HelloBox1. Introduction and operator
HelloBox is an email client that turns domains on your own Amazon SES or Resend account into a shared inbox, and lets you send campaigns to your contacts. This policy explains what we collect, why, and the choices you have.
- Service
- HelloBox
- Operated by
- Komlan Daniel-Sylvère Siameyon AMETSOWOU (Sole Proprietor)
- Tax ID (NIF)
- 1002053591
- Address
- Zossimé - Nanégbé, Lomé - Togo (State: Maritime)
- Legal contact
- [email protected]
We collect only what we need to run the service. Email is sensitive, so we treat it that way.
2. Information we collect
- Account information: your name, email address and sign-in details. Passwords are stored as cryptographic hashes, never as plain text. If you sign in with Google, GitHub or your company's SSO provider, we receive the basic profile that provider shares, such as your name and email address.
- Workspace information: workspace names, members, roles, invitations, domains, mailboxes, labels, rules and sender lists.
- Email content: messages you receive and send through your connected Amazon SES or Resend account, including senders, recipients, subjects, bodies, headers, attachments and the original message files. This includes personal data about the people who write to you.
- Contacts and campaigns: contacts you add or import, with their email addresses, names, any custom fields you give them, and whether they've unsubscribed. We also store your templates and the campaigns you send, including their content and how many people they went to. This is personal data about the people on your lists.
- Resend connection: access tokens and webhook secrets for the Resend account you connect, which are encrypted before storage.
- Amazon SES connection: your AWS account ID, region, the address of the role your CloudFormation stack creates, and an external ID that only lets HelloBox use that role. We never receive or store your AWS access keys.
- Billing information: your plan, subscription status, billing dates and customer identifiers. Dodo Payments handles card details, and we never receive full card numbers.
- Agent connections: if you connect an AI agent, the connection's name, the access you gave it, when it expires and when it was last used. We keep only a hash of its token.
- AI provider details: if you add your own AI provider, its name, your chosen model and your API key, which is encrypted before storage.
- Technical information: logs needed to run and secure the service, such as request times, IP addresses, device or browser details for your active sessions, errors and security events.
3. Why we process information
- Running the service: receiving, storing, threading, searching and displaying mail, and sending what you write.
- Sorting and safety: scoring messages for spam, checking sender authentication, applying your rules and sorting mail into categories. These run automatically on each message.
- Campaigns: on Resend, copying your contacts to a segment in your own Resend account and sending your campaigns through Resend Broadcasts. On Amazon SES, sending one email per contact from your own AWS account. Either way, adding an unsubscribe link to every campaign and recording opt-outs, bounces and complaints so nobody who unsubscribed gets another campaign.
- Amazon SES access: using the role in your AWS account to verify domains, send mail, record deliveries, and set up receiving. Incoming mail is stored briefly in an S3 bucket in your account, copied to our storage, then deleted from the bucket. Anything we fail to collect is deleted by the bucket after one day.
- Communication: email verification, password resets, invitations and essential notices about the service.
- Billing: managing plans, limits and subscriptions, including how many contacts a plan can store.
- Security: protecting accounts, preventing abuse and enforcing our Terms.
- Legal compliance: meeting tax and accounting duties, and responding to lawful requests.
4. No sale of data, no AI training
- We don't sell personal information, and we don't share it with advertisers or data brokers.
- We don't train AI models on your data. Your email is never used to build or improve AI models.
- We don't run ads or cross-site trackers. Remote images in emails are blocked by default, so senders can't see when you open a message until you allow them.
5. AI features
HelloBox doesn't include its own AI service. The assistant only works if you add an API key from a provider you choose. Your request goes to that provider, along with recent messages from the open conversation if you leave sharing on. That provider's own terms and privacy policy apply to what it receives.
The assistant only returns draft text. It can't send email or take other actions. Spam filtering and categories don't use your AI provider.
You can also connect your own AI agent over MCP with a connection you create in Settings. It acts on your behalf, with the access you chose (read, organize or send), and never more than your own. What it reads goes to that agent and the AI provider behind it, under their terms. Changes and sends it makes are recorded in the audit log, and emails it sends are marked as sent by an agent. You can revoke a connection at any time.
