Privacy Policy

1. Who we are

InboxConsent ("we") lets you set preferences about which types of marketing emails you want to avoid (e.g. Mother's Day, fertility, bereavement). Participating brands check our service before sending and suppress campaigns that match your preferences.

2. What we collect

• Email address: We use your email to send you a one-time sign-in link (magic link). We may store a normalised version (e.g. lowercase) to display in your account and to link your preferences. We also store a one-way hash of your email (SHA256) which is what brands use to check preferences—they never see your real email.
• Preference data: Your choices (e.g. "block Mother's Day campaigns") are stored and linked to your account. We do not sell this data.

3. Legal basis and purpose

We process your data to provide the preference service and to honour your choices. Our legal basis is your consent and our legitimate interest in operating the service.

4. How long we keep it

We keep your account and preferences until you ask us to delete them. You can delete your data at any time from the dashboard or the data deletion page.

5. Your rights (UK GDPR)

You have the right to:

• Access the data we hold about you
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict processing
• Data portability
• Object to processing

To exercise these rights, use the "Delete my data" flow in the dashboard or contact us. We will respond within one month.

6. Processors

We use Supabase (database and authentication) and Vercel (hosting). They process data on our behalf under contracts that protect your data. We do not transfer your data outside the UK/EEA except where our processors are located and appropriate safeguards apply.

7. Contact

For privacy questions or to exercise your rights, contact us at the address or email on our website.