Privacy policy
Effective 22 October 2026. English is the governing version. This policy is part of the terms of service.
Kist Soluções em Telecom e Energia Ltda (“InboxBro”) provides the InboxBro service. Address: Servidão Carvalho Brasileiro, 90, Carianos, Florianópolis, Santa Catarina, 88047-435, Brazil. Requests about access, correction, or deletion: contact@inboxbro.com.
1. Who decides, and who carries it out
The customer decides to connect a LinkedIn inbox and to use those conversations. For that content, the customer is the controller under the GDPR and the controlador under the LGPD. InboxBro is the processor and the operador. InboxBro follows the customer’s instructions in the terms and in the product. InboxBro does not sell conversation text and does not use it to train InboxBro’s own models.
2. What InboxBro processes
- Account: name, email address, login session, and the workspace the person belongs to.
- LinkedIn connection: a pairing token for the extension, the linked account identifier, and connection status. InboxBro does not ask for or store the LinkedIn password.
- Mirrored inbox: the conversation text, display names, and the suggested reply, so the customer can read and approve it.
- Billing: subscription status received from Stripe. The card number stays at Stripe.
- Support and security: the content of a message the customer sends to InboxBro, and technical logs that do not include conversation text.
A conversation may contain whatever the people in it wrote. That can include an email address or, if someone sends a résumé, an identification number. InboxBro does not ask for health information or payment-card numbers inside the inbox. If those appear in a message, they are stored only as part of that conversation and for the period below.
3. Why
InboxBro processes this information to provide the account, mirror the inbox, prepare a reply, send a reply only after approval, bill the subscription, keep the service secure, and answer the customer. The customer’s instruction is the basis on which InboxBro handles the conversations. Account and billing data are handled to perform the contract with the customer.
4. How long
A mirrored conversation stays while the account is connected, and no longer than 90 days after the last message in that conversation. After the customer disconnects the LinkedIn account, or the subscription ends, InboxBro deletes the mirrored conversations for that account within 15 days. The customer can delete the mirrored conversations immediately from the account page, and InboxBro also deletes sooner when the customer asks. Billing and tax records are kept for the period tax law requires, and those records do not include the conversation text. A deleted conversation may remain in the hosting provider’s backup until that backup is overwritten in the ordinary backup cycle. Backups are not used to operate the inbox.
5. Where it is stored, and who else receives it
The application and the PostgreSQL database run on Render in Oregon, United States. The company that operates the service is in Brazil. Connections to the service use TLS. The database provider encrypts the stored database volumes.
- Render hosts the application and the database in Oregon, United States.
- Stripe processes the payment. InboxBro does not store the card number.
- Email delivery. When a login or service email is sent, the recipient address and the message are handled by the email provider engaged for that delivery. Conversation text is not put in those emails.
- Language model. No language-model provider receives conversation text until that provider is named in this policy. If InboxBro later uses a model to suggest a reply, only the text needed for that suggestion is sent, and only to produce the suggestion.
InboxBro may also disclose information if the law requires it, or to protect the service and its customers against abuse. A customer does not receive another customer’s conversations.
6. Transfers out of the customer’s country
Because the database is in the United States, conversation text leaves the customer’s country. Where the GDPR applies, the customer authorizes this transfer, and the Standard Contractual Clauses adopted by the European Commission in Decision 2021/914, Module Two (controller to processor), are incorporated into the terms for that transfer. The customer also authorizes the subprocessors named in this policy. Customers in Brazil, the United Kingdom, Switzerland, and the United Arab Emirates receive the same description of the path: browser, InboxBro, database in Oregon, and the providers named above.
7. Security
InboxBro limits who can sign in to production systems, does not put conversation text in application logs, and relies on the hosting provider’s access controls and encryption at rest. No method of storage is free of risk. If InboxBro becomes aware of a breach of conversation text that the law requires it to report, InboxBro will notify the customer and the authorities the law names.
8. Requests
A customer may ask for access, correction, export, or deletion at contact@inboxbro.com. A person in a customer’s conversation may write to the same address. InboxBro will tell the customer, because the customer decides about that conversation, and will delete the copy InboxBro holds when the customer instructs it or when the law requires InboxBro to delete it. The customer is responsible for answering the person.
The service is not directed to children, and the customer must not use it to process a child’s information.
9. Changes
InboxBro posts changes on this page and updates the effective date. A material change is notified as the terms describe.
Política de privacidade
Vigência: 22 de outubro de 2026. Se houver diferença, vale a versão em inglês.
A Kist Soluções em Telecom e Energia Ltda presta o serviço InboxBro. Endereço: Servidão Carvalho Brasileiro, 90, Carianos, Florianópolis, Santa Catarina, 88047-435, Brasil. Pedidos de acesso, correção ou exclusão: contact@inboxbro.com.
O cliente decide ligar a caixa do LinkedIn e usar essas conversas. Para esse conteúdo, o cliente é o controlador. O InboxBro é o operador e segue as instruções dos termos e do produto. O texto da conversa não é vendido e não treina modelo do InboxBro.
O InboxBro trata: a conta (nome, e-mail, sessão e espaço); o token de pareamento da extensão e o estado da ligação, sem a senha do LinkedIn; o texto da conversa espelhada, os nomes e a resposta sugerida; o estado da assinatura recebido do Stripe, sem o número do cartão; e logs técnicos, que não incluem o texto da conversa.
A conversa espelhada fica enquanto a conta está ligada, e no máximo 90 dias depois da última mensagem daquele fio. Depois que o cliente desconecta a conta ou a assinatura termina, o InboxBro apaga as conversas espelhadas daquela conta em até 15 dias. O cliente pode apagar as conversas espelhadas na hora, na página da conta, e o InboxBro também apaga antes disso se o cliente pedir. Registros de cobrança exigidos pela lei fiscal não incluem o texto da conversa. Uma conversa apagada pode permanecer na cópia de segurança do provedor até essa cópia ser substituída no ciclo normal. A cópia de segurança não opera a caixa.
O aplicativo e o banco PostgreSQL ficam na Render, em Oregon, nos Estados Unidos. A empresa que opera o serviço está no Brasil. A ligação ao serviço usa TLS, e o provedor criptografa os volumes do banco. Também recebem dados, cada um na sua função: a Stripe, para o pagamento; o provedor de e-mail, quando uma mensagem de acesso é enviada, sem o texto das conversas; e um provedor de modelo de linguagem, somente depois de ser nomeado nesta política, e só com o texto necessário para sugerir a resposta.
O banco nos Estados Unidos significa que o texto sai do país do cliente. Onde o GDPR se aplica, as cláusulas-padrão da Comissão Europeia (Decisão 2021/914, módulo dois) fazem parte dos termos para essa transferência. O cliente autoriza os subprocessadores nomeados aqui.
O cliente pede acesso, correção, exportação ou exclusão em contact@inboxbro.com. A pessoa de uma conversa pode escrever para o mesmo endereço. O InboxBro avisa o cliente, porque a decisão sobre essa conversa é do cliente, e apaga a cópia que guarda quando o cliente determina ou quando a lei exigir. O serviço não se dirige a crianças.