Privacy Policy

1. Who we are

Smart Think Consulting SRL, a company registered in Romania under registration number J40/14677/2008, VAT/tax ID RO24395293, with its registered office at 23 Ceahlaul Street, Bucharest, Romania, is the data controller for the personal data described in this policy, unless stated otherwise below.

You can reach us at hello@maxinbox.io for any question about this policy or your personal data.

2. What data we collect

Account data: name, email address, company name, billing details, authentication data, and usage logs.

Monitoring data (Maxinbox): the brands and competitors you choose to track. The email content we capture comes from mailing lists our own monitoring inboxes subscribe to.

Send data (MaxInbox Send) — processed on behalf of our clients, with us acting as data processor: recipient email address and/or phone number, consent and opt-in records, message content, delivery, open/click events, bounce and complaint events, unsubscribe requests, and suppression list entries.

Technical data: IP address, device and browser information, and cookies strictly necessary for the service to function.

3. Why we process this data

To provide and maintain the service you requested (contract performance, Art. 6(1)(b) GDPR).

To send transactional and marketing emails or SMS through MaxInbox Send, on the instructions of, and under the consent collected by, the client brand that owns the recipient relationship. For that activity we act as a data processor — the client brand is the controller responsible for obtaining valid opt-in consent before any list is imported (Art. 6(1)(a) GDPR, consent obtained by the controller).

To keep our sending infrastructure compliant and protect recipients from unwanted messages, through bounce and complaint suppression and abuse prevention (legitimate interest, Art. 6(1)(f) GDPR).

To bill you, respond to support requests, and secure our systems (contract performance and legitimate interest).

To comply with legal obligations, such as accounting and fraud prevention.

4. How long we keep it

Account data is kept for as long as your account is active, plus up to 5 years afterward for accounting and legal obligations.

Suppression list entries — bounces, complaints, and unsubscribes — are kept indefinitely, even after a sender relationship ends, because their only purpose is to prevent that address from being emailed again. Retaining them is itself a safeguard for the data subject's rights.

Message content and delivery logs are kept for up to 24 months, then deleted or anonymized.

Technical and security logs are kept for up to 12 months.

5. Who we share it with

Amazon Web Services (Amazon SES), region eu-north-1 (Stockholm, EU) — email delivery infrastructure.

Supabase — database hosting.

Vercel Inc. — application hosting.

A payment processor, where applicable, for billing.

We do not sell personal data, and we do not share MaxInbox Send recipient data with anyone other than the client brand that owns that relationship and the infrastructure sub-processors listed above.

6. International transfers

Our primary infrastructure runs in the EU (AWS eu-north-1, Supabase EU region). Where a sub-processor is located outside the EEA, we rely on Standard Contractual Clauses or an equivalent safeguard recognized under GDPR Chapter V.

7. Your rights

Under the GDPR you have the right to access your data, rectify inaccurate data, request erasure, restrict processing, receive your data in a portable format, object to processing based on legitimate interest, and withdraw consent at any time.

If you receive messages through MaxInbox Send, every message includes a one-click unsubscribe link; using it removes you from future sends from that sender.

To exercise any other right, contact hello@maxinbox.io. You can also lodge a complaint with the Romanian supervisory authority (ANSPDCP, www.dataprotection.ro).

8. Security

We use encryption in transit and at rest where applicable, access controls, and SPF/DKIM/DMARC authentication on our sending domains to protect data and prevent abuse.

9. Changes to this policy

We may update this policy from time to time. Material changes will be posted on this page with an updated "last updated" date.

10. Contact

Smart Think Consulting SRL, 23 Ceahlaul Street, Bucharest, Romania — hello@maxinbox.io