1. Introduction
ScaleMakers V.O.F. (“we”, “us”, “our”), which operates the InboxServe service, is committed to protecting your personal data. This Privacy Policy explains what data we collect, why we process it, how we protect it, and what rights you have under the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), the Dutch GDPR Implementation Act (UAVG), and other applicable European and national privacy legislation.
This Privacy Policy describes how we process personal data when you use our services. Where we rely on consent, you may withdraw it as described in section 11.
2. Controller and Processor Responsibilities
For our merchant accounts, billing, website operation, and service security, InboxServe determines the purposes of processing and acts as a controller. The responsible company is:
ScaleMakers V.O.F.Motketel 10
7031 LB Wehl
The Netherlands
KvK: 96391995
Email: privacy@inboxserve.com
When a store uses InboxServe to handle its customers' messages, orders, and support requests, the store normally acts as controller and InboxServe processes that information on its behalf. The store decides how it uses the service and is responsible for its customer privacy notice, lawful basis, and instructions. Contact the store about your purchase or support data; we assist with requests concerning data held in InboxServe.
3. What Personal Data We Collect
3.1 Account Data
- Full name, email address, and authentication credentials (passwords are stored as hashes)
- Organization name, ID, and role
3.2 Usage Data
- IP address, browser, operating system, referring URL
- Pages visited, actions performed, session duration
Our website and merchant dashboard use analytics and technical monitoring, as described in sections 7 and 12. The customer portal and storefront chat do not enable our optional browser analytics or session recording. Requests still pass through the infrastructure needed to provide and secure those services.
3.3 Customer and Communication Data
As a processor on your behalf:
- Messages and conversations between you and your customers
- Customer contact details, order data, attachments
3.4 Technical and Security Data
Log files, authentication tokens, and API call metadata.
3.5 Google User Data
If you choose to connect your Google account to InboxServe, we collect your Google email address (to identify the connected account) and OAuth tokens (access and refresh as issued by Google) needed to call Google APIs on your behalf. We request only the OAuth scopes listed in section 4.
3.6 AI Features
When a store uses AI features, relevant conversation text, knowledge articles, and customer or order context may be processed to classify, translate, summarize, or suggest and generate support replies. Information submitted to an AI feature, including images where supported, may be sent to the AI services listed in section 7. Avoid including unnecessary sensitive information in support messages.
4. Google API Disclosure & Limited Use
InboxServe uses Google APIs to provide sending from your connected Gmail or Google Workspace mailbox when you enable that option.
4.1 OAuth scopes (Connect Gmail)
The OAuth consent screen and our authorization request use the following scopes together (space-separated in the request; see https://www.googleapis.com/auth/gmail.send openid https://www.googleapis.com/auth/userinfo.email):
https://www.googleapis.com/auth/gmail.send— send email through the Gmail API when you send replies or outbound messages from your connected account inside InboxServe.openid— establish your Google sign-in session for the OAuth grant used by this connection flow.https://www.googleapis.com/auth/userinfo.email— read your Google account email address via the OAuth UserInfo endpoint so we can display and store which mailbox is connected (we do not use Gmail read or metadata scopes for mailbox access).
4.2 Access, use, storage, and sharing
- Access: We access Google user data only after you complete Google's OAuth consent for the scopes above, and only through Google's APIs for the purposes described here.
- Use: We use this data to identify the connected mailbox, maintain the connection, and send messages you initiate from InboxServe through your Google account. We do not use Google user data to serve advertisements (including remarketing or interest-based ads); we do not transfer Google user data to third parties except where necessary to provide or improve user-facing features in InboxServe, where compelled by applicable law, or in connection with a merger, acquisition, or sale of assets with continued protection; we do not allow humans to read Google user data except (a) where you have given us specific consent to do so, (b) where it is necessary for security purposes such as investigating abuse, (c) where required to comply with applicable law, or (d) where the data has been aggregated and de-identified and is used for internal operations consistent with this policy; and we do not use Google user data to develop, improve, or train generalised or non-personalised AI or machine-learning models.
- Storage: We store your connected Google email address and encrypted refresh token in our service database. Disconnecting Gmail removes those connection details from the active application. Messages already sent or held as support history have separate retention, as described in section 9. Data is transmitted over TLS; our security measures are described in section 10.
- Sharing: Google processes data according to Google's terms and policies. We do not transfer Google user data to third parties except as needed to operate the service (sub-processors in section 7) or when required by law.
We do not use the Gmail API to read your mailbox. Inbound mail typically reaches InboxServe through your forwarding or channel configuration. Your organization may view and handle those conversations in InboxServe as a support platform in line with your instructions and this policy.
