Privacy Notice

InboxDoctor (inboxdoctor.io) is the data controller for the personal data described here. Contact us about anything in this notice at support@inboxdoctor.io.

• Scan data — the domain name you submit and the public DNS and blocklist results returned for it. Used to produce and store your report, and to make it available at its shareable link. This is public infrastructure data, not mailbox content.
• Account data — email address and authentication identifiers when you create an account, including via Google sign-in. Used to give you access to your plan, saved domains and reports.
• Purchase data — plan, status and renewal dates received back from our payment provider. Used to grant access and support you. Card details never reach us.
• Support and contact messages — your name, email, subject and message when you use the contact form, plus the originating IP address and browser user agent for abuse prevention. Used to answer you and to keep the form from being abused.
• Usage and technical data — pages requested, approximate timing, device and browser information, and error diagnostics. Used to keep the service running, secure and reasonably fast.

We do not use your data to train models, and we do not sell or rent it to anyone.

• Contract — running scans you request, providing paid features and supporting your account.
• Legitimate interests — security, fraud and abuse prevention, service reliability, and improving the product, balanced against your rights.
• Consent — any optional marketing email, which you can withdraw at any time.
• Legal obligation — tax, accounting and responding to lawful requests.

• Hosting and infrastructure providers that run the application and database on our behalf.
• Paddle, our Merchant of Record, for the sale of the product, subscription management, payments, invoicing and tax compliance.
• Public DNS resolvers and blocklist operators, which necessarily receive the domain name being looked up as part of a scan.
• Email and support tooling used to deliver messages you have asked for or to reply to you.
• Professional advisers and authorities where required by law.

A scan report is reachable by anyone who has its link, and it contains only publicly published DNS data for the domain scanned. Do not treat a report link as private. Ask us and we will delete a specific report.

Scan reports are kept so their links keep working and so before-and-after comparisons remain possible; they are deleted or anonymised when no longer needed for that purpose. Account and purchase records are kept for the life of the account and then for as long as tax and accounting rules require. Contact messages are kept while the matter is open and for a reasonable period afterwards.

Our providers may process data outside your country, including in the United States. Where data leaves the UK or EEA, transfers rely on an adequacy decision or on Standard Contractual Clauses with appropriate safeguards.

Depending on where you live, you may ask for access to your data, correction, erasure, restriction, portability, or object to processing based on legitimate interests, and you may withdraw consent at any time. Email support@inboxdoctor.io and we will respond within one month. If you are in the UK or EEA and are not satisfied, you can complain to your supervisory authority.

We use appropriate technical and organisational measures, including encryption in transit, access controls on the database, and row-level security so accounts can only reach their own records. No system is perfectly secure, but we treat credentials and customer records as sensitive by default.

We use essential cookies and local storage to keep you signed in and to remember basic preferences. We do not run advertising cookies. Any analytics we add will be limited to aggregate usage measurement, and you can block cookies in your browser, though signing in will stop working.