Draft for legal review
This is a complete readable draft, published for legal review. It is not in force and has no effective date.
Unresolved
These must be supplied by the operator and its advisers before this policy can be issued.
This draft describes how Bobby Inbox handles personal data. Bobby Inbox runs as a controlled, invitation-only inbound pilot: accounts and sign-in are live, and invited pilot workspaces receive inbound email that is stored in a canonical archive. Personal data is therefore processed today for account holders and for the senders and recipients of mail received by pilot workspaces.
When a person creates an account we process their private email address, a password stored only as a hash, an optional display name and avatar, language and timezone preferences, notification preferences, and security metadata such as sessions, devices and sign-in events.
The private email address identifies the person, not a company. It is used for authentication, verification, security notices and account correspondence.
Within a pilot workspace we process the email messages the workspace receives directly or by forwarding, including headers, bodies, attachments and authentication results; the routing decisions and forwarding attempts they produce; and membership and role records. As the full product launches, this will extend to assignment, internal comments, drafts and tags.
This content belongs to the workspace. The workspace decides who may read it, and it is isolated from other workspaces.
AI assistance is planned as an optional feature that is off unless the workspace enables it, and may be restricted to specific channels. When enabled, message content from those channels will be processed to produce summaries, priority and intent signals, suggested tags and assignment, action items and drafted replies.
Derived AI output will be stored with the conversation and deleted with it. AI execution is not launched during the pilot, so no AI provider processes pilot mail.
To provide the service the customer asked for; to keep accounts and workspaces secure; to maintain an auditable record of routing and delivery; to bill for seats, add-ons and credits; and to comply with legal obligations.
Operating the service will require infrastructure providers, an email-delivery provider, an object store for attachments (Cloudflare R2 is preferred), an AI provider where AI is enabled, and a payment processor (Stripe planned first, with Mollie and Adyen as possible future options).
The final sub-processor list is unresolved and is deliberately not stated here. Personal data will not be sold.
Retention is intended to be configurable per workspace. Deleting a message is intended to remove its attachments and derived AI output; deleting a workspace is intended to remove its content within the retention window then in force.
A personal account can be deleted independently of the workspaces it belonged to.
Intended measures include workspace isolation, least-privilege roles, private attachment storage reached only through short-lived authorised links, sanitised HTML rendering, blocked remote images by default, malware scanning of attachments, and audit records for administrative actions.
No certification or external audit is claimed.
Where data-protection law applies, people have rights of access, rectification, erasure, restriction, objection and portability, and may complain to a supervisory authority. The contact address for exercising these rights will be published with the final policy.
The Bobby Inbox website does not set advertising cookies and does not run third-party analytics. Any future analytics will be described here before it is enabled.
See also the draft Terms of Service and the pilot disclosures.