This Privacy Policy applies to InboxStream (“we,” “us,” “our”), which operates https://inboxstream.co and provides CRM, Voice AI, and marketing automation services. By using our Site or Services, you agree to the practices described in this Policy. Our contact email is: [email protected]. We are based in Lahore, Pakistan and serve clients globally.

1. Information We Collect

Category	Examples
Identifiers	Name, email, phone, company name, postal address, IP address, account username
Commercial information	Services purchased, subscription tier, billing history, invoice records
Financial information	Payment details at invoicing (processed by Stripe or Payoneer — we do not store full card numbers)
Internet & device activity	Pages visited, links clicked, time on Site, referring URL, browser type, OS, device data
Geolocation (approximate)	City and country from IP — we do not collect precise GPS location
Audio recordings	Sales, onboarding, and support calls (with prior notice); Voice AI call recordings and transcripts processed on behalf of clients
Professional information	Business type, industry, business size
Branding & setup data	Logos, scripts, workflow preferences, and business info shared during setup
Client-uploaded customer data (as processor)	Customer names, phone numbers, emails, appointments, call recordings, messages, and other data uploaded to the CRM
Inferences	Profiles built from the above to assess fit and deliver relevant communications

We do not knowingly collect: racial or ethnic origin, religious beliefs, sexual orientation, genetic data, biometric data, precise geolocation, health information, or data from children under 16.

2. Where We Get Your Information

• Directly from you — forms, demo bookings, signups, or onboarding submissions
• Automatically from your device — cookies, pixels, and analytics tools when you visit our Site
• From advertising platforms — Meta and Google may share interaction data when you engage with our ads
• From our clients — when clients upload customer lists, messages, and records to the CRM
• From sub-processors — Voice AI providers who process call data on our behalf, and our telephony carrier, Signal House, which transmits the messages and calls placed through the Platform
• From publicly available sources — business directories and public records

3. How We Use Your Information

• To provide, maintain, and support the Services (CRM, Voice AI, automations, website builder)
• To schedule and conduct setup and demo calls
• To send invoices and process payments
• To communicate service updates, security alerts, and support messages
• To analyse Site usage and improve our offerings using analytics tools
• To deliver and measure advertising campaigns on Google and Meta (retargeted advertising)
• To build audiences for advertising including lookalike audiences on ad platforms
• To conduct quality assurance by reviewing call recordings
• To comply with legal obligations and enforce our Terms of Service
• To prevent fraud, abuse, and unauthorized access

We do not sell your personal data or your customers’ data to third parties for monetary consideration.

4. How We Share Your Information

Recipient	Purpose
Voice AI providers (e.g., the voice provider, the voice provider)	To process inbound calls, generate transcripts, and handle Voice AI on clients’ behalf
Telephony carrier (Signal House)	To transmit the SMS/MMS messages and voice calls that clients send and place through the Platform — Signal House processes phone numbers, message content, and call data solely to deliver them
Payment processors (Stripe, Payoneer)	To process subscription and invoice payments securely
Hosting & infrastructure providers	To store and deliver the Platform and website
Analytics providers (PostHog, Google Analytics)	To understand how visitors use our Site and improve our Services
Advertising platforms (Google Ads, Meta/Facebook Ads)	To deliver retargeted advertising and build lookalike audiences — this constitutes “sharing” under California law. See Section 6 for opt-out options.
Email & SMS delivery providers	To send transactional and service communications
Professional advisors	For legal, accounting, and compliance purposes
Acquirers	In connection with a merger, acquisition, or sale of business assets
Government or legal authorities	When required by law, court order, or regulatory obligation

5. Mobile Communication Policy

5.1 Messages We Send You

When you provide your mobile number, you consent to receive SMS from InboxStream related to account notifications, invoice reminders, and onboarding. Reply STOP to opt out, HELP for assistance. Message frequency varies. Standard rates apply.

5.2 Messages Sent Through the Platform

Our clients use the Platform to send SMS/MMS to their own customers. Those messages are sent by the client — not InboxStream. The client is solely responsible for consent. The Platform automatically honors STOP, UNSUBSCRIBE, and CANCEL keywords. Messages are transmitted by our telephony carrier, Signal House, solely to deliver them.

6. Advertising, Cookies, and Tracking

6.1 What We Use

• Essential cookies — to keep you logged in and remember preferences
• Analytics — PostHog and/or Google Analytics to understand Site interactions, page performance, and user flow. May include session recording and heatmaps.
• Advertising & retargeting — Meta Pixel and Google Ads tags to deliver retargeted ads to Site visitors and build lookalike audiences

6.2 Your Advertising Opt-Out Rights

When you visit our Site, your browsing activity may be shared with Google and Meta for advertising. This is considered “sharing” under California privacy law. You have the right to opt out at any time.

7. Voice AI and Sub-Processors

The Voice AI feature is powered by external providers (such as the voice provider, the voice provider, or similar). When a call is handled by Voice AI, the caller’s phone number, call audio, and transcript are processed by that provider under contractual data protection obligations.

