Privacy Policy (Datenschutzerklärung)

1. Introduction

psquared GmbH ("we", "us", "our"), located at Dametzstraße 2-4, 4020 Linz, Austria, operates the InboxMate service (the "Service"). InboxMate is a product built on the psquared AgentHub platform, developed and operated by psquared GmbH.

InboxMate is an AI service for business email. It connects to the mailboxes you choose (personal or shared), classifies and routes incoming emails by your rules, writes reply drafts, and sends replies that you approve or that a rule allows. InboxMate also offers an optional Website-Chat module (an embeddable chat widget for your website). The sections that refer to the chatbot, the widget, website visitors or Shopify apply only if you use that module.

This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use our Service, in accordance with the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), the Austrian Data Protection Act (Datenschutzgesetz, DSG), and the EU Artificial Intelligence Act (Regulation (EU) 2024/1689).

2. Data Controller

The data controller responsible for your personal data is:

psquared GmbH
Dametzstraße 2-4, 4020 Linz, Austria
FN 647249m, Landesgericht Linz
Email: office@psquared.dev

3. Data We Collect

We collect the following categories of personal data:

• Account data: Name, email address, and password (hashed) when you register for an account.
• Billing data: Billing name, address, VAT ID and invoice history. We invoice by bank transfer; we do not process credit card data.
• Mailbox connection data: The address of each connected mailbox and its access credentials (OAuth tokens for Microsoft and Google, or IMAP/SMTP login data). Credentials are stored encrypted.
• Email data: The emails of processed threads from your connected mailboxes: sender, recipients (To, CC), subject, body, attachments, and message metadata (timestamps, message identifiers, headers). See Section 5a.
• Drafts and replies: AI reply drafts, your edits, and replies sent through InboxMate.
• Rule decisions and logs: The category that a rule assigned, the actions taken (for example forwarding, ticket creation, webhook calls), and approvals by your team.
• Contact and company data: Contacts and companies created from emails, including research notes from the public website of the sender's company.
• Usage data: Information about how you use the Service, including rule and agent configurations, chatbot configurations, page views, feature usage, and login timestamps.
• Website content: Content scraped from your website to build your AI knowledge base (used for reply drafts and, with the Website-Chat module, for your chatbot), as directed and initiated by you.
• Uploaded documents: PDFs and other files you upload to expand your knowledge base.
• Chat data (Website-Chat module): Conversations between your website visitors and your InboxMate chatbot, including message content, timestamps, and visitor metadata (browser language, referrer URL).
• Technical data: IP addresses, browser type and version, operating system, device type, and referrer URLs. Collected via server logs and for security purposes.

4. How We Use Your Data

We process your personal data for the following purposes:

• Providing the Service: Processing the emails of your connected mailboxes (classification, routing, reply drafts, sending, research about the sender, tickets and contacts), managing your knowledge base, running the InboxMate dashboard, and, with the Website-Chat module, operating your AI chatbot and delivering responses to your visitors.
• AI training: Training your custom AI agents (email agents and, if used, your chatbot) exclusively on your business content. Your data is used only for your agents — never to train models for other customers.
• Billing: Issuing invoices, handling payments by bank transfer and refunds.
• Service communications: Sending transactional emails (account confirmation, password reset, usage alerts, subscription changes).
• Service improvement: Analyzing aggregated, anonymized usage patterns to improve performance, reliability, and features.
• Security: Detecting and preventing fraud, abuse, and unauthorized access.
• Legal compliance: Fulfilling legal obligations under Austrian and EU law, including tax and accounting requirements.

5. Legal Basis for Processing (Art. 6 GDPR)

We process your data based on the following legal grounds:

• Contract performance (Art. 6(1)(b)): Processing necessary to provide the Service you registered for, including account management, email processing, chatbot operation (Website-Chat module), and support.
• Legitimate interest (Art. 6(1)(f)): Service improvement through anonymized analytics, fraud prevention, and security monitoring. Our legitimate interest does not override your fundamental rights.
• Consent (Art. 6(1)(a)): Where you have given explicit consent, such as for optional analytics cookies or marketing communications. You may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)): Compliance with Austrian tax law (BAO), commercial law (UGB), and other applicable regulations requiring data retention.

5a. Email Data from Connected Mailboxes

When you connect a mailbox, InboxMate processes the emails of that mailbox on your behalf. This includes personal data of the people who write to the mailbox, of the people to whom you write from it, and of people named in the emails or their attachments.

