Privacy Policy

1. Introduction

Pebble Labs LLC ("Company", "we", "us") operates Unbox, a professional email hosting service. This Privacy Policy explains how we collect, use, and protect your information when you use our Service.

2. Information We Collect

Account Information

When you create an account, we collect:

• Name and email address (via Google, Microsoft, or Apple sign-in)
• Organization name and custom domain
• Billing information (processed by Stripe)

Email Data

To provide the Service, we process and store:

• Email messages (sender, recipient, subject, body, attachments)
• Email metadata (timestamps, delivery status)
• Email addresses created within your organization

Usage Data

We automatically collect:

• Email sending and receiving statistics
• Storage usage
• Feature usage patterns

3. How We Use Your Information

We use your information to:

• Provide, operate, and maintain the email service
• Process and deliver emails on your behalf
• Verify domain ownership and configure DNS records
• Process payments and manage subscriptions
• Send service-related communications
• Detect and prevent abuse, spam, and security threats
• Improve and develop new features

4. Email Content Privacy

We do not read, analyze, or sell the content of your emails. Email content is processed automatically to deliver messages and is not accessed by our employees except when:

• You explicitly request technical support
• Required by law or valid legal process
• Necessary to investigate abuse or security incidents

5. Data Storage and Security

Your data is stored on secure infrastructure provided by Amazon Web Services (AWS). We implement industry-standard security measures including:

• Encryption in transit (TLS) and at rest
• DKIM, SPF, and DMARC email authentication
• Access controls and authentication
• Regular security assessments

6. Third-Party Services

We use the following third-party services to operate Unbox:

• Amazon Web Services (AWS) — Email delivery (SES), file storage (S3), computing infrastructure
• Stripe — Payment processing
• Turso — Database hosting
• Google, Microsoft, Apple — Authentication providers

Each third party processes data according to their own privacy policies.

7. Data Sharing

We do not sell your personal information. We may share data with:

• Service providers necessary to operate Unbox (as listed above)
• Law enforcement when required by valid legal process
• Other parties with your explicit consent

8. Data Retention

We retain your data for as long as your account is active. After account deletion:

• Email content is deleted within 30 days
• Account information may be retained for up to 90 days for legal and operational purposes
• Aggregated, anonymized data may be retained indefinitely

9. Your Rights

You have the right to:

• Access and export your data
• Correct inaccurate information
• Delete your account and associated data
• Object to certain processing activities

To exercise these rights, contact us at the email below.

10. Children's Privacy

Unbox is not intended for users under 18 years of age. We do not knowingly collect information from children.

11. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or through the Service. The "Last updated" date indicates when the policy was last revised.

12. Contact

For questions about this Privacy Policy or to exercise your data rights, contact us at adi@unbox.so.