inbox.ky — Privacy Policy
Last updated: 8 June 2026
This Privacy Policy explains how INBOX.KY Ltd. (a Cayman Islands company),
trading as inbox.ky (“inbox.ky”, “we”, “us”, “our”), collects, uses,
shares, and protects personal data when you use our website at inbox.ky and our
email services (together, the “Service”).
We are the data controller for the personal data described here.
Our promise, in plain words: inbox.ky is owned and run in the Cayman Islands. We do not read your mail for advertising, we do not profile you, and we never sell your personal data. You are our customer — not our product.
1. Who we are & how to contact us
- Controller: INBOX.KY Ltd., 65 Garvin Road, West Bay, Grand Cayman, Cayman Islands, Cayman Islands.
- Privacy / data-protection contact:
privacy@inbox.ky(ordpo@inbox.ky). - General:
hello@inbox.ky· +1 345-233-6978.
2. Scope
This policy covers (a) the marketing & reservation website at inbox.ky, and
(b) the email services (address forwarding, mailboxes, and business
communications) once launched. Some sections apply only once paid services are
live; these are noted.
3. The personal data we collect
(a) When you reserve a name (live now):
- the handle you request (the part before
@inbox.ky); - your contact email address;
- the tier you selected;
- a timestamp, the referring page, and any UTM campaign parameters;
- a one-way hashed (SHA-256) form of your IP address and your browser’s user- agent string, used only for abuse-prevention. We do not store your raw IP address with reservations.
(b) When you hold an account / use the email service (future):
- account and profile details (name, login credentials held in hashed/secured form, the forwarding destination address you choose);
- billing information — processed by our payment provider; we receive limited records (e.g. plan, status, last 4 digits), not full card numbers;
- email content and metadata that passes through, is forwarded by, or is stored in your mailbox, strictly to deliver the Service;
- support correspondence and service logs.
(c) Automatically, on the website:
- essential first-party data (cookieless session storage) needed to serve and measure the site;
- with your consent only, analytics and marketing-measurement tools — Google Analytics 4 (anonymised IP), Microsoft Clarity (usage analytics including session recordings), and the Meta (Facebook) Pixel (marketing conversion measurement) — which load only if you Accept our cookie banner. See the Cookie Policy.
4. Why we use it, and our lawful bases
| Purpose | Lawful basis (GDPR / Cayman DPA) |
|---|---|
| Take and manage your reservation; tell you when you can claim it | Performance of a contract / steps prior to a contract; your consent |
| Provide, operate, forward, store, and secure your email | Performance of a contract |
| Prevent abuse, spam, fraud; enforce our policies | Legitimate interests (running a safe service) |
| Send service/transactional emails (e.g. confirmations) | Performance of a contract |
| Send optional marketing about inbox.ky | Your consent (withdrawable anytime) |
| Comply with law and respond to lawful requests | Legal obligation |
| Take payment and keep financial records | Performance of a contract / legal obligation |
We do not use the content of your email to build advertising profiles, and we do not sell or rent your personal data to anyone. Automated spam and malware filtering is operational security only — it is not used to profile you.
5. Email content & confidentiality
To run a forwarding or mailbox service we necessarily transmit, route, and (for the Mailbox tier) store your email. We treat its content as confidential. We access it only where strictly necessary to provide or troubleshoot the Service at your request, to protect the Service’s security, or where required by law. We do not disclose its content except as set out in Section 7.
6. How long we keep it (retention)
- Reservations: kept while the launch waitlist is active and for a reasonable period afterwards, then deleted or anonymised. If you ask us to delete your reservation sooner, we will.
- Account & email data: kept for the life of your account and a limited period after closure to allow recovery, handle disputes, and meet legal/accounting duties, then deleted.
- Logs & abuse signals: kept only as long as needed for security and legal purposes.
7. Who we share it with
We share personal data only with:
- Service providers (subprocessors) who help us run the Service, under contract and only on our instructions (see Section 8);
- Payment providers to process payments (once paid plans launch);
- Authorities / third parties where we are legally required to, or to protect rights, safety, and the integrity of the Service, or in connection with a merger or business transfer.
We never sell your personal data and we do not share it for third-party advertising.
8. Subprocessors (third-party providers)
We currently rely on the following providers. This list will be kept up to date; the email-delivery backend is being finalised.
| Provider | Purpose | Where |
|---|---|---|
| Netlify | Website hosting and reservation data store | US/global |
| Brevo (Sendinblue) | Sending transactional/confirmation email | EU |
| Cloudflare | Bot-protection challenge (Turnstile), if enabled | US/global |
| Google (Analytics 4) | Website analytics — only with consent | US/global |
| Microsoft (Clarity) | Website analytics + session recordings — only with consent | US/global |
| Meta (Facebook Pixel + Conversions API) | Marketing conversion measurement (incl. server-side, with a hashed email) — only with consent | US/global |
We will add our email-delivery backend and payment provider to this list when the paid email services launch.
9. International transfers
inbox.ky is operated from the Cayman Islands, and some providers above process data outside the Cayman Islands (including the EU and US). Where we transfer personal data internationally, we use appropriate safeguards (such as contractual protections / Standard Contractual Clauses and provider compliance commitments) consistent with the Cayman DPA 2017 and, where applicable, the GDPR/UK GDPR.
10. Security
We protect personal data with measures including encryption in transit (TLS), access controls, one-way hashing of IP addresses for reservations, hashed credentials, and least-privilege internal access. No system is perfectly secure, but we work to protect your data and will notify you and the relevant authority of a qualifying personal-data breach as required by law.
11. Your rights
Under the Cayman Islands Data Protection Act, 2017, you have rights to: be informed about how we use your data; access your data; have inaccurate data corrected; require us to stop processing that is likely to cause unwarranted damage or distress; stop processing for direct marketing; and require correction, blocking, erasure, or destruction of data in certain cases. You may complain to the Office of the Ombudsman (Cayman Islands).
If you are in the EU/EEA or UK, under the GDPR / UK GDPR you also have rights to: access; rectification; erasure (“right to be forgotten”); restriction of processing; data portability; objection to processing; and to withdraw consent at any time. You may complain to your local supervisory authority (in the UK, the ICO).
To exercise any right, email privacy@inbox.ky. We will respond within the time
limits set by applicable law. Exercising your rights is free unless a request is
manifestly unfounded or excessive.
12. Marketing
We only send marketing email if you opt in, and every marketing email has an unsubscribe link. Opting out of marketing does not stop essential service emails (e.g. security or billing notices).
13. Children
The Service is intended for adults and is not directed at children under 16 (or the age of digital consent in your jurisdiction). We do not knowingly collect their data; contact us if you believe a child has provided us data.
14. Cookies & tracking
We use no advertising or third-party tracking cookies. See the Cookie Policy.
15. Changes
We may update this policy. We will post the new version here and update the date; material changes will be communicated where appropriate.
16. Complaints
Contact us first at privacy@inbox.ky — we want to put things right. You also
have the right to complain to the Office of the Ombudsman (Cayman Islands) or,
if applicable, your EU/UK supervisory authority.
Questions? privacy@inbox.ky · INBOX.KY Ltd., 65 Garvin Road, West Bay, Grand Cayman, Cayman Islands