• What we store: Only the email threads that InboxMate needs to act. When you connect a mailbox, we read a limited number of recent messages from its inbox folder. After that, we read new incoming messages. We do not copy your full mailbox.
• Email content: Sender, recipients, subject, body, attachments, and message metadata of processed threads. Subject and body are stored encrypted in our database. Attachments are kept in our file storage (Supabase, EU).
• Drafts and replies: AI reply drafts, your edits, and sent replies. If you turn on draft sync, drafts are also placed in the drafts folder of your connected mailbox.
• Rule decisions and logs: The category, the rule applied, the actions taken, and approvals, so that you can see and check each decision.
• Actions in other systems: If your rules forward emails, call webhooks, API or MCP endpoints, or create tickets and contacts, we transfer the data that the rule names to that destination.
• Sender research: If a rule includes research about the sender, we fetch public information from the website of the sender's company and store a short briefing with the company record.

The connection types are described in Section 9 (Microsoft 365 / Outlook), Section 9a (Gmail) and Section 9b (IMAP/SMTP and forwarding).

5b. Website-Chat (optional module): Widget Data Collection

The embedded InboxMate chat widget collects the following data from your website visitors:

• Session ID: A unique session identifier stored in the visitor's browser via localStorage to maintain conversation continuity.
• Chat messages: The content of messages exchanged between the visitor and the chatbot.
• Browser language: The visitor's browser language setting.
• Referrer URL: The page from which the visitor accessed the chat widget.
• Email address (optional): Only if the visitor voluntarily provides it during the conversation.

The widget does not set cookies and does not perform any tracking. IP addresses are processed in server logs for security purposes but are not stored beyond 90 days.

6. Your Role as Data Controller

When InboxMate processes the emails of your connected mailboxes, you are the data controller for that email data, and psquared GmbH acts as your data processor under Art. 28 GDPR. You are responsible for informing the people you correspond with about the AI processing of emails (e.g., through your own privacy policy), and for making sure that you are authorized to connect each mailbox, including shared mailboxes.

Website-Chat (optional module): When your website visitors interact with your InboxMate chatbot, you are the data controller for that visitor data, and psquared GmbH acts as your data processor under Art. 28 GDPR. You are responsible for informing your visitors about the chatbot's data collection (e.g., through your own privacy policy) and obtaining any necessary consents.

A Data Processing Agreement (DPA) in accordance with Art. 28 GDPR is automatically included as part of these terms and applies to all customers. The DPA is available for download at inboxmate.at/dpa.

When you use the human handover feature of the Website-Chat module, your team members may access and respond to visitor conversations. This constitutes an additional processing activity that you should disclose in your own privacy policy.

7. Data Storage and Hosting

All data is processed and stored within the European Union. We use Supabase (EU region, hosted on AWS eu-central-1, Frankfurt, Germany) as our primary database and storage provider.

All primary data storage takes place within the European Union: our database and file storage (Supabase), transactional email (AWS SES), and application servers (Heroku) are located in the EU. AI inference depends on the account setting "EU models only": when enabled, inference runs on Microsoft Azure OpenAI in the EU (Sweden Central) and no prompt data leaves the EU. The setting is enabled by default for new accounts. When an account disables it, inference runs on OpenAI in the United States. For sub-processors incorporated outside the EU or where US processing applies (such as OpenAI Inc. and AlphaAI Technologies Inc./Tavily), transfers are governed by Standard Contractual Clauses (SCCs) under Art. 46(2)(c) GDPR and, where applicable, the EU-US Data Privacy Framework adequacy decision.

8. Sub-Processors

We use the following sub-processors to operate the Service. All sub-processors are bound by data processing agreements:

EU data processing guarantee: All primary data storage and processing takes place within the European Union. With the Advanced Compliance option (available on Pro and Business plans), you can ensure that all data processing — including AI inference — is restricted to EU-based infrastructure only.

We will notify you before adding or replacing sub-processors. You may object to changes within 30 days.

Data Protection Officer

We have not appointed a Data Protection Officer as we are not required to do so under Art. 37 GDPR. For all data protection inquiries, contact office@psquared.dev.

9. Microsoft Graph / Outlook Integration

InboxMate offers an optional integration with Microsoft Outlook / Microsoft 365 via the Microsoft Graph API. This integration is only active when you explicitly connect a Microsoft account through the agent's E-Mail Integration tab; you can use InboxMate without it.

Data flow direction. The integration is strictly one-way: InboxMate reads and acts on data inside your Microsoft mailbox (for example, fetching incoming emails, moving a message to the Archive folder, applying a category label). No InboxMate-internal data (chats, contacts, knowledge bases, tickets) is transmitted to Microsoft beyond the metadata strictly required to perform a requested action on a specific message, and the reply drafts and replies that you choose to place in or send from your mailbox.

