Privacy Policy

Last updated: June 2026

1. Data controller

Ubox is operated from Lithuania, European Union. Privacy contact: privacy@ubox.lt.

2. What we collect

  • Email content and metadata — fetched from your connected mailboxes to provide triage and drafting. Not stored long-term; processed transiently.
  • Account credentials — IMAP/SMTP passwords encrypted at rest (Fernet/AES-256). Gmail accounts use OAuth tokens, never passwords.
  • Session data — a single httpOnly session cookie (30-day expiry) to keep you logged in.
  • Billing information — handled entirely by Stripe. We do not store card numbers.

3. Gmail API data — Limited Use disclosure

Ubox's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data accessed via the Gmail API is used solely to provide the Ubox service to you. It is not used to serve advertisements, is not sold to or shared with third parties, and is not used to develop, improve, or train artificial intelligence or machine learning models.

4. AI inference

Email content is sent to Anthropic for triage classification and reply drafting. Anthropic processes this data under their privacy policy and does not train models on API request data.

5. Data retention

  • Active account: account data and credentials stored while your account is active.
  • After deletion request: all data purged within 30 days. Immediate deletion available from Settings → Account.
  • After subscription cancellation: data retained 30 days then permanently deleted.

6. Your rights

Under GDPR you have the right to:

  • Access, export, or correct your data (via Settings)
  • Request permanent deletion (via Settings or email)
  • Object to or restrict processing
  • Lodge a complaint with the Lithuanian Data Protection Authority (VDAI) at ada.lt

7. Cookies

We use one cookie: session_id (httpOnly, Secure, SameSite=Lax, 30-day expiry). No analytics cookies. No tracking pixels. No third-party advertising cookies.

8. Third-party services

  • Stripe — payment processing. EU-based data handling. See Stripe's privacy policy.
  • Anthropic — AI inference for triage and drafting. API data is not used for model training.

9. Security

Mailbox credentials encrypted at rest with Fernet (AES-256). All traffic encrypted in transit via TLS. We never log message bodies, credentials, or authentication tokens.

10. Legal basis (GDPR)

We process your data on the legal basis of contract performance (Article 6(1)(b) GDPR) — processing is necessary to provide the Ubox service you signed up for.

11. Contact

Privacy questions or data requests: privacy@ubox.lt