Privacy Policy

Letterbox is a shared email inbox for support teams. It is an independent service run by an individual based in India (“we”, “us”). This policy explains what we collect, why, and the choices you have.

Two kinds of data

• Account data about the people who use Letterbox: name, email address, password (stored only as a secure hash), workspace membership and settings.
• Workspace content that a team handles in Letterbox: the emails their customers send them and the replies they send, attachments, contacts, comments, labels and saved replies. The team that owns the workspace decides what goes in it; we process it on their behalf.

What we collect automatically

Basic technical data needed to run and secure the service: IP addresses (to limit repeated sign-in attempts and spot abuse), browser and device type, and logs of errors. We use cookies only to keep you signed in. We don't use advertising or cross-site tracking cookies, and we don't sell personal data.

How we use it

• To provide the service: receive, store, show and send email for your workspace.
• To send email the service needs: replies your team writes, invitations from your teammates, sign-in and account messages, and notifications you can turn off.
• To keep the service secure and working, and to answer support requests.
• To understand how the product is used, in aggregate, so we can improve it.

We never use workspace content for marketing, and never send marketing email to your customers.

AI features

When someone on your team uses an AI feature (drafting a reply, rewriting text or summarizing a conversation), the relevant conversation content is sent to Anthropic's Claude model through Vercel AI Gateway to produce the result. Nothing is sent unless a person clicks an AI button, and workspace admins can turn AI features off entirely.

Service providers

We rely on a few providers who process data for us under their own security and privacy commitments:

• Vercel, for hosting the website and app, and for the AI gateway.
• Convex, for the database, file storage and backend.
• Anthropic, for AI features, only when they're used.
• Our email delivery provider, for receiving and sending email.

These providers may store and process data in the United States and other countries.

How long we keep it

We keep account data and workspace content while the account or workspace exists. Notifications are deleted after 90 days. When a workspace is deleted, or you ask us to delete your account, we delete the related data within 30 days, except where the law requires us to keep it.

Your choices and rights

You can see and update your account details in the app. You can ask us for a copy of your data, to correct it, or to delete it. If you are a customer who emailed a business that uses Letterbox, please contact that business first: they control their workspace, and we'll help them with your request.

Security

Data is encrypted in transit, access to workspaces is limited to their members, sign-in attempts are rate limited, and two-factor authentication is available. No system is perfectly secure, but we work to protect your data and will tell affected customers about a breach as the law requires.

Children

Letterbox is a business tool and isn't meant for anyone under 18.

Changes

If we change this policy, we'll update the date above, and tell account owners about significant changes before they take effect.

Contact

Questions about privacy? Email hello@useletterbox.com.