OAuth and access tokens. When you click Mit Outlook verbinden, Microsoft issues an OAuth access token and a refresh token scoped to the permissions listed below. Both tokens are encrypted at rest using AES-256 with a server-side key and decrypted only in memory when making a Graph API call on your behalf.

Requested permissions (delegated scopes). We request only the scopes needed for the feature set you activate:

• offline_access — required to refresh access tokens without a new sign-in.
• User.Read — read your basic profile (display name and email address) to label the connection in our UI.
• Mail.ReadWrite — read incoming messages from the inbox folder, mark messages as read, move them to the Archive folder when a categorizer or operator archives the linked conversation, and attach Outlook categories.
• Mail.Send — send replies you compose in InboxMate (or that the AI drafts and you approve, or that a rule you set sends automatically) from your own Outlook address.
• Mail.ReadWrite.Shared and Mail.Send.Shared — the same read, write and send actions for shared mailboxes (for example office@ or support@) of which you are a member. Only used when you connect a shared mailbox.
• MailboxSettings.ReadWrite — create and read the Outlook master-category list so that mirrored InboxMate categories render as coloured chips. Only used when the Mirror InboxMate categories to Outlook toggle is enabled on the connection.

What we read. Incoming email headers and body content from the mailbox's Inbox folder, the message’s Outlook categories (only while the mirror toggle is on), and your master-category list at connect time so we can pick a sensible default for the mirror toggle. When draft sync is on, we also check whether a draft that InboxMate placed in your Drafts folder was sent, so that we can record the sent version. We do not read your calendar, contacts list, OneDrive files, or Teams data.

What we write. Outbound replies that you trigger or that a rule you set sends automatically, AI reply drafts in your Drafts folder (only when draft sync is on), the “read” flag on messages we have surfaced, folder moves (Archive, Deleted Items, or a folder that your rule names) that mirror a corresponding action in InboxMate, deletion of a message when a rule you set says so, and category assignments (only when the mirror toggle is on). We never modify message bodies, never compose mail without explicit operator or AI-auto-reply action, and never delete master categories you created yourself.

No secondary use. Data received from Microsoft Graph is used exclusively to provide the InboxMate Outlook integration. We do not use it for advertising, market research, profiling outside of your own InboxMate workspace, or to train AI models. Microsoft data is logically isolated per account and never shared between InboxMate customers.

No sharing. Microsoft data is not shared with third parties, except as necessary to provide the Service (e.g., displaying emails in your InboxMate inbox, sending them to the LLM you configured for triage / drafting) or as required by law. The list of LLM sub-processors is in Section 8 of this policy.

Revocation. You can revoke InboxMate’s access at any time:

• In InboxMate, click Trennen next to the Outlook connection — we immediately delete the encrypted access and refresh tokens, and the connection stops syncing on the next poll cycle.
• Or from the Microsoft side at My Microsoft Account — Apps and services. Revoking access there invalidates our tokens regardless of the connection state in InboxMate.

Retention. Email bodies pulled via Graph are stored in the InboxMate database under the same retention schedule as forwarded emails (see Section 14 of this policy). On disconnect, the tokens are deleted immediately; previously synced emails remain in InboxMate until the account-level retention rules apply.

9a. Google API Data Usage (Gmail, beta)

InboxMate may request access to certain Google APIs (e.g., Gmail API) to enable email channel integration. The Gmail connection is in beta. When you connect your Google account:

• Requested scopes: gmail.modify (read messages and change their state, for example mark as read or archive), gmail.send (send replies), gmail.compose (create reply drafts), and userinfo.email with openid (identify the connected address).
• Limited use: InboxMate's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Scope of access: We only request the minimum permissions necessary to provide the email integration feature (reading and sending emails on your behalf within InboxMate).
• No secondary use: Google user data is used exclusively to provide the InboxMate email channel feature. We do not use Google data for advertising, market research, or to train AI models.
• No sharing: Google user data is not shared with third parties, except as necessary to provide the Service (e.g., displaying emails in your InboxMate inbox) or as required by law.
• Revocation: You can revoke InboxMate's access to your Google account at any time through your Google Account permissions or through your InboxMate dashboard settings.

9b. IMAP/SMTP and Email Forwarding

IMAP/SMTP. If you connect a mailbox through IMAP/SMTP, you give us the server address and the login data of that mailbox. The password is stored encrypted and is used only to read incoming messages and to send replies and carry out rule actions in that mailbox.

