Privacy Policy

Inboxa is a product of Tejviq Technology, New Delhi, India ("Inboxa", "we", "us"). This policy covers the Inboxa website, the Inboxa studio and its Instagram DM automation.

For the personal data that runs your account (your sign-in, your account and settings, the records of what you agree to and upload, and, while you allow it, how you use Inboxa), we are the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (the DPDP Act): we decide why and how it is used, as this policy says.

For the content you bring to Inboxa and your customers' data (the people in the photos you upload, and the people who comment on or message the accounts you connect), you decide what is collected and why, and Inboxa processes it only for you, on your instructions, as your Data Processor. You are responsible for having the right to give it to us, and for telling those people how you use their data (see our Terms of Use).

When you sign up, we ask for your consent to use your personal data as this policy describes. You can withdraw it at any time (see Your rights).

This policy is published under the Information Technology Act, 2000 and its rules, and is our notice under the DPDP Act.

It is written in English. To read it in Hindi or another language of the Eighth Schedule to the Constitution, write to support@inboxa.in and we will send it to you.

Each item below says why we need it. From your Google account, when you sign in: your name, email address and profile picture, to create your account and know it is you. We never see your Google password.

• Your business: your website address, what we read from your public website when you ask us to (your brand's name, logo, colours, fonts, headings and products), and your answers to our questions about your goals, audience and what makes you different, to plan and make content that fits your brand.
• What you upload: product photos, logos, photos of people, pets or places for templates, and screenshots you send with feedback, to make your creations from them and answer you. Before your first upload, you confirm that you own what you upload or have permission to use it, including from the people in it.
• What you make: posts, carousels, reels, storyboards, campaigns, captions and voiceovers, the choices you make for them, and your chats with Iba, our assistant, so you can keep, change and download your work.
• Your Instagram account, when you connect it: its account ID, username and profile picture, and the access token Meta gives us to act for it, which we keep encrypted, to run your DM automations. To show you how your account is doing, we read your bio, the link in it and your posts' captions, likes and comments when you open Inboxa, and keep one row a day of your account's follower, following and post counts, deleted when you disconnect Instagram and after 400 days. When Iba checks your Instagram (once a week on a paid plan, or when you ask), she also looks at your latest posts' pictures to say whether your grid has one look; the pictures are not kept. What each check found (your score, why your best post worked, with the first line of its caption, the week's suggestions and Iba's short read of your grid) is kept so it stays the same until the next check, and deleted when you disconnect Instagram and after 400 days. We keep no one else's data for this.
• DM automation: the posts and reels you set it on, the keywords and messages you write, and the leads it collects. For each lead we keep their public Instagram username, a one-way code made from their Instagram ID (never the ID itself), the keyword they commented, when each step happened, and an email address only if they choose to share one, to run the automation and show you your leads. We read comments and messages to answer them, but do not keep their text.
• Your account: your credits and what used them, your settings, and the feedback you send us, to run your account and answer you.
• If you buy a plan: which plan, when each month of it starts and ends, what you paid and when, whether each payment went through, and Razorpay's references for your plan and payments, to give you the plan, answer you about a payment and keep the records tax law asks for. Razorpay takes the payment itself, and we never see your card number, UPI PIN or bank login.
• Inboxa Partners, if you apply to be a partner: the code you choose, where you will talk about Inboxa, the size of your audience, what you write about how, and that you agreed to the Partner Terms, to decide on your application and run your partnership; what you earn, and the transfers you ask for and are paid, with the bank's reference for each. Before your first transfer, we ask you by email for your PAN and your bank or UPI details, to pay you and deduct tax as the law requires.
• If a partner sent you: which partner's link or code you joined through, or whose code you gave at checkout, how you gave it (a link, a code at sign-up or a code at checkout), and what you pay for Inboxa and when, to pay that partner their share of what you pay. The partner never learns who you are: they see only how many people visited, signed up and pay through them, that someone gave their code at checkout and when, and what that earns them. Visits to a partner's link are counted by day, with no address, device or person kept.
• Records of what you agree to and upload: each box you tick or untick, with its words, and each file you upload, with its size, type and fingerprint, each with its date and time and the version of our Terms of Use in force, to show what was agreed and given (see Records we keep as proof).
• To keep free use fair: a random identifier for your device, and a one-way code made from your IP address. We do not keep your IP address itself.
• How you use Inboxa, if you allow analytics in Cookie settings: which pages you open, which features you use and what you make, to learn what works and improve Inboxa. While "Help improve Inboxa" is on in Settings it is linked to your account; with it off, or when you are not signed in, it is kept with only a random number for your browser tab, never with your account. With the same yes, Google Analytics counts the pages you open, without your name, email address or account (see our Cookie Policy).

We do not ask for sensitive personal data such as health, financial account or government ID details. Please do not upload it.