6. Your content and responsibilities
Workspaces decide which domains and mailboxes to connect, and who can access them. You're responsible for having a lawful basis to process the personal data in your mail, and for telling people about it where the law requires that.
The same goes for your contacts. Only add people who agreed to hear from you, or whom you can otherwise lawfully email. Every campaign carries an unsubscribe link that can't be removed. Once someone unsubscribes, HelloBox won't send them another campaign, and only they can subscribe again.
For that content, your workspace generally decides how the data is used, and we process it on your behalf to provide the service. Workspace owners and admins can access all of the workspace's mailboxes. You keep full ownership of your content.
7. Third-party service providers
We rely on these providers to deliver the service:
- Resend: if you connect it, sends and receives your mail through your own account and stores the contacts you add to campaigns there. It also sends our product emails.
- Amazon Web Services: if you connect Amazon SES, sends and receives your mail through your own AWS account. HelloBox's own AWS account only holds the identity that your role trusts, and no mail passes through it.
- Cloudflare: R2 file storage for attachments and original messages, and network services.
- Contabo: server hosting for the application, database and queue.
- Dodo Payments: subscriptions, invoices and payments.
- Google and GitHub: optional sign-in.
- Your SSO provider: optional sign-in on the Business plan, chosen by your company.
- Your AI provider: optional, chosen by you.
We run spam scoring on our own servers, so email content isn't sent to an outside spam service. Resend's and AWS's own handling of your accounts is governed by your agreements with them.
8. Data retention and deletion
We keep your data while your account and workspace are active. Conversations in Spam and Trash are permanently deleted after 30 days, and you can delete a conversation in Trash sooner.
Contacts stay until you delete them, and unsubscribes are kept with them so opt-outs keep working. Deleting a contact removes it from HelloBox and from your workspace's segment in Resend. The contact itself stays in your Resend account, where you can delete it, and Resend's own retention applies. Campaigns you send stay in your list until you remove them.
You can export workspace data and delete your account in Settings. Deleting your account also deletes any workspace where you're the only member. You can also ask for deletion at [email protected].
We may keep some information where the law requires it, such as tax records, or to resolve disputes and prevent fraud. Copies in backups last until those backups are overwritten.
9. Security
- HTTPS for data sent over the internet.
- Hashed passwords, secure session cookies and optional two-factor authentication.
- Application-level encryption for Resend tokens, webhook secrets and AI keys. Amazon SES access uses short-lived credentials and no stored keys.
- Access checks that separate workspaces and mailboxes.
- Sanitizing and sandboxing of email content before it's displayed.
Email isn't end-to-end encrypted. Search and spam filtering need to read it. No system is perfectly secure, so we can't guarantee absolute security.
10. International data processing
HelloBox is operated from Togo. Our providers process data in several countries, and file storage is currently in North America. If you use HelloBox from another country, your data will be transferred to and processed in countries whose data protection laws may differ from yours.
11. Your privacy rights
Depending on where you live, you may have the right to access, correct, delete, restrict or export your personal data, to object to certain processing, and to withdraw consent. You may also be able to complain to your local data protection authority.
To use these rights, contact [email protected]. If your data is in a mailbox run by a HelloBox customer, for example because you emailed them, please contact that customer first, since they control that mail.
If you got a campaign sent with HelloBox, the unsubscribe link at the bottom of it stops any more campaigns from that sender right away. That sender controls their contact list, so ask them directly to delete your details.
13. Children's privacy
HelloBox is for professional use and isn't directed at children. We don't knowingly collect information from anyone under 18. If you believe a minor has given us information, contact [email protected] and we'll delete it.
14. Changes to this policy
When we update this policy, we change the date at the top of this page. For significant changes, we'll also notify you by email or in the app.
15. Contact
- Service
- HelloBox
- Operated by
- Komlan Daniel-Sylvère Siameyon AMETSOWOU (Sole Proprietor)
- Tax ID (NIF)
- 1002053591
- Address
- Zossimé - Nanégbé, Lomé - Togo (State: Maritime)
- Legal contact
- [email protected]