Forwarding. If you forward emails to an InboxMate forwarding address, the forwarded emails are received through Amazon Web Services (SES, EU). Replies for this connection type are sent through Amazon SES from the forwarding address, with a reply-to address that points to your own address.

For both types, Section 5a describes which email data we store.

9c. Shopify Integration and Shopify App Store (Website-Chat module)

If you install InboxMate from the Shopify App Store or connect your Shopify store from within the InboxMate dashboard, the following additional processing applies:

OAuth and access tokens. When you install InboxMate, Shopify issues an OAuth access token scoped to the following read-only Admin API permissions: read_products, read_content, read_online_store_pages, read_themes, read_locales, and read_shipping. We do not request write access. Access tokens are encrypted at rest using AES-256 with a server-side key, and decrypted only in memory when required for API calls.

Data we read from your shop. Using these read-only scopes, we pull the following content into a per-shop knowledge bucket used exclusively by your InboxMate agent:

• Shop policies (return, shipping, refund, privacy, Terms of Service policies published in your storefront)
• Online store pages (About, FAQ, and other merchant-authored pages)
• Products and collections metadata (titles, descriptions, handles)
• Store locales and shipping zone settings, used to keep chatbot answers accurate

We do not read customer, order, checkout, or financial data from Shopify. The knowledge bucket is isolated per shop and never shared with other merchants.

Webhooks we receive. Your Shopify store sends the following webhooks to InboxMate:

• app/uninstalled — triggered when a merchant removes InboxMate. We soft-delete the integration and revoke the stored access token.
• app_subscriptions/update — billing-status changes (approved, cancelled, frozen, expired) that we mirror onto your InboxMate account.
• customers/data_request — Shopify's mandatory GDPR data-access webhook (see below).
• customers/redact — Shopify's mandatory GDPR customer-erasure webhook (see below).
• shop/redact — Shopify's mandatory GDPR shop-erasure webhook, sent 48 hours after uninstall (see below).

Shopify billing. For subscriptions started from the Shopify App Store, Shopify Inc. acts as the payment processor and controller for billing data. We receive a subscription identifier and status via the app_subscriptions/update webhook but do not receive or store card numbers or other payment instrument details. Shopify's own privacy policy governs your payment data. See our Terms of Service, Section 6a for details on Shopify billing and the 7-day free trial.

Mandatory GDPR webhook handling. As required by Shopify, we implement all three GDPR webhooks:

• customers/data_request: When a shop customer requests a copy of their data via the merchant's Shopify admin, Shopify forwards the request to us. Because InboxMate does not ingest Shopify customer records, we typically hold no personal data about the individual customer. We forward the request and our response to the merchant so they can fulfill their controller obligations under Art. 15 GDPR. If a customer's email address happens to appear in a chatbot conversation stored on InboxMate, that record is included in the response.
• customers/redact: Triggered 10 days after a shop customer requests deletion. We search the merchant's InboxMate data for any records matching the customer identifier (e.g., email address in chat transcripts) and permanently delete them.
• shop/redact: Triggered 48 hours after a merchant uninstalls InboxMate, if the shop does not reinstall. We permanently purge the shop integration, the encrypted access token, the per-shop knowledge bucket (policies, pages, product content), and all knowledge items associated with the shop. This is irreversible.

Retention on uninstall. On receipt of app/uninstalled, we immediately revoke and delete the encrypted access token and soft-delete the Shopify integration. Your remaining InboxMate account data (agent configuration, non-Shopify knowledge, conversation logs) follows the retention schedule in Section 14. If Shopify subsequently sends shop/redact, all shop-linked knowledge is fully purged as described above.

Shopify as a sub-processor. Shopify Inc. (and its affiliates) acts as our sub-processor for the distribution and billing path and as an independent controller for your use of the Shopify platform itself. Shopify's data processing is governed by its own Data Processing Addendum, available at shopify.com/legal/dpa.

10. AI-Specific Data Processing and EU AI Act Compliance

InboxMate uses large language models (LLMs) to classify emails, write reply drafts and replies, summarize sender research and, with the Website-Chat module, generate chatbot responses. Important details about how AI processes your data:

• No cross-customer training: Your business data, knowledge base, and conversation data are never used to train AI models for other customers or for general model improvement.
• Prompt isolation: Each AI request (for an email or a chat message) is processed in isolation. Your data is sent to the LLM provider only at the moment of generating a response and is not retained by the provider beyond the request.
• EU processing: We use EU API endpoints where available to ensure data stays within the EU during AI processing.
• No automated decision-making: InboxMate does not make automated decisions with legal or similarly significant effects on individuals as defined by Art. 22 GDPR. AI-generated responses are informational only.

