Privacy Policy

1. Introduction

This Privacy Policy describes how Clustox LLC, doing business as inboxwarm.ai ("inboxwarm.ai," "we," "our," or "us"), collects, uses, stores, and protects information about you when you visit our website at inboxwarm.ai (the "Site") or use our email inbox warmup platform and associated services (collectively, the "Services"). inboxwarm.ai is operated by Clustox LLC, a Delaware limited liability company, with its registered address at 8 The Green, STE A, Dover, DE 19901, United States.

Our Services help businesses and individuals improve email deliverability by gradually building sender reputation through a controlled, automated warmup process. This involves connecting to your email account and sending and receiving warmup emails on your behalf, strictly within the scope you authorize. We do not read, analyze, or process the content of non-warmup emails in your inbox.

Please read this Privacy Policy carefully before using the Services. By accessing or using the Services, you acknowledge that you have read, understood, and agreed to this Privacy Policy. If you do not agree, please discontinue use of the Services. Your use of the Services is also governed by our Terms of Use, which are incorporated herein by reference.

2. Information We Collect

We collect information in three main categories:

2a. Personal Data

When you register for an account, subscribe to a plan, or contact us, we collect personal data you provide directly, including:

• Full name
• Email address
• Company name and role (if provided)
• Phone number (if provided)
• Billing information and billing address, payment card processing is handled exclusively by Stripe, Inc., and we do not store full card numbers on our systems
• Connected email account details, including credentials required to access your inbox for warmup purposes, credentials are stored in encrypted form and used solely for providing the Service
• Account credentials, including hashed passwords
• Any other information you voluntarily submit through support requests, surveys, or direct communications

2b. Usage Data

When you use the Services, we automatically collect technical and behavioral data to operate, maintain, and improve the platform, including:

• IP addresses and approximate geographic location derived from IP
• Browser type, version, and language preferences
• Pages visited, features accessed, and actions taken within the platform
• Date, time, and duration of sessions
• Referring URLs and navigation paths
• Error logs and diagnostic data
• Email warmup campaign performance metrics (e.g., delivery rates, open rates, reply rates, bounce rates, and spam complaint rates) associated with your account

2c. Email Account Data

To deliver the Service, we access your connected email account(s) (such as Gmail, Outlook, or custom SMTP providers) solely for the purpose of sending and receiving warmup emails as configured by your warmup schedule. This access is strictly limited to warmup activities. We do not read, store, analyze, or process the content of non-warmup emails in your inbox.

Warmup emails sent through the Service may be generated dynamically using automated tools, including AI-based content generation services, to simulate realistic communication patterns. These tools operate on anonymized or synthetic data. Your email content and personal data are never used to train AI models.

As part of the warmup process, the Service uses a pool of system-operated email accounts to send simulated replies to your inbox, creating natural conversation threads. These pool accounts are operated under strict privacy and security controls.

2d. Cookies & Tracking Technologies

We use cookies, web beacons, pixels, and similar tracking technologies on the Site. The categories we use are:

Strictly Necessary Cookies

Essential for the Site and Services to function and cannot be disabled. They enable user authentication, session management, and security. Third-party providers in this category may include our cloud infrastructure and payment providers.

Analytics & Performance Cookies

These cookies help us understand how users interact with the Site, such as which pages are visited most frequently. We may use third-party analytics providers such as Google Analytics. You may opt out of analytics cookies through our cookie preference center or your browser settings.

Marketing & Advertising Cookies

These optional cookies enable us and our advertising partners to deliver relevant advertisements. They may be used to measure the effectiveness of campaigns. You may disable these through our cookie consent mechanism.

You can manage cookie preferences at any time through our cookie consent tool or via your browser settings. For comprehensive guidance on managing cookies, visit www.allaboutcookies.org. Note that disabling certain cookies may affect Site functionality.

3. How We Use Your Information

We process your information for the following purposes:

• Providing and operating the Services, including account management, inbox warmup automation, and email deliverability monitoring
• Accessing your connected email account solely to send and receive warmup emails as authorized by you
• Generating warmup email content using automated tools to simulate realistic communication patterns, using only anonymized or synthetic data
• Operating the warmup pool account system to create simulated reply threads that improve sender reputation
• Processing payments and managing billing through Stripe, including invoices, subscription management, and transaction communications
• Responding to support requests, inquiries, and technical issues
• Sending transactional communications, such as account confirmations, password resets, security alerts, and service notifications
• Sending marketing communications about our Services, feature updates, and promotions where you have opted in or where we have a legitimate interest — you may opt out at any time via the unsubscribe link in our emails or by contacting support@inboxwarm.ai
• Analyzing usage patterns and platform performance to improve, optimize, and develop new features
• Detecting and preventing fraud, abuse, security incidents, and violations of our Terms of Use, including monitoring for bounce rates and spam complaints
• Complying with applicable legal obligations, including responding to lawful requests from regulatory or law enforcement authorities
• Enforcing our agreements and protecting the rights, safety, and property of inboxwarm.ai and its users

We do not sell or rent your personal data to third parties. We do not use your email content or personal data to train AI models.

