The short version
- We collect what we need to run your account — your details, billing records and how you use the app — and nothing for advertising.
- The contacts you upload belong to you. We process them only on your instructions, under our Data Processing Addendum.
- We never sell or rent personal data, and we don't use it to target ads.
- Our public website loads no analytics, advertising or tracking scripts.
- You can access, correct, export or delete your data. Email privacy@lebx.io.
This summary is for convenience only — the full text below is what applies.
Who we are and what this policy covers
Lebx Mail is operated by Lebx, India ("we", "us"). This Privacy Policy explains how we collect, use, share and protect personal data when you visit our websites, create an account or use the Lebx Mail service (the "Service").
We play two different roles:
- As a controller (or "data fiduciary" under India's Digital Personal Data Protection Act, 2023), for data about our website visitors, customers and their team members. This policy describes that processing.
- As a processor (or "data processor"), for the contact and subscriber data our customers upload and the people they email. Our customers decide how that data is used; we process it on their behalf under our Data Processing Addendum. If you received an email sent through the Service, see section 10.
Information we collect
Information you give us
- Account details — name, email address, password (stored hashed), company name, postal address, phone number, time zone and language.
- Billing details — billing name and address, tax identifiers (such as GSTIN), plan, invoices and payment history. Card and bank details are handled by our payment processors; we don't store full card numbers.
- Sender details — sending domains, "from" names and addresses, and the postal address shown in your emails.
- Communications — messages you send to support, survey responses and feedback.
Information collected automatically
- Log and device data — IP address, browser type and version, operating system, referring page, pages and features used, and date and time of access.
- Security data — login events, two-factor authentication status and signals used to detect fraud and abuse.
- Cookies — a small number of essential cookies to keep you signed in and secure. See our Cookie Policy.
Information from third parties
- Sign-in providers — if you sign in with Google or Facebook, your name, email address and profile picture from that provider.
- Payment processors — confirmation of payment, the last digits and expiry of your card, and fraud-screening results.
- Connected services — data you ask us to import from services you connect, such as an e-commerce store or advertising account.
How we use your information
Where the GDPR or UK GDPR applies, we rely on the legal bases shown below. Under India's DPDP Act, we process your data for the purposes you consent to by creating an account, and for the legitimate uses the Act permits.
| Purpose | Examples | Legal basis (GDPR) |
|---|---|---|
| Provide the Service | Create and run your account, send your campaigns, show reports, process payments | Contract |
| Security and abuse prevention | Detect spam, fraud and unauthorised access; review sending activity; enforce our policies | Legitimate interests; legal obligation |
| Support and service messages | Answer questions, send receipts, security alerts and notices about changes | Contract; legitimate interests |
| Improve the Service | Understand which features are used, fix bugs, plan new features (using aggregated data where possible) | Legitimate interests |
| Marketing from us | Product news and tips — you can unsubscribe at any time | Consent or legitimate interests (where the law allows) |
| Legal and financial | Keep tax and accounting records, respond to lawful requests, establish or defend legal claims | Legal obligation; legitimate interests |
We do not use your personal data to make decisions that produce legal or similarly significant effects on you based solely on automated processing.
Email tracking in campaigns
To give our customers campaign reports, emails sent through the Service may contain a tiny tracking image and links that pass through our servers. These record when an email is opened or a link is clicked, together with the IP address, device and email client used, and an approximate location derived from the IP address. Customers can turn open and click tracking off for their campaigns.
This data belongs to the customer who sent the email and is processed on their behalf. Customers are responsible for telling their recipients about tracking where the law requires it.
How we share information
We do not sell, rent or trade personal data, and we do not share it for cross-context behavioural advertising.
We share personal data only with:
- Service providers who help us run the Service under contracts that require them to protect it and use it only for our instructions — for example cloud hosting and storage, email delivery infrastructure, payment processing, bot protection (Google reCAPTCHA on our sign-up form), customer support tools and, when you use AI-assisted features, AI model providers that process the text you submit.
- Services you connect — such as advertising platforms or e-commerce stores — when you instruct us to send data to them.
- Authorities and others where required — to comply with law, a court order or a lawful government request; to enforce our Terms; or to protect the rights, property or safety of our users, the public or us.
- A successor business — if we are involved in a merger, acquisition or sale of assets, subject to this policy continuing to protect your data.
You can request a current list of our sub-processors by emailing privacy@lebx.io.
International transfers
We are based in India and our service providers may process data in other countries. When we transfer personal data out of the European Economic Area, the United Kingdom or Switzerland, we use safeguards recognised by those laws — such as the European Commission's Standard Contractual Clauses and the UK Addendum — or rely on adequacy decisions. Transfers out of India are made in compliance with the DPDP Act and any restrictions notified under it.
How long we keep information
| Data | Retention |
|---|---|
| Account data and Your Content (including contacts you upload) | While your account is active, then deleted within 30 days after closure |
| Backups | Overwritten on a rolling basis, normally within a further 30 days |
| Invoices, payment and tax records | As long as tax and accounting laws require (up to 8 years) |
| Security and access logs | Up to 12 months |
| Support conversations | Up to 3 years after the conversation ends |
| Suppression lists (unsubscribes, complaints, abuse records) | As long as needed to honour opt-outs and prevent abuse |
We may keep data longer where needed to resolve disputes, enforce our agreements or comply with the law.
Security
We use technical and organisational measures appropriate to the risk, including encryption in transit (TLS), hashed passwords, optional two-factor authentication, role-based access with least-privilege for our staff, firewalls, monitoring and regular backups. No system is perfectly secure; if a breach affects your personal data we will notify you and the relevant authorities as the law requires.
Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and receive a copy of it;
- correct inaccurate or incomplete data, and update it;
- erase your data, or restrict or object to certain processing;
- data portability — receive your data in a structured, machine-readable format;
- withdraw consent at any time, where we rely on consent (this does not affect earlier processing);
- grievance redressal and, in India, nominate another person to exercise your rights in the event of death or incapacity;
- complain to a data protection authority — for example your local EU supervisory authority, the UK Information Commissioner's Office, or the Data Protection Board of India.
You can update most account details yourself in the app. For anything else, email privacy@lebx.io. We will verify your identity before acting and respond within 30 days (or sooner where the law requires). We will not discriminate against you for exercising your rights.
California residents: we do not sell or share personal information as those terms are defined in the CCPA/CPRA, and we do not use sensitive personal information for purposes that require an opt-out.
If you received an email sent with Lebx Mail
Our customers send their own emails using the Service, and they decide who to email. If you received one:
- use the unsubscribe link in the email to stop receiving messages from that sender — it takes effect immediately;
- contact the sender directly to access, correct or delete your data — they control it;
- if you can't reach the sender, or believe the email is spam, write to abuse@lebx.io and we will investigate and pass on your request.
Children
The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it. Customers must not use the Service to process children's data without verifiable parental consent where the law requires it.
Emails from us
We send transactional and service emails (such as receipts, security alerts and policy notices) that you cannot opt out of while you have an account. We may also send product news and tips; every such email has an unsubscribe link and you can opt out at any time.
Changes to this policy
We will update this policy when our practices change. If a change is material, we will notify account owners by email or in the app before it takes effect. The "Last updated" date shows the current version.
Contact and Grievance Officer
For privacy questions or requests, email privacy@lebx.io.
In accordance with the Information Technology Act, 2000, the rules made under it and the DPDP Act, 2023, you can reach our Grievance Officer at privacy@lebx.io (subject line: "Grievance"). We acknowledge grievances within 48 hours and aim to resolve them within 30 days.