Privacy Notice

Carlson Nfor, trading as CarlyX Inbox AI, is the data controller for the personal data described here. This notice explains what we collect, why, who we share it with, and the rights you have. Contact: carlsonjaff@gmail.com or +31 6 84880795.

Data we collect and why

• Account data (name, email address, password hash, business name) — to create and secure your account and provide the service. Legal basis: performance of a contract.
• Business Brain content (services, prices, FAQs, communication style, instructions you enter) — to ground AI analysis and drafts in your own information. Legal basis: performance of a contract.
• Mailbox data from the mailbox you connect (sender name and address, subject, message body, thread identifiers, timestamps) — to classify enquiries, draft replies you approve, and manage leads. Legal basis: performance of a contract. This can include personal data about your own customers, for which you are the controller and we act as your processor.
• Lead records (customer name, email, company, request, stage, follow-up dates, notes) — to run your pipeline. Legal basis: performance of a contract.
• Usage and technical data (feature usage counts, log entries, device and browser information, IP address) — for security, fraud prevention, troubleshooting, and improving the product. Legal basis: legitimate interests.
• Support messages — to answer you. Legal basis: legitimate interests.
• Marketing emails, where you opt in. Legal basis: consent, withdrawable at any time.

Mailbox access

We request the minimum Google permissions needed: your email address, read access to messages, and permission to send a reply only when you click Approve & Send. We never delete, archive, label, or otherwise modify your mailbox, and we do not use your mailbox content to train AI models. Access tokens are encrypted and stored on our backend only, never exposed to the browser. Disconnecting the mailbox removes the stored connection.

Mailbox data is used only to provide the product's features: syncing new messages into your CarlyX inbox, analysing them, classifying whether they are relevant to your business, preparing draft replies and follow-ups, and sending a reply through the intended workflow after you review it and click Approve & Send.

Google API data

CarlyX Inbox AI's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide and improve the features described above, is not sold, is not transferred to others except as needed for those features or where required by law, and is not used for advertising or to train generalised AI models.

Disconnecting Gmail and deleting your data

• Disconnect the mailbox: in the app, open Integrations and choose Disconnect on the Gmail card. This removes the stored connection so CarlyX stops accessing your mailbox. You can also revoke access at myaccount.google.com/permissions.
• Delete your account and data: email carlsonjaff@gmail.com from your account address and ask us to delete your CarlyX account. We will delete your account, Business Brain, imported messages and leads, and confirm once done.

Who we share data with

• Service providers / subprocessors: our hosting and database provider, and the AI model providers that process message text to produce classifications and drafts.
• Paddle.com, our Merchant of Record, for the sale of subscriptions, payments, subscription management, tax compliance, and invoicing.
• Professional advisers (legal, accounting) where necessary.
• Authorities, where required by law.

We do not sell personal data.

International transfers

Some providers process data outside the UK/EEA. Where that happens we rely on adequacy decisions or Standard Contractual Clauses together with appropriate technical safeguards.

Retention

Account, Business Brain, mailbox and lead data are kept while your account is active and for up to 90 days after closure, after which they are deleted or anonymised. Billing records are retained by Paddle for the period tax law requires. Logs are kept for up to 12 months.

Security

We use appropriate technical and organisational measures: encryption in transit and at rest, encrypted OAuth credentials, row-level access rules that isolate each account's data, and restricted administrative access.

Your rights

You have the right to access, rectify, erase, restrict, or port your data, to object to processing based on legitimate interests, and to withdraw consent at any time. Email carlsonjaff@gmail.com and we will respond within one month. If you are in the UK or EEA you may also complain to your local supervisory authority.

Cookies

We use essential cookies and local storage only, to keep you signed in and to remember preferences. We do not use advertising or third-party tracking cookies. You can clear or block cookies in your browser, though sign-in will not work without the essential ones.