Privacy Policy

We collect information necessary to provide, secure, improve, and administer our services including Account Information (Full name, business email, login credentials, phone, organization name, domain, billing address, tax info, roles, and subscriptions).

We process organization name, domain, configuration, departments, teams, user accounts, roles, permissions, distribution lists, security policies, and subscription assignments configured by workspace administrators.

We process sender/recipient emails, subjects, body text, attachments, headers, message IDs, delivery timestamps, folder labels, signature preferences, quarantine logs, and SPF/DKIM/DMARC authentication results to deliver and secure your email.

We process SMTP credentials, sending domains, recipient addresses, transaction metadata, IP addresses, authentication results, bounce records, complaint signals, and rate-limit events to maintain relay deliverability and network reliability.

We process subscriber names, email addresses, lists, campaign content, templates, opens, clicks, bounces, complaints, and suppression lists. Customers are responsible for recipient opt-in consent compliance.

Processes event titles, descriptions, dates, timezones, locations, attendees, reminders, recurrence rules, availability, and attached meeting links.

Processes direct messages, channels, attachments, mentions, timestamps, delivery receipts, shared links, and moderation signals.

Processes meeting IDs, participant accounts, session timestamps, device info, connection metadata, and audio/video stream routing. Cloud recordings are stored only when explicitly enabled by administrators.

Processes tasks, descriptions, due dates, priorities, assignees, project tags, and completion tracking.

Processes documents, real-time collaboration edits, comments, version histories, and sharing permissions.

Processes files, folders, metadata, file versions, sharing permissions, and previews. Customer content remains 100% customer-owned.

Processes lead records, contact pipelines, interaction notes, and sales opportunities provided by customer teams.

Processes milestones, project tasks, workflow triggers, actions, and execution logs configured by the customer.

Processes contact cards, job titles, phone numbers, email addresses, and organizational tags synchronized across modules.

Processes notification preferences, device push tokens, and security alert events.

Collects billing addresses, tax IDs, invoice histories, and payment transaction tokens. Full credit card data is securely handled by PCI-compliant payment gateways.

Processes plan codes, duration cycles (Monthly, 1Y–4Y), license counts, minimum commitments, enabled features, and usage limits.

Processes organization entitlements, license pools, system configurations, and administrative audit trails.

Collects IP addresses, login timestamps, failed attempts, device signatures, MFA events, and security tokens to prevent unauthorized access.

Processes SPF, DKIM, DMARC, and MX records to verify domain ownership and enforce anti-spoofing controls.

Automatically logs browser agents, OS versions, approximate IP location, API request latency, and system error events for performance optimization.

Processes API tokens, integration credentials, webhook events, and request/response logs for connected external services.

Maintains tamper-evident logs of logins, role changes, file sharing, billing updates, and administrative configurations.

Used to manage accounts, authenticate users, deliver workspace apps, route emails, process billing, enforce security, validate DNS records, prevent spam, troubleshoot issues, and comply with legal obligations.

AI features (InMind AI) process content solely to fulfill real-time user requests (e.g. Smart Reply, document summaries). Customer content is never sold or used for public advertising model training.

Automated scanning detects malware, phishing links, spoofed headers, and spam to protect mailboxes and maintain IP reputation.

Rely on contractual performance, compliance with legal duties, legitimate security interests, and user consent.

Shared only with trusted infrastructure sub-processors (AWS, Hetzner, Cloudflare, PayPal/Stripe), authorized workspace administrators, or when legally compelled by law enforcement.

Vetted sub-processors operate under strict confidentiality and security agreements.

Data is stored in secure regional data centers with standard contractual clauses (SCCs) and GDPR/CCPA safeguards.

Enforces AES-256 encryption at rest, TLS 1.3 in transit, role-based access control (RBAC), multi-tenant isolation, and rate-limiting.

Stored using salted cryptographic hashes. Users are responsible for credential confidentiality and MFA enforcement.

Retained for active subscription periods plus legal compliance windows.

Upon account cancellation, customer data enters a 30-day grace period, after which all mailboxes, stored files, and backups are permanently purged.

Workspace admins can delete users, files, documents, messages, and campaigns directly within the console.

Uses essential session cookies (`inmail-token`, CSRF tokens) required for authentication and security.

Anonymous telemetry evaluates performance and error rates to maintain uptime reliability.

Transactional and security emails are mandatory; promotional communications include an opt-out link.

Senders must maintain recipient opt-in consent, SPF/DKIM/DMARC records, and bounce rates below 5%.

Inictus is intended for commercial organizations and does not knowingly collect data from children.

Supports rights of access, correction, erasure, portability, and restriction under applicable data protection laws.

Corporate account admins control workspace permissions, data access, and user retention rules.

Submit data requests to support@inictus.com with account verification details.

Inictus notifies affected account administrators within 72 hours of a confirmed security incident.

Material changes will be notified via website announcement or email notice prior to taking effect.

Governed by the applicable legal jurisdiction of Navkar Infotech Services.

• ✓ Customer data remains customer-owned.
• ✓ We do not sell customer business content as a commercial data product.
• ✓ We process data primarily to provide the services customers request.
• ✓ We apply enterprise AES-256 and TLS 1.3 security controls.