4. Legal Basis for Processing (GDPR)

inboxwarm.ai is actively working toward full compliance with the EU General Data Protection Regulation (GDPR) and the UK GDPR. Where these regulations apply — that is, where you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland — we process your personal data on one or more of the following legal bases:

• Contractual Necessity: We process personal data where it is necessary to perform the contract we have with you — for example, providing access to the Services, managing your subscription, processing billing, and accessing your connected email account to deliver the warmup Service.
• Legitimate Interests: We process personal data where we have a legitimate business interest that is not overridden by your rights — for example, improving our Services, preventing fraud and abuse, monitoring platform performance, and sending marketing communications to existing customers.
• Legal Obligation: We process personal data to comply with applicable laws and regulations, including tax, accounting, and data protection obligations.
• Consent: Where required, we rely on your consent — for example, setting non-essential cookies or sending marketing communications to prospective customers. You may withdraw consent at any time without affecting the lawfulness of prior processing.

For questions about the specific legal basis applicable to a processing activity, please contact us at support@inboxwarm.ai.

5. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data. We may share your information only in the following limited circumstances:

5a. Service Providers

We engage trusted third-party service providers to perform functions on our behalf. These providers are granted access to your information only as necessary to perform their services and are bound by contractual data protection obligations. Current categories of service providers include:

• Payment processing — Stripe, Inc. (payment card handling; we do not store full card numbers)
• Cloud infrastructure and hosting providers
• Email delivery and SMTP service providers
• AI-based content generation services (operating on anonymized or synthetic data only)
• Customer support and helpdesk platforms
• Analytics and performance monitoring tools

5b. Legal and Regulatory Requirements

We may disclose personal data to government authorities, law enforcement, or other third parties if required by applicable law, court order, subpoena, or regulatory requirement. We may also disclose data where we in good faith believe disclosure is necessary to protect the rights, property, or safety of inboxwarm.ai, our users, or the public.

5c. Business Transfers

In the event of a merger, acquisition, asset sale, reorganization, or similar corporate transaction involving Clustox LLC, your personal data may be transferred to a successor entity. We will provide reasonable notice before your personal data becomes subject to a materially different privacy policy.

5d. With Your Consent

We may share your information with third parties where you have given explicit consent to such sharing.

6. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. Our specific retention practices are:

• Account Data: Retained for the duration of your active account. Following account deletion, we retain core account records for up to 3 years to comply with legal, tax, and dispute-resolution obligations, unless a longer period is required by law.
• Connected Email Credentials: Stored in encrypted form and retained only for as long as your email account remains connected to the Service. Credentials are deleted promptly upon disconnection or account termination.
• Warmup Campaign & Performance Data: Retained for the duration of your account and for up to 12 months following account closure for analytics and audit purposes.
• Transaction & Billing Records: Retained for a minimum of 7 years to comply with financial recordkeeping requirements under applicable law.
• Support & Communication Records: Retained for up to 3 years from the date of the interaction, or as required by applicable law.
• Marketing Consent Records: Retained for as long as you remain a subscriber, and for up to 3 years following opt-out, to demonstrate compliance.
• Cookies & Analytics Data: Session cookies are deleted when your browser session ends. Persistent cookies and analytics data are retained in accordance with the retention periods of the applicable third-party provider.
• Backup Copies: Residual copies of data may persist in encrypted backup systems for a limited period after deletion due to technical constraints.

You may request deletion of your Customer Data at any time by contacting us at support@inboxwarm.ai. Upon such request, we will take reasonable steps to delete your data, unless retention is required for legal, security, or operational purposes.