We conduct Data Protection Impact Assessments (DPIAs) under Art. 35 GDPR where appropriate, particularly for new AI processing activities.

EU AI Act compliance: InboxMate is classified as a limited-risk AI system under the EU AI Act (Regulation (EU) 2024/1689). We comply with the transparency obligations of Art. 50 by clearly disclosing that chatbot responses are AI-generated. In the Website-Chat module, the chat widget includes a visible "Powered by AI" indicator, and we do not use AI to manipulate, deceive, or exploit users. InboxMate does not perform biometric identification, social scoring, or any practices prohibited under Art. 5 of the AI Act.

11. Data Sharing

We do not sell, rent, or trade your personal data. We share data only in the following circumstances:

• Sub-processors: As listed in Section 8, strictly for operating the Service.
• Destinations you set: When your rules forward emails to a person, or call webhooks, API or MCP endpoints of other systems, we transfer the data that the rule names to that destination on your instruction.
• Legal requirements: When required by law, court order, or regulatory authority (e.g., Austrian tax authorities).
• Protection of rights: To enforce our Terms of Service or protect the safety of our users, if legally permitted.

Your business data, emails, knowledge base and chatbot training data, and conversation logs are never shared with third parties for their own purposes.

12. Cookies and Tracking

We use the following types of cookies:

• Strictly necessary cookies: Required for the Service to function (authentication session, CSRF protection, language preference). These do not require consent under Art. 5(3) of the ePrivacy Directive.
• Analytics cookies: Optional. Help us understand how visitors use our website. Only set with your explicit consent. We currently do not use third-party analytics on the InboxMate landing page.

Website-Chat (optional module): The InboxMate chat widget placed on your website uses a session identifier stored in the visitor's browser (localStorage) to maintain conversation continuity. No tracking cookies are set by the widget.

Product analytics inside the InboxMate operator app: we use PostHog (EU instance) to capture pseudonymous product events such as signup, onboarding step completion, and agent publication. The only identifier we send to PostHog is your opaque user ID (a UUID) so that server- and client-emitted events can be joined into a single timeline — we do not send your email address, your name, your message content, or any other personal data. IP addresses are anonymised, session replay and autocapture are disabled, and we honour your browser's Do Not Track signal. These events are processed under our legitimate interest (Art. 6(1)(f) GDPR) to improve the product.

13. Your Rights Under GDPR

You have the following rights regarding your personal data:

• Right of access (Art. 15): Request a copy of all personal data we hold about you.
• Right to rectification (Art. 16): Request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17): Request deletion of your personal data ("right to be forgotten").
• Right to restrict processing (Art. 18): Request that we limit how we use your data.
• Right to data portability (Art. 20): Receive your data in a structured, commonly used, machine-readable format (JSON or CSV).
• Right to object (Art. 21): Object to processing based on legitimate interest at any time.
• Right to withdraw consent (Art. 7(3)): Withdraw any previously given consent. Withdrawal does not affect the lawfulness of prior processing.

To exercise any of these rights, contact us at office@psquared.dev. We will respond within 30 days as required by Art. 12(3) GDPR. We may request identity verification before processing your request.

14. Data Retention

We retain your data according to the following schedule:

• Account data: Retained for the duration of your account. Deleted within 30 days of account deletion.
• Conversation data (email threads, attachments, drafts and, with the Website-Chat module, chat conversations): Retained for the duration of your account, unless you ask us to delete it earlier.
• Knowledge base: Deleted within 30 days of account deletion or when you manually remove content.
• Payment records: Retained for 7 years as required by Austrian tax law (§ 132 BAO).
• Server logs: Automatically deleted after 90 days.

15. Data Security

We implement appropriate technical and organizational measures (Art. 32 GDPR) to protect your personal data:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Row-level security in our database ensuring strict data isolation between accounts
• Role-based access control for all team members
• Secure password hashing (bcrypt)
• Regular security reviews and dependency updates
• Two-factor authentication support

16. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Austrian Data Protection Authority within 72 hours (Art. 33 GDPR) and affected individuals without undue delay (Art. 34 GDPR).

17. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Austrian Data Protection Authority:

Österreichische Datenschutzbehörde
Barichgasse 40-42, 1030 Wien, Austria
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Website: www.dsb.gv.at

18. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email at least 14 days before they take effect. The current version is always available at this URL. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

19. Contact

For any questions about this Privacy Policy, data processing, or to exercise your rights, contact us at:

psquared GmbH
Dametzstraße 2-4, 4020 Linz, Austria
Email: office@psquared.dev