforms, warmup tools, CRM tools, enrichment tools, or other connected platforms you authorize;
• advertising, event, partnership, affiliate, or referral sources;
• publicly available sources or third-party databases where needed for fraud prevention, risk review, sanctions screening, dispute handling, or compliance.

3.4 Workspace, Team, and Administrator Information

If you are added to a workspace by another user, we may process your name, email address, role, permissions, and activity within that workspace. Workspace owners and administrators may be able to access, manage, review, export, or remove certain information associated with your use of that workspace, subject to product design and their settings.

4. How We Use Personal Data

We use personal data for the following purposes:

4.1 To Provide and Operate the Services

We process personal data to create accounts, authenticate users, provision services, operate workspaces, process purchases, manage domains and mailboxes, support registrar connections, provide Zapbox functionality, support filters and reporting, generate alerts, and otherwise operate the Services.

4.2 To Process Payments and Manage Billing

We use personal data to process payments, maintain subscriptions, apply wallet balances, administer credits, prevent failed payments, manage auto top-up settings, issue invoices, detect payment-related fraud, and maintain financial records.

4.3 To Provide Support and Customer Service

We process personal data to respond to inquiries, troubleshoot issues, provide onboarding, resolve support requests, investigate complaints, and improve customer experience.

4.4 To Maintain Security and Protect the Services

We use personal data to secure the Services, verify users, monitor for abuse, prevent fraud, detect suspicious activity, enforce our Terms, protect against unauthorized access, and investigate security or compliance concerns.

4.5 To Improve, Analyze, and Develop the Services

We use personal data to understand usage trends, debug and optimize product performance, improve workflows, develop new features, evaluate adoption, test interfaces, and create aggregated or de-identified analytics.

4.6 To Communicate With You

We use personal data to send transactional and service-related communications, onboarding messages, billing notices, renewal reminders, support responses, security alerts, legal notices, updates to terms or policies, and other operational communications.

Where permitted by law, we may also use personal data to send marketing communications, newsletters, product updates, event invitations, and promotional messages.

4.7 To Administer New or Optional Features

We may process personal data to support features such as:

• domain buyback and wallet credit workflows,
• domain health checks and PDF reports,
• activity logs and audit-style event views,
• action-needed alerts,
• AI-assisted name or profile generation,
• unified workspace functionality,
• partner rewards or marketplace experiences,
• advanced search, tagging, bulk actions, keyboard navigation, and personalization features.

4.8 To Comply With Law and Protect Rights

We process personal data to comply with applicable law, respond to lawful requests, resolve disputes, establish or defend legal claims, exercise our rights, enforce agreements, and protect the rights, safety, and property of Zapmail, our users, and others.

4.9 In Connection With Corporate Transactions

We may process and disclose personal data in connection with an actual or proposed merger, acquisition, financing, asset sale, restructuring, bankruptcy, dissolution, or other corporate transaction.

5. Legal Bases for Processing

If you are located in the EEA, UK, or Switzerland, we process personal data under one or more of the following legal bases:

• Performance of a contract: where processing is necessary to provide the Services, manage your account, process billing, and fulfill our obligations.
• Legitimate interests: where processing is necessary for our legitimate business interests, such as securing the Services, preventing fraud, improving our products, communicating with customers, administering operations, and enforcing our terms, provided those interests are not overridden by your rights.
• Consent: where required by law, including for certain marketing or non-essential cookie use.
• Legal obligation: where processing is necessary to comply with applicable laws, regulations, lawful requests, court orders, or enforcement obligations.

6. How We Disclose Personal Data

We may disclose personal data as follows.

6.1 Service Providers and Vendors

We disclose personal data to vendors and service providers that help us operate the Services, including providers of hosting, cloud infrastructure, payment processing, customer support, communications, analytics, security, fraud prevention, email delivery, logging, monitoring, and similar services.