• To run Inboxa for you: read your website, plan your content, make the pictures, reels and voiceovers you ask for, and run your DM automations.
• To keep your account working: sign-in, credits, your saved work and your settings.
• To keep Inboxa safe: check requests against our content rules, prevent abuse and fraud, and protect your account.
• To answer you when you write to us, and to tell you about changes to Inboxa or to these documents.
• To learn what works and improve Inboxa: we keep a record of what was made, how it was made, and whether you liked it.
• To learn your brand's taste, only if you let Iba: which of our looks, fonts, logo spots, reel templates and voices you pick, keep and like, kept with that company's work in your account, so new posts and reels start the way you usually make them. Turning it off in Settings forgets them.
• To show what you agreed to and what you uploaded, and when, if a question, complaint or legal claim about it arises.
• To meet our obligations under Indian law.

We do not sell your personal data, show you advertising from others, or use your customers' data for our own marketing.

Inboxa keeps a record each time you:

• Tick or untick a box that gives or withdraws your consent or confirms your rights: at sign-up, before your first upload, under the photos you add to a remix or a reel, in Erase, when Studio asks whether Iba may learn your brand's taste, the switches in Settings, and your cookie choices. The record holds your account, the box, your answer, the exact words beside it in the language you read them in, the photo and look it was for where there was one, the version of our Terms of Use in force, when you gave it and when our server received it.
• Upload a file to your account: a photo, a logo or a screenshot. The record holds your account, where the file is kept, its size and type, a fingerprint of its contents, the version of our Terms of Use in force, and when it was stored, by our storage's clock.

We do not record your IP address or your location in them.

Each record is fingerprinted with a SHA-256 hash when it is written, so it can be shown that it has not changed since. Records are never edited: the only thing ever added to one is the date your account closed.

We use them only to show what was agreed and given, and when: if you, a person in a photo, a rights holder, a court or an authority raises a question, complaint or claim about content on Inboxa, and to show that we had your consent. We share them only for that, and only what bears on it (see Who we share it with).

They are kept apart from your other data, where only our servers can read them, while your account is open and for 3 years after it closes: the time within which most claims about content or a contract can be brought in India. Then they are deleted, unless a claim, an investigation or the law still needs them.

Deleting your account, or asking us to erase your data, does not delete them before then, because they exist to show what happened. You can ask us for a copy of the records about you at any time.

Inboxa makes pictures, reels, voiceovers and words with AI services run by other companies, which may process data outside India. To make what you ask for, we send them only what it needs: your request and choices, the photos you add, and your brand's details.

Each service processes it under its own terms and safeguards. A list of the service providers we use is available on request at support@inboxa.in.

We do not train AI models on your content or your customers' data.

AI can get things wrong. Check every creation before you publish it, especially names, prices and claims.

You connect Instagram through Instagram's own login, so we never see your Instagram password. Meta gives us an access token for the permissions you approve: to read your account's profile and posts, receive comments on them, and send messages from your account.

DM automation answers only people who comment your keyword on the posts and reels you choose, within the limits Instagram sets. It does not message anyone who has not commented.

We use Instagram data only to run your automations, show you your leads, and show you how your own account is doing. We do not sell it, give it to data brokers, share it with another Inboxa customer, use it for advertising, or use it to train AI models.

For the people who comment, you are responsible for telling them how their data is used and for answering their requests. We help: you can delete a lead in Inboxa, and anyone can write to support@inboxa.in to have their data deleted (see Deleting your data).

We share personal data only with those who help us run Inboxa, and only what each of them needs:

• Google, to sign you in, and, if you allow analytics in Cookie settings, to count how Inboxa is used (Google Analytics).
• Meta, to connect your Instagram account and send your automated messages.
• Razorpay, to take the payments for paid plans.
• Our hosting, database and storage providers, which keep Inboxa and your data running.
• The AI services that make your creations (see AI services).
• When we read your website, the public services that help us find its logo, fonts and earlier versions, which receive only its address.
• Authorities, when Indian law requires it or a court orders it.
• When a complaint or legal claim is made about content you uploaded or made, those who must decide or answer it (a court, an authority, the person who complained, or our legal advisers): only the records that bear on it, and only as far as the law allows.
• A company that takes over or merges with Tejviq Technology, which would be bound by this policy for the data it receives.

Each may use the data only for the purpose we give it.

Your data is stored with our hosting and database providers, which may keep it on servers outside India. We transfer personal data only where the DPDP Act allows, and only to providers bound to protect it.

• Everything Inboxa sends and receives is encrypted in transit (HTTPS).
• Access rules in our database let each account reach only its own data.
• Instagram access tokens are encrypted, and they and our service keys stay on our servers, never sent to your browser.
• Within our team, only those who need it to run and support Inboxa can see personal data.

If a breach of personal data happens, we will tell you without delay what happened and when, what data it touched, what it may mean for you, what we are doing about it and what you can do, and report it to the Data Protection Board of India and to CERT-In as the law requires.

No system is completely secure. If you think your account has been misused, write to us straight away.

We keep your data while your account is open, and only as long as we need it for the purposes above.

