Privacy Policy
Last updated October 25, 2026
InboxFlow is a cold email infrastructure service operated by GSJMedia. This policy explains what information we collect, why we collect it, how we store it, and who we share it with. It covers the InboxFlow web application at inboxflow.gsjmedia.co and the provisioning automations that run behind it.
If you have questions about anything here, email jatin@gsjmedia.co.
What InboxFlow does
InboxFlow provisions and manages cold email sending infrastructure for our customers. When you place an order, we connect domains you own to an email provider (Google Workspace or Microsoft 365), create sending mailboxes on those domains, configure the DNS authentication records those mailboxes need, and connect the results to your sending tool.
To do this, InboxFlow acts on a Google Workspace or Microsoft 365 tenant that you control, using access you explicitly authorize. We only ever operate on tenants and domains that an administrator of that tenant has connected to InboxFlow.
Information we collect
Account information
Your name, email address, company name, and account credentials. We use this to identify you, secure your account, and communicate with you about your orders.
Order and infrastructure information
The domains you ask us to configure, the sender names and usernames used to create mailboxes, the mailboxes we create, their sending configuration, and an audit log of every provisioning action we take on your behalf.
Credentials you authorize
To perform provisioning we store credentials you supply or authorize: OAuth refresh tokens for your email provider tenant, API tokens for your DNS provider, and API keys for your sending tool. We also store the mailbox passwords and two-step verification backup codes generated during provisioning, because you need them to sign in to and reconnect your own mailboxes.
Google Workspace data
When you connect a Google Workspace tenant, InboxFlow requests a specific and limited set of Google API scopes. We request only what provisioning actually requires, and each scope maps to a concrete feature:
| Scope | What we do with it |
|---|---|
admin.directory.domain | Add the domains you ordered to your Workspace tenant, read their verification status, and remove them when you offboard. |
admin.directory.user | Create the sending mailboxes for your order, set their names and profile photos, reset their passwords at your request, and delete them when you offboard. |
admin.directory.user.security | Generate two-step verification backup codes for each mailbox we create, so it can be connected to your sending tool and reconnected later without lockout. |
siteverification | Obtain the DNS TXT proof Google requires for each domain, and submit it to verify that you own the domain. |
These scopes are used solely to provision and manage the infrastructure you ordered. We do not read, index, or process the contents of any mailbox. InboxFlow does not request access to Gmail messages and cannot read your email. We do not use Google user data to develop, improve, or train generalized AI or machine learning models, and we do not sell it, rent it, or use it for advertising.
Limited Use disclosure.InboxFlow's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Microsoft 365 data
Where you connect a Microsoft 365 tenant instead, we use the Microsoft Graph API under an application registration you authorize, for the equivalent purposes: adding and verifying domains, creating and licensing mailboxes, and removing them on offboarding. The same limits apply — we do not read mailbox contents.
How we store and protect information
- Application data is stored in Supabase (managed PostgreSQL), with row-level security so each customer can read only their own records.
- Credentials and provider tokens are stored server-side, are never exposed to the browser or to other customers, and are used only to call the corresponding provider on your behalf.
- All traffic to and from InboxFlow is encrypted in transit over HTTPS.
- Administrative access to production data is limited to GSJMedia staff who need it to operate the service.
No system is perfectly secure and we cannot guarantee absolute security. If we become aware of a breach affecting your data, we will notify you.
Who we share information with
We do not sell your information. We share it only with the service providers required to deliver InboxFlow, and only to the extent needed:
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication, and storage |
| Vercel | Application hosting |
| Google / Microsoft | The email provider tenant you connected |
| Cloudflare | DNS record management for your domains |
| Your sending tool | Connecting mailboxes to Instantly, Smartlead, or similar, at your direction |
We may also disclose information where required by law, or to protect the rights, safety, and property of GSJMedia, our customers, or the public.
Cookies and ad measurement
We use the Meta Pixel and Meta's Conversions API to measure our advertising: page views, sign-ups, checkouts started and purchases, sent with a hashed email address, a hashed account ID, your IP address and browser details so Meta can match them to an ad you saw. We do not send the contents of your orders, mailboxes or credentials.
If you visit from the European Economic Area, the United Kingdom or Switzerland, none of this happens unless you accept the cookie banner. You can change your mind at any time by clearing the if_consent cookie for this site, which brings the banner back.
Retention and deletion
We keep account and order information for as long as your account is active, and for a reasonable period afterwards to meet legal, accounting, and dispute-resolution obligations.
Provider credentials are retained while your tenant remains connected to InboxFlow. You can have them removed at any point: revoke InboxFlow's access in your provider's admin console, then email us to purge the stored refresh tokens, API keys, mailbox passwords, and backup codes. We action those requests promptly.
You can request deletion at any time by emailing jatin@gsjmedia.co. Deleting InboxFlow records does not delete mailboxes or domains inside your own Workspace or Microsoft 365 tenant — those remain under your control.
Revoking access
You can revoke InboxFlow's access to your Google Workspace tenant at any time, without involving us, from your Google Account permissions page or by removing InboxFlow from the connected-apps list in your Google Admin console. Revoking access immediately stops all further provisioning on that tenant.
Your rights
Depending on where you live, you may have the right to access, correct, export, or delete the personal information we hold about you, and to object to or restrict certain processing. Email jatin@gsjmedia.co and we will respond within a reasonable period.
Children
InboxFlow is a business service and is not directed at anyone under 18. We do not knowingly collect information from children.
Changes to this policy
We may update this policy as the service changes. When we do, we revise the last-updated date at the top of this page. Material changes affecting how we handle Google user data will be communicated to affected customers by email.
Contact
GSJMedia — jatin@gsjmedia.co
gsjmedia.co