Privacy Policy — Boxset.ai

Boxset.ai (“Boxset”, “we”, “us”, or “our”) operates the Boxset.ai platform (the “Service”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

Email address
Name (if provided)
Password (stored securely using industry-standard hashing)
Organization or company name (if provided)

1.2 Mailbox Connection Data

When you connect email mailboxes to the Service, we collect and store:

OAuth tokens (encrypted at rest) for Gmail, Google Workspace, Outlook, and Microsoft 365 accounts
SMTP/IMAP credentials (encrypted at rest) for manually configured mailboxes
Email metadata — sender, recipient, subject lines, timestamps, and delivery status for emails sent or received through the Service
Email content — only processed temporarily for warmup and placement testing; not stored long-term

1.3 Google API Data (Limited Use Disclosure)

When you connect a Gmail or Google Workspace account via OAuth, the Service requests send-only access. That is the complete list:

Send email (gmail.send) — to send warmup emails from your mailbox to mailboxes that Boxset.ai owns, which is what builds your sender reputation
Your email address (openid, userinfo.email) — so we can confirm which account authorized the connection. The gmail.send scope alone cannot tell us that

We do not request read or modify access to your mailbox. The gmail.send scope is write-only: it authorizes Boxset.ai to send a message on your behalf and nothing else. With it we cannot read your email, cannot list or open your messages, cannot mark, star, label or delete anything, and cannot see or touch your spam folder. No warmup mail is delivered into your mailbox.

The only trace warmup leaves in your account is the outgoing message itself, which Gmail files in your Sent folder exactly as it does for any email you send. The engagement that teaches a provider your mail is wanted — opening it, and rescuing it from spam — is performed in the Boxset.ai-owned mailboxes that receive your warmup email. Never in yours.

If instead you connect a mailbox with an app password over IMAP/SMTP, no Google OAuth scope is involved at all.

Boxset.ai's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

1.4 Domain & DNS Data

We collect DNS records (SPF, DKIM, DMARC, MTA-STS, BIMI) for domains you add to the Service. This data is publicly available and queried from public DNS servers.

1.5 Usage Data

We automatically collect standard usage information including IP addresses, browser type, pages visited, and timestamps to improve the Service and for security purposes.

2. How We Use Your Information

We use the information we collect to:

Provide and maintain the Service, including email warmup, deliverability monitoring, and DNS health checks
Send warmup emails and process engagement signals on your behalf
Monitor and improve your email deliverability and sender reputation
Generate deliverability reports and analytics
Communicate with you about your account and Service updates
Detect and prevent fraud, abuse, and security incidents

3. Data Sharing & Disclosure

We do not sell, rent, or trade your personal information. We may share data only in the following circumstances:

Service providers — trusted third parties that help us operate the Service (e.g., cloud hosting, payment processing), bound by confidentiality agreements
Warmup network — email addresses in your warmup pool interact with other Boxset users' mailboxes to simulate organic email engagement. Only warmup-generated content is exchanged; your real email content is never shared
Legal obligations — if required by law, regulation, or valid legal process
Business transfers — in connection with a merger, acquisition, or sale of assets

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All of the categories above exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

4. SMS / Text Messaging

Boxset.ai sends SMS text messages only to people who gave us their own mobile number and checked the SMS consent box themselves. We never text purchased lists and we never send cold outreach.

What we send — email deliverability and sending-reputation alerts, inbox warm-up and account updates, and replies to questions you send us.
How you opt in — enter your mobile number and check the unchecked-by-default consent box on our SMS sign-up page: crm.boxset.ai/sms-opt-in/boxset-ai. Consent is never a condition of buying or receiving any service.
How often — message frequency is low, typically 0-4 messages per month. Message and data rates may apply.
How to stop — reply STOP or UNSUBSCRIBE to any message and we stop immediately; reply HELP, or email [email protected], for help.
Your number — mobile numbers and SMS consent are used only to send the messages described above. They are never sold, rented, or shared with third parties or affiliates for their marketing.

Full SMS terms and consent disclosure: crm.boxset.ai/sms-policy/boxset-ai.

5. Data Security

We implement industry-standard security measures including:

Encryption of sensitive data at rest and in transit (TLS/SSL)
Encrypted storage of OAuth tokens and SMTP/IMAP credentials
Access controls and authentication for all API endpoints
Regular security reviews

6. Data Retention

We retain your data for as long as your account is active. When you delete your account or disconnect a mailbox:

OAuth tokens are revoked and deleted
Stored credentials are permanently removed
Email metadata may be retained in anonymized form for analytics

7. Your Rights

Depending on your jurisdiction, you may have the right to:

Access, correct, or delete your personal data
Revoke OAuth access at any time through your Google/Microsoft account settings
Export your data
Object to or restrict certain processing activities

To exercise these rights, contact us at [email protected].

8. Cookies

We use essential cookies and local storage for authentication and session management. We do not use third-party advertising cookies.

9. Children's Privacy

The Service is not directed to individuals under 18. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the “Last updated” date.

11. Contact Us

If you have questions about this Privacy Policy, please contact us at:

Email: [email protected]
Website: https://boxset.ai