Telephony services for the Platform — including the delivery of SMS/MMS messages and the transmission of inbound and outbound voice calls — are provided by Signal House. Signal House acts as our telephony carrier and processes phone numbers, message content, and call metadata solely to transmit those messages and calls on our behalf, under contractual data protection and confidentiality obligations.

A current sub-processor list, including Signal House, is available upon request. Clients are responsible for informing their callers that they may be speaking with or recorded by an AI system.

8. Mobile App (Client Access)

InboxStream does not currently offer its own proprietary mobile application. Clients may access the Platform through a mobile companion application available on iOS and Android, provided by our technology partner and governed by that provider’s own terms and privacy policy. InboxStream is not responsible for the privacy practices of third-party applications clients use to access the Platform.

9. Call Recording

9.1 Calls With InboxStream

InboxStream records sales, onboarding, and support calls for quality assurance, training, and dispute resolution. We provide verbal notice at the start of each recorded call. By continuing after notice, you consent to being recorded.

9.2 Calls Through the Platform

When clients use the Platform’s dialer or Voice AI to call their own customers, the client is solely responsible for providing required notice and obtaining required consent under applicable call recording laws. Calls placed through the Platform are transmitted by our telephony carrier, Signal House, which processes call data only to connect and deliver the call.

10. Data Processing — Controller and Processor

For data InboxStream collects about its own clients and Site visitors, InboxStream is the data controller. For data clients upload about their own customers, the client is the data controller and InboxStream is the data processor. InboxStream will: process customer data only on the client’s instructions; not sell or use client customer data beyond the Services; implement reasonable security measures; notify the client of any confirmed breach; and delete or return data within 30 days of termination upon request. A full DPA is available on request at [email protected].

11. Data Retention

Data Type	Retention Period
Client account records	While active, plus 12 months after termination
Customer data uploaded to CRM	Until deleted by client, or 30 days after account termination
Call recordings (InboxStream’s own calls)	Indefinitely, for training, QA, and dispute resolution
Voice AI call recordings (client calls)	12 months, or until deleted by client on request
Billing and tax records	7 years (legal requirement)
Site analytics data	Up to 26 months
Advertising audience data (Google, Meta)	As governed by those platforms’ retention policies
Support communications	Duration of account plus 12 months
Cookies (session)	Until browser session ends
Cookies (persistent)	Up to 13 months

12. Your Privacy Rights

Right	What It Means
Right to know / access	Request a copy of the personal information we hold about you
Right to delete	Request deletion of your personal information
Right to correct	Request correction of inaccurate personal information
Right to portability	Receive your information in a portable format
Right to opt out of sale/sharing	Stop us from sharing your data with advertising partners for behavioral advertising
Right to restrict processing	Ask us to limit how we use your data
Right to object	Object to processing based on legitimate interests or for direct marketing
Right to withdraw consent	Where processing is based on consent, withdraw it at any time
Right to non-discrimination	We will not deny services or charge different prices for exercising your rights
Right to lodge a complaint	File a complaint with a data protection authority in your jurisdiction

13. How to Exercise Your Rights

Email [email protected] with subject “Privacy Request”. Include your name, email, country, and type of request. We will: acknowledge within 10 business days; respond fully within 45 days; provide the first request per 12 months at no charge. Or use our Privacy Request page.

14. Data Security

We implement reasonable administrative, technical, and physical safeguards including: HTTPS/TLS encryption in transit; access controls limiting data access to authorized personnel; contractual security obligations on all sub-processors (including our telephony carrier, Signal House); and regular review of data handling practices. No method of transmission or storage is 100% secure. In the event of a confirmed breach affecting your personal information, we will notify you as required by applicable law.

15. Children’s Privacy

Our Site and Services are not directed to individuals under 18. We do not knowingly collect personal information from minors. If you believe we have collected information from a minor, contact us at [email protected] and we will delete it promptly.

16. International Data Transfers

InboxStream is based in Lahore, Pakistan. Your information may be transferred to and processed in Pakistan or in other countries where our sub-processors operate (including the United States and EU). By using our Services, you acknowledge and consent to this transfer. We impose contractual data protection obligations on our sub-processors.

17. Third-Party Links

Our Site may contain links to third-party websites or services. This Privacy Policy does not apply to those third parties. We encourage you to read their privacy policies.

18. California Privacy Rights (CCPA / CPRA)

California residents have the right to know what personal information we have collected in the past 12 months; opt out of “sharing” of personal information for cross-context behavioral advertising (see Section 6); limit use of sensitive personal information; and not be discriminated against for exercising CCPA rights. In the past 12 months, we have collected the categories listed in Section 1, shared internet activity and identifier data with Google and Meta for advertising, and have not sold personal information for monetary consideration. To exercise California rights, email [email protected] with subject “California Privacy Request.”

19. GDPR — Rights for EEA and UK Residents

If you are in the EEA or UK, our lawful bases for processing include: contract performance (delivering subscribed Services); legitimate interests (analytics, fraud prevention); consent (advertising cookies, marketing); and legal obligation (compliance). You have the right to lodge a complaint with your local supervisory authority. Email [email protected] with subject “GDPR Request.”

20. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting a prominent notice on our Site or by email at least 14 days before the changes take effect. Continued use of the Services after the effective date constitutes acceptance of the updated Policy.