7. Data Security

We implement and maintain appropriate technical, administrative, and organizational security measures designed to protect your personal data against unauthorized access, alteration, disclosure, loss, or destruction. These measures include:

• Encryption of data in transit using TLS/SSL protocols
• Encryption of sensitive data at rest, including connected email account credentials
• Encrypted storage of all third-party account credentials, which are used solely for warmup purposes
• Role-based access controls to limit access to personal data on a need-to-know basis
• Automatic warmup pause mechanisms on bounce detection or excessive spam complaints
• Regular security assessments and vulnerability reviews
• Use of reputable, security-certified third-party infrastructure providers
• Employee and contractor training on data privacy and information security practices

While we take reasonable and industry-standard precautions, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security of your data. In the event of a security breach that is reasonably likely to result in a risk to your rights and freedoms, we will notify affected users and relevant regulatory authorities in accordance with applicable law and without undue delay.

8. Your Rights

8a. Rights Under GDPR (EEA, UK, and Switzerland)

If you are located in the EEA, the United Kingdom, or Switzerland, you have the following rights in respect of your personal data:

• Right of Access: The right to obtain confirmation of whether we process your personal data and to receive a copy of that data.
• Right to Rectification: The right to have inaccurate or incomplete personal data corrected.
• Right to Erasure: The right to request deletion of your personal data, subject to applicable legal retention requirements.
• Right to Restriction of Processing: The right to request that we limit how we use your data in certain circumstances.
• Right to Data Portability: The right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller where technically feasible.
• Right to Object: The right to object to processing based on legitimate interests or for direct marketing purposes.
• Rights Related to Automated Decision-Making: The right not to be subject to decisions based solely on automated processing that produce significant legal or similarly significant effects.
• Right to Withdraw Consent: Where processing is based on consent, the right to withdraw consent at any time, without affecting the lawfulness of prior processing.
• Right to Lodge a Complaint: The right to lodge a complaint with your local data protection supervisory authority if you believe we have not handled your personal data in compliance with applicable law.

8b. Rights Under CCPA/CPRA (California Residents)

If you are a California resident, you have the following rights under the CCPA and CPRA:

• Right to Know: The right to request disclosure of the categories and specific pieces of personal information we have collected, the sources, our business purposes, and the categories of third parties with whom we share it.
• Right to Delete: The right to request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Correct: The right to request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: We do not sell personal information as defined under CCPA/CPRA, nor do we share it with third parties for cross-context behavioral advertising.
• Right to Limit Use of Sensitive Personal Information: To the extent we collect sensitive personal information, you have the right to limit its use to purposes permitted under applicable law.
• Right to Non-Discrimination: You will not receive discriminatory treatment for exercising any of your CCPA/CPRA rights.

8c. How to Exercise Your Rights

To exercise any of the rights described above, please contact us at support@inboxwarm.ai. We will respond to verifiable requests within the timeframe required by applicable law — generally 30 days under GDPR and 45 days under CCPA/CPRA, with a possible extension where permitted. We may need to verify your identity before processing your request. There is no charge for submitting a rights request unless requests are manifestly unfounded or excessive.

9. International Data Transfers

inboxwarm.ai is operated by Clustox LLC, based in the United States (Delaware). If you access our Services from outside the United States, your personal data will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country of residence.

Where we transfer personal data originating from the EEA, the United Kingdom, or Switzerland to countries not deemed to provide an adequate level of data protection, we implement appropriate safeguards to ensure that your data remains protected. These safeguards may include:

• Standard Contractual Clauses (SCCs) approved by the European Commission or the UK Information Commissioner's Office
• Binding Corporate Rules, where applicable
• Other legally recognized transfer mechanisms as they become available under applicable law

You may request a copy of the applicable transfer safeguards by contacting us at support@inboxwarm.ai.

10. Children's Privacy

The Services are intended solely for use by individuals who are at least 18 years of age, as required by our Terms of Use. We do not knowingly collect, solicit, or process personal data from anyone under the age of 18. If you are a parent or guardian and believe that a minor has provided us with personal data without your consent, please contact us immediately at support@inboxwarm.ai. Upon verification, we will take prompt steps to delete such data from our systems.

11. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Services, or applicable law. The "Last Updated" date at the top of this Policy indicates when the most recent revision was made.

When we make material changes, we will provide notice by updating the effective date and, where required by law or where changes are significant, by notifying you via email to your registered address or through a prominent notice on the Site. Your continued use of the Services after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms.

We encourage you to review this Privacy Policy periodically to remain informed about how we protect your information.

12. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

For EEA or UK users wishing to lodge a complaint with a supervisory authority: EEA authorities are listed at https://edpb.europa.eu. The UK authority is the Information Commissioner's Office (ICO) at https://ico.org.uk.

© 2026 Clustox. All rights reserved.