• When you delete your account, it is deleted at once with your leads, automations, the photos you uploaded and the files you made, and Instagram is disconnected. Anything that could not be removed straight away is removed within 30 days.
• The details you signed up with (your name, your email address, and when you joined and left) and the records we keep as proof are kept for 3 years after your account is closed, and then deleted. India's IT Rules ask for sign-up details to be kept for at least 180 days; we keep them as long as the records, which would name no one without them.
• With them we keep how many of the beta's free credits the account had used. If you open a new account with the same email while they are kept, its free credits carry on from there rather than starting again.
• Copies we make along the way, such as a photo sent with a request or a video before it is finished, are deleted within 30 days.
• When you disconnect Instagram, or remove Inboxa in your Instagram app's settings, we delete its connection and its access token. If you ask Meta to have the data Inboxa received from Instagram deleted, we also delete the leads it collected, and give you a confirmation code.
• Content we remove because of a complaint or an order is kept, out of use, for 180 days, or longer if a court or an authority asks, as India's IT Rules require.
• If you are a partner, your application and partnership are deleted with your account, and payout and tax records, once there are any, are kept for as long as tax law asks. Which partner sent an account, and a partner's code it gave at checkout, are kept with that account and deleted with it; a payment already counted for that partner stays as an amount and a date, and a code given at checkout as a date, with no account.
• If you buy a plan, the record of each payment (which plan, what was paid and when) is kept for as long as tax law asks, also after your account is closed.
• Each email has one free plan. So that a new account with the same email does not start it again, the free plan's monthly counts of Instagram DMs and photo tool images are kept under a one-way code made from your email, never the email itself, and hold only numbers. With the details you signed up with, they also decide what free credits and free first post a new account with the same email gets.
• Other records the law asks us to keep, such as logs, are kept for as long as it asks.

Under the DPDP Act, you can:

• Ask for a summary of the personal data we hold about you, how we use it, and who we have shared it with.
• Correct, complete or update it. Most of it you can change yourself in Inboxa.
• Have it erased: delete your account in Settings, or ask us. The records we keep as proof are the exception: they are kept for the time that section gives.
• Withdraw your consent at any time: turn off Personal data processing in Settings (this pauses your DM automations), turn off Help improve Inboxa, or write to us. We then stop the processing it allowed, and the parts of Inboxa that need it may stop working. Withdrawing does not undo what was lawfully done before.
• Nominate someone to act for you if you die or become unable to act.
• Complain to us, and, if you are not satisfied with our answer, to the Data Protection Board of India.

Write to support@inboxa.in from the email address you sign in with. We may ask you to confirm it is you, and we complete your request within 30 days.

You can delete your data at any time:

• Your whole account: in Inboxa, open Settings and choose Delete account permanently. This deletes your account, leads, automations, uploads and the files you made at once, disconnects Instagram and cancels your plan. Only the details you signed up with and the records we keep as proof stay, for 3 years (see How long we keep it).
• Instagram only: in Inboxa, open Settings and choose Disconnect next to your Instagram account, or remove Inboxa in your Instagram app, under Settings, Apps and websites. Either way, its connection and access token are deleted.
• Anything else, or if you cannot sign in: write to support@inboxa.in with the subject "Delete my data". We confirm it and complete it within 30 days.

If you commented on or messaged a business that uses Inboxa and want your data deleted, write to support@inboxa.in with your Instagram username and the business's name. We delete it, or pass your request to the business, within 30 days.

Our Cookie Policy lists every cookie and every kind of storage Inboxa uses, and how to change your choice.

Inboxa does not use advertising cookies, and no tracker follows you to other sites. Counting how Inboxa is used, by our own count and by Google Analytics, and Google's sign-in suggestion, stay off until you allow them in Cookie settings.

We set a few cookies of our own: one that recognises your device, so free use is counted fairly (it lasts a year), and short-lived ones that keep connecting Instagram secure.

Your browser keeps your sign-in, your work in progress and your choices, such as light or dark, in its local storage. Clearing your browser's data for Inboxa removes them from that browser.

If you follow a partner's link, your browser remembers that partner's code for 60 days, so an account you make in it is counted as theirs.

While you are signed in, your work in progress is also kept with your account, so you find the same work on every device you sign in on. Logging out removes it from that browser once your account has all of it, and deleting your account deletes it.

Our pages load their fonts from Google Fonts, which sees your IP address in order to send them.

Inboxa is for businesses and professionals aged 18 or over. We do not knowingly collect personal data of anyone under 18. If you believe a child has used Inboxa, write to support@inboxa.in and we will delete their data.

When we change this policy in a way that matters, we will tell you by email or in Inboxa at least 14 days before the change takes effect. The date at the top of this page shows when it last changed.

The changes of 6 October 2026, for paid plans, apply to you when you buy one.

Questions, requests and complaints about your personal data go to our Grievance Officer, Amit Chakraborty, at support@inboxa.in, Tejviq Technology, New Delhi, India. We acknowledge a complaint within 24 hours and resolve it within 7 days, and complete a request about your data within 30 days.

If our answer does not resolve your complaint, you can complain to the Data Protection Board of India.