4.3 Scopes we do not request
For the Gmail connection described above, we do not request Gmail read, metadata-only, compose/draft management, or full-mailbox scopes (for example gmail.readonly, gmail.modify, or https://mail.google.com/). We use send-only access via https://www.googleapis.com/auth/gmail.send for messages you initiate in InboxServe.
4.4 Limited Use
InboxServe's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, we do not use Google user data for serving advertisements (including personalised, remarketing, or interest-based ads); we do not transfer Google user data to third parties except as necessary to provide or improve user-facing features in InboxServe, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with continued protection; we do not allow humans to read Google user data unless we have your affirmative consent for specific messages, it is necessary for security purposes such as investigating abuse, it is required to comply with applicable law, or the data has been aggregated and de-identified and is used only for internal operations; and we do not use Google user data to develop, improve, or train generalised or non-personalised AI or machine-learning models.
4.5 Scope of other purposes
The general processing purposes listed in section 5 (Legal Basis) and section 6 (Purposes of Processing) — including platform improvement, analytics, service improvement, and marketing communications — do not apply to Google user data. Google user data is processed only for the purposes described in this section 4, in line with the Google API Services User Data Policy and its Limited Use requirements.
5. Legal Basis for Processing
These bases concern processing for which we act as controller. For store customer data, the store determines the applicable basis and instructs us as its processor. Permission to connect an integration does not by itself establish a GDPR legal basis for every subsequent use of data.
| Legal basis | Explanation |
|---|---|
| Performance of a contract (Art. 6(1)(b)) | Necessary to provide our services and manage your account. |
| Legitimate interest (Art. 6(1)(f)) | Service security, fraud prevention, and reliability, subject to balancing those interests against your rights. This does not replace consent where required for non-essential cookies or similar technologies. |
| Legal obligation (Art. 6(1)(c)) | Tax administration, court orders. |
| Consent (Art. 6(1)(a)) | Processing for which consent is required, such as non-essential tracking or separately requested marketing communications. Consent can be withdrawn. Google OAuth separately controls your authorization to connect Gmail. |
6. Purposes of Processing
- Service delivery: Account management, message processing, and customer interactions.
- Platform improvement: Usage analysis and feature development.
- Security: Protection against unauthorized access and abuse.
- Communication: Inquiries, service notifications, and — where you have opted in separately — product marketing communications using the contact details you provided to us. We never use Google user data for marketing.
- Legal obligations: Compliance with applicable laws.
- Dispute resolution: Establishing or defending legal claims.
8. International Data Transfers
Providers may process data outside the European Economic Area (EEA). The applicable processing locations and transfer arrangements depend on the provider and service configuration. GDPR transfer requirements can involve an applicable adequacy decision or appropriate safeguards, such as Standard Contractual Clauses. Contact our privacy address for information about the arrangements and safeguards applicable to your service.
9. Retention Periods
- Merchant account and billing records: retention depends on maintaining the account, necessary administration, applicable accounting obligations, and the establishment or defence of legal claims. Those purposes do not require retaining every support message for the same period.
- Chat and customer portal history: store retention settings govern scheduled cleanup, with a default of 365 days. Closed or resolved conversations are eligible based on their last activity; open support requests can remain available while being handled. Other support channels have separate retention needs.
- Gmail connection credentials: disconnecting Gmail removes the stored connection email and refresh token from the active application; it does not delete messages already delivered to a recipient or retained as support history.
- Customer sign-in: sessions normally expire after 7 days and one-time verification codes after 15 minutes. Expiry ends access; it does not mean every associated record is immediately deleted. Some session records remain linked to support history for access and deletion handling.
- Deletion and provider records: deletion requests, scheduled cleanup, provider logs, and backup retention are separate processes. Removing data from the active application does not establish immediate deletion from every provider or backup. Contact us or your store for the retention criteria applicable to your information.
10. Security
- HTTPS for service connections and server-side handling of integration credentials.
- Secure authentication with hashed passwords.
- Organization and store access boundaries and permission checks.
- Filtering of sensitive fields in operational monitoring.
11. Your Rights
Under the GDPR you have the right to: access, rectification, erasure, restriction of processing, data portability, object, withdraw consent where processing is based on consent, and not to be subject to solely automated decision-making that produces legal or similarly significant effects (where applicable). Contact us at privacy@inboxserve.com to exercise these rights. We respond without undue delay and normally within one month, subject to extensions allowed by law. For information handled on a store's behalf, you can also contact the store or use its customer portal privacy requests. Identity verification may be needed before disclosing or deleting personal information.
13. Complaints
Contact us at privacy@inboxserve.com, or file a complaint with the Autoriteit Persoonsgegevens.
14. Contact
PRIVACY CONTACT
ScaleMakers V.O.F. · Motketel 10, 7031 LB Wehl, the Netherlands · KvK 96391995 · privacy@inboxserve.com