6.2 Connected Providers and Integrations

If you connect third-party tools, registrars, providers, or integrations, we may disclose relevant data to those third parties or receive data from them in order to provide the requested functionality. Your use of those connected services remains subject to their own terms and privacy policies.

6.3 Workspace Owners, Administrators, and Team Members

If you use the Services through a workspace, certain personal data and activity data may be visible to workspace owners, administrators, billing contacts, or authorized team members, depending on the permissions and functionality provided by the Services.

6.4 Affiliates and Corporate Group

We may disclose personal data to our affiliates and related entities for purposes consistent with this Privacy Policy.

6.5 Professional Advisers

We may disclose personal data to lawyers, auditors, insurers, accountants, consultants, and other professional advisers where necessary to obtain advice or protect our business interests.

6.6 Legal and Compliance Disclosures

We may disclose personal data if we believe disclosure is necessary to:

• comply with law, regulation, legal process, or a lawful government request;
• enforce our agreements, policies, and terms;
• detect, investigate, or prevent fraud, abuse, security incidents, or illegal activity;
• protect the rights, property, or safety of Zapmail, our users, providers, or others.

6.7 Business Transfers

We may disclose personal data in connection with a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar transaction.

6.8 Aggregated or De-Identified Information

We may use and disclose aggregated, statistical, or de-identified information that does not reasonably identify an individual, subject to applicable law.

7. Cookies and Similar Technologies

We and our vendors may use cookies, pixels, SDKs, scripts, local storage, and similar technologies to:

• keep you signed in and maintain sessions,
• remember preferences and settings,
• secure the Services,
• understand traffic and usage patterns,
• improve functionality and performance,
• personalize content and user experience,
• measure campaigns and marketing effectiveness,
• support analytics and attribution.

These technologies may be categorized as:

• Strictly necessary cookies, required for core functionality and security;
• Functional cookies, used to remember preferences and improve experience;
• Analytics cookies, used to measure and understand usage;
• Advertising or marketing cookies, where applicable, used to measure campaigns or support marketing activity.

Where required by law, we will obtain consent before using non-essential cookies. You can manage cookie preferences through your browser settings and, where available, our cookie tools. Blocking some cookies may affect functionality.

8. Communications and Marketing Choices

You may opt out of promotional emails by using the unsubscribe link in the email or by contacting us. Even if you opt out of marketing messages, we may still send you transactional or service-related communications, including billing notices, security alerts, account notices, support messages, policy updates, and similar communications.

9. Data Retention

We retain personal data for as long as reasonably necessary for the purposes described in this Privacy Policy, including to:

• provide and operate the Services;
• maintain your account and workspaces;
• process transactions and maintain billing records;
• preserve logs, support history, and product records;
• comply with legal, tax, accounting, regulatory, or contractual obligations;
• resolve disputes, enforce our agreements, and protect our rights.

Retention periods vary depending on the nature of the data, the context in which it was collected, and legal or operational requirements. We may retain different categories of data for different periods, including shorter retention periods for certain logs or temporary feature data, and longer retention periods for financial records, security records, and legal compliance purposes.

We may also retain anonymized or de-identified data for analytics, security, product, and business purposes where permitted by law.

10. International Data Transfers

Zapmail operates globally and may process personal data in the United States, India, and other jurisdictions where we or our service providers operate.

If personal data is transferred internationally, we take steps designed to provide an appropriate level of protection as required by applicable law, including through contractual safeguards, internal measures, and other recognized transfer mechanisms where applicable.

By using the Services, you understand that your personal data may be transferred to and processed in countries that may have different data protection laws than those in your jurisdiction.

11. Security

We use commercially reasonable administrative, technical, and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure.

These measures may include:

• encryption in transit and, where appropriate, at rest,
• access controls and authentication measures,
• monitoring, logging, and security review processes,
• role-based access where appropriate,
• vendor and infrastructure controls,
• incident response procedures.

No method of transmission, storage, or security control is completely secure. Accordingly, we cannot guarantee absolute security.

