Privacy Policy

Last updated: July 2026

1. Information We Collect

We collect only the information necessary to provide and improve our email hosting service:

Account Information: Name, email address, and profile picture, obtained through Google authentication (Firebase Auth). Phone number is collected during onboarding.
Email Data: Message content, attachments, metadata (sender, recipient, timestamps) stored in your mailboxes on our servers.
Usage Data: Aggregate analytics on page views and feature usage on our public marketing pages (not your dashboard or email content).
Payment Data: Payment information is processed and stored by Razorpay. We only retain transaction IDs, order references, and payment status — never full card numbers or bank details.

2. How We Use Your Information

Provide, maintain, and improve the email hosting service
Process payments and manage subscriptions
Send service-related communications (renewal reminders, policy updates)
Detect and prevent abuse, spam, or unauthorized access
Optimize public marketing site performance (anonymous analytics only)

3. Third-Party Services

We use trusted third-party providers to operate the Service:

Firebase (Google): Authentication and user identity management.
Razorpay: Payment processing and subscription billing.
Redis: Caching and queue management for email delivery.
AI Providers (OpenAI, Gemini, Groq): When you enable AI writing features with your own API key, data is sent directly to the provider you choose. We do not store AI provider keys or prompts beyond the current session.

Your email content is never shared with third parties for advertising, training, or analytics purposes.

4. Data Security

We implement industry-standard security measures including encryption in transit (TLS), hashed credentials, and regular security audits. However, no system is completely secure, and we cannot guarantee absolute protection against unauthorized access.

5. Data Retention

We retain your email data for the duration of your account activity. Upon account termination, your data is permanently deleted within 30 days unless required by law to retain it. Payment transaction records are retained as required by applicable financial regulations.

6. Your Rights

You have the right to:

Access and export your data at any time
Delete your account and associated data
Update your personal information through account settings
Opt out of non-essential communications

7. Cookies

We use essential cookies for authentication and service functionality. No tracking cookies are used on the webmail dashboard. Our public marketing pages may use standard analytics cookies for site performance optimization.

8. Contact

For privacy-related inquiries, contact us at support@gravbox.com.