Privacy Policy

Mission Inbox Inc. ("we," "us," "our," or "Company") is committed to protecting your privacy and being transparent about how we collect, use, and protect your personal information. This Privacy Policy explains our data practices when you use our email infrastructure platform and related services (the "Service").

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our practices, please do not use the Service.

Service Provision

• Deliver, operate, maintain, and improve our email infrastructure services across both product lines.
• Process and route your email campaigns and transactional sends.
• Manage your account, authenticate your identity, and provide customer support.
• Monitor deliverability metrics and maintain sender reputation on shared infrastructure.
• Enforce compliance with our Acceptable Use Policy and these Terms.

Billing & Business Operations

• Process subscription and usage-based charges, generate invoices, and manage payment collections as described in our Billing Policy.
• Send service updates, security alerts, billing notifications, and account communications.
• Analyze platform usage patterns to improve features and user experience.
• Meet regulatory, tax, and legal compliance obligations.

Security & Fraud Prevention

• Monitor for suspicious activity, unauthorized access, and AUP violations.
• Investigate potential security incidents and platform abuse.
• Maintain audit logs for compliance, billing disputes, and troubleshooting.

AI-Powered Spam Protection (MI Shield)

Mission Inbox uses email content patterns and performance data to train and improve our proprietary MI Shield system. See Section 12 for full details on AI data processing, safeguards, and your options.

Service Providers

We share data with trusted third-party providers who assist in operating the Service. All providers are contractually bound to protect your information and use it only for the specific purpose for which it was shared:

Legal Requirements

We may disclose information when required by law or when we reasonably believe disclosure is necessary to: comply with legal process, court orders, or government requests; protect our rights, property, or safety or that of our users; investigate fraud, security breaches, or policy violations; or enforce our Terms of Service.

Business Transfers

In the event of a merger, acquisition, or sale of substantially all of our assets, your information may be transferred as part of the transaction. We will provide notice via email and/or a prominent notice on our website prior to the transfer taking effect, and you will have the option to delete your account before the transfer.

Your Email Recipients

When you send emails through the Service, recipient information and email content are shared with the intended recipients and with email delivery providers in the transmission chain. Email performance data (opens, clicks, bounces) is processed by analytics services when enabled on your account.

Technical Safeguards

• Encryption: All data is encrypted in transit using TLS and at rest using AES-256.
• Access controls: Role-based access with multi-factor authentication required for all Mission Inbox personnel accessing production systems.
• Credential handling: SMTP/IMAP credentials stored on our platform are encrypted at rest and never exposed in logs, error messages, or support interfaces.
• Network security: Firewalls, intrusion detection systems, and regular penetration testing.
• SOC 2 compliance: Mission Inbox operates under an active SOC 2 compliance program covering security, availability, and confidentiality trust service criteria.

Employee Access

Access to personal information is restricted to Mission Inbox personnel who require it to perform their job functions. All employees undergo security awareness training and sign confidentiality agreements. Access is reviewed and revoked promptly upon role changes or departure.

Incident Response

• In the event of a confirmed security incident affecting your account data, we will notify you within 72 hours of discovery via the email address registered to your account.
• We will contain the incident, assess the scope of impact, and take corrective measures to prevent recurrence.
• Where required by law, we will notify relevant supervisory authorities within applicable timeframes.
• To report a potential security vulnerability or incident, contact hey@missioninbox.com with subject line "Security Incident."

Regardless of your jurisdiction, Mission Inbox honors the following rights for all users:

To exercise any right, email hey+privacy-requests@missioninbox.com or submit a request through your account dashboard. We will respond within 30 days, or within the timeframe required by applicable law in your jurisdiction.

Mission Inbox is headquartered in the United States. If you are accessing the Service from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate.

We ensure international transfers are protected through one or more of the following mechanisms:

• Adequacy decisions: Transfers to countries that the European Commission or relevant authority has determined provide adequate protection.
• Standard Contractual Clauses (SCCs): EU-approved contractual terms incorporated into agreements with service providers.
• Supplementary measures: Technical and organizational measures that provide an equivalent level of protection where required by local law.

Enterprise customers requiring a Data Processing Agreement (DPA) to satisfy GDPR Article 28 requirements should contact hey@missioninbox.com.

You can manage cookie preferences through your browser settings, our in-platform cookie preference center, or opt-out tools for specific analytics providers. We honor Do Not Track (DNT) browser signals and will not deploy non-essential tracking for users with DNT enabled.

The Service is not directed to, and we do not knowingly collect personal information from, individuals under the age of 21. If you believe a minor has provided us with personal information, please contact hey+privacy@missioninbox.com and we will take prompt steps to delete it.

To exercise regional rights, email hey+privacy-requests@missioninbox.com identifying your jurisdiction and the right you wish to exercise. We will respond within the timeframe required by your local law.

Mission Inbox uses email content patterns and performance data to train and continuously improve our proprietary spam detection system, MI Shield. This section explains what data is used, how it is protected, and what the system does.

What MI Shield Does

• Spam detection: Identifies and prevents spam, phishing, and low-quality content from being sent through our infrastructure.
• Content quality analysis: Analyzes email characteristics that correlate with deliverability outcomes and spam classification by major ISPs.
• Platform protection: Maintains the health of our IP infrastructure and sender reputation pool for all customers.
• Automated policy review: Flags content that may violate our Acceptable Use Policy for human review.

Data Used for AI Training

• Content patterns: Email text structures, subject line patterns, and formatting features are analyzed. Full message bodies are processed but not retained in identifiable form beyond our standard email content retention window.
• Performance correlation: Engagement metrics (bounce rates, complaint rates) are correlated with content features to improve quality scoring.
• Anonymization: Training datasets are processed to remove personally identifiable information where technically practicable before use in model training.
• Aggregation: Individual patterns are combined into aggregate datasets; the model does not memorize or reproduce individual email content.

AI Training Safeguards

• Data minimization: Only content features necessary for spam detection improvement are extracted for training purposes.
• Access controls: AI training datasets are accessible only to authorized Mission Inbox engineering personnel.
• Purpose limitation: Training data is used exclusively for improving spam protection and content quality analysis — not for advertising, profiling, or resale.
• Retention limits: Training datasets are periodically refreshed; outdated data is removed on a rolling basis.

We may update this Privacy Policy periodically to reflect changes in our practices, the Service, or applicable law. Material changes will be communicated through:

• Email notification to your registered account address at least 14 days before the change takes effect.
• A prominent notice on our website and within the platform.

Your continued use of the Service after the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. If you disagree with material changes, you may terminate your account before the effective date.

This Privacy Policy is effective as of January 5, 2026 and applies to all users of Mission Inbox services. It is incorporated by reference into the Mission Inbox Terms of Service. For all other legal matters, refer to the Terms of Service and Billing Policy.