12. Customer Responsibilities and Administrator Visibility

If you use Zapmail on behalf of an organization, or through a workspace administered by another party:

• your organization and its administrators may be able to access, disclose, export, manage, or delete certain data associated with your use of the Services;
• Zapmail may provide tools that allow workspace owners or administrators to monitor activity, access logs, manage users, connect providers, review reports, or control settings;
• your employer, client, agency, or workspace owner is responsible for its own privacy practices and internal access controls.

Customers are responsible for ensuring they have an appropriate lawful basis to submit personal data to the Services and to authorize Zapmail to process it on their behalf.

13. Zapbox, Workspace Content, and User Communications

If you use Zapbox or related messaging and inbox features, we may process:

• message metadata,
• thread information,
• contact details,
• compose content,
• signatures,
• imported tags,
• recipient interaction context,
• related workspace activity.

You are responsible for the content you choose to upload, send, store, or manage through the Services and for ensuring that you have the necessary rights and legal basis to do so.

Zapmail is not a consumer messaging service and is not intended to serve as a regulated archiving or legal-hold solution unless expressly agreed otherwise in writing.

14. AI and Automated Features

The Services may include AI-assisted or automated features such as name generation, identity or profile generation, image or profile workflows, categorization, summaries, recommendations, and similar functionality.

If you use these features, we may process the inputs you provide and the resulting outputs for the purpose of delivering the feature, improving service performance, enforcing safety or abuse prevention measures, debugging, and related product purposes, subject to applicable law and contractual commitments.

You are responsible for reviewing AI-assisted outputs before using them and for ensuring that any content, names, profile information, or images used in connection with such features are lawful and appropriate.

15. Children’s Privacy

The Services are intended for business users and are not directed to children. We do not knowingly collect personal data from individuals under 18. If we become aware that we have collected personal data from a child without appropriate authorization, we will take reasonable steps to delete it.

16. Your Privacy Rights

Depending on where you live and subject to applicable law, you may have the right to:

• request access to personal data we hold about you;
• request correction of inaccurate or incomplete personal data;
• request deletion of certain personal data;
• request restriction of processing in certain circumstances;
• object to certain processing, including processing based on legitimate interests;
• withdraw consent where processing is based on consent;
• request portability of certain personal data in a structured, commonly used, machine-readable format;
• opt out of certain marketing communications;
• opt out of certain uses of cookies or similar technologies where applicable;
• lodge a complaint with a supervisory authority or regulator.

If you want to exercise a privacy right, contact us using the details below. We may need to verify your identity before processing your request. We may also deny or limit a request where permitted by law.

16.1 EEA, UK, and Switzerland

If you are in the EEA, UK, or Switzerland, you may have the rights described above under applicable data protection laws, including the right to object to processing, request portability, and lodge a complaint with your local supervisory authority.

16.2 U.S. State Privacy Rights

If you are a resident of a U.S. state that provides privacy rights, you may have rights to know, access, correct, delete, and obtain a copy of certain personal data, as well as rights to opt out of certain forms of targeted advertising, profiling, or certain data-sharing activities where applicable.

We will not unlawfully discriminate against you for exercising privacy rights. Where applicable, you may also have the right to appeal a decision regarding a privacy request.

17. Do Not Track and Similar Signals

Some browsers transmit “Do Not Track” or similar signals. Because there is not always a consistent industry standard for interpreting such signals, our Services may not respond to them in all circumstances. Where required by law, we will honor legally recognized opt-out preference signals.

18. Third-Party Links and Services

The Services may contain links to third-party websites, tools, or services, or may allow you to connect third-party providers. We do not control those third parties and are not responsible for their privacy practices, content, security, or availability.

We encourage you to review the privacy policies of any third-party services you use.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last Updated” date above and, where required by law, provide additional notice.

Your continued use of the Services after an updated Privacy Policy becomes effective means that the updated Privacy Policy applies to your use of the Services.

20. Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy or our privacy practices, you can contact us at:

[email protected]

[email protected]

Outbox Labs Inc.

Delaware, USA