Draft — pending legal review before launch. Structure is final; wording will be confirmed by counsel.
Privacy Policy
Last updated: June 2026
1. Who we are
Inbox is operated by The Agentic Group (“we”, “us”). We provide AI-drafted, founder-approved customer-support replies for Shopify merchants. Contact: privacy_inbox@theagenticgroup.dev.
2. Data we process
Account data (your email, authentication identifiers). Store data you connect (Shopify orders, customers, products — read-only). Customer-support content (inbound messages and the replies you approve). We process this to draft replies and operate the service. We act as a processor for the customer personal data contained in your support messages; you remain the controller.
3. How we use it
To generate draft replies, learn your brand voice, send approved replies on your behalf, provide analytics, and secure and improve the service. We do not sell personal data.
4. AI sub-processors
Drafts are generated using third-party LLM providers (e.g. Groq, Google Gemini) and routed through our gateway. Inbound content is sent to these providers solely to produce a draft. Our full, current sub-processor list details every provider, its purpose, and the data involved.
5. Storage & security
Data is stored in Supabase (Postgres) with row-level security per tenant. OAuth tokens are encrypted at rest and never logged. Access is least-privilege. Accounts can enable two-factor (TOTP) authentication, sign-in is protected by bot-challenge and rate limiting, webhooks are signature-verified, and the application ships with strict security headers (CSP, HSTS) and automated dependency-vulnerability scanning. See our security practices for detail.
6. Retention
We retain support content for as long as your account is active or as needed to provide the service, then delete or anonymize it. You can request deletion at any time.
7. Your rights
Subject to applicable law (including GDPR, India’s DPDP Act, and CCPA/CPRA), you may access, correct, export, delete, or object to the processing of your data, and you will not be discriminated against for exercising these rights. You can export and delete your data self-serve from account settings, or email privacy_inbox@theagenticgroup.dev.
8. International transfers
We may process data in countries other than yours (see hosting regions in our sub-processor list). Where required, we rely on an appropriate transfer mechanism such as the EU Standard Contractual Clauses and the UK Addendum.
9. For business customers (DPA)
When we process your customers’ personal data to provide the Service, we act as your processor under our Data Processing Agreement; you remain the controller.
10. Changes
We will post updates here and revise the “last updated” date. Material changes will be notified.