Privacy Policy

1. Who we are and what this policy covers

Box MailLogic ("Box" or the "Service") is provided by Dux Systems, Inc., a Delaware corporation, which operates the MailLogic and Box MailLogic brands ("MailLogic", "we", "us" or "our"). This Privacy Policy explains how we collect, use, share and protect information when you use Box: its webmail, Console, REST API and webhooks, MCP server, and the websites at which we offer them.

This policy applies to Box only. MailLogic's email forwarding and SMTP service at maillogic.io has its own privacy policy, which does not apply to Box.

It covers our customers, the people who sign in to Box, and people who are not our customers but whose information we process because they email a Box mailbox, receive email from one, or contact us.

2. Information we collect

Account and sign-in information

Your email address, which you use to sign in with a one-time code or link. If you sign in with Google, we receive your email address and the basic profile information Google shares, such as your name. We also keep sign-in records, such as when you signed in. When an account is created, we record the IP address the request came from and the result of the checks described in section 5.

Account configuration

The domains and mailboxes you add, mailbox display names, the results of our checks of your domains' DNS records, your API keys (we keep a secure hash, not the key itself), webhook settings, and the apps you have authorized and the permissions you granted them.

Email content and metadata

The email your mailboxes receive, send and store, including message bodies, attachments and drafts, and their metadata: headers, sender and recipient addresses, subject lines, dates, sizes, folders, read state, and the results of authentication (SPF, DKIM, DMARC) and spam checks. This includes information about the people you correspond with.

Delivery and event records

Records of mail Box receives and sends: envelope sender and recipient addresses, the IP addresses of the mail servers and of the API or MCP client involved, timestamps and delivery status. Your account's event history, which its webhooks and the events API deliver to you, also includes the sender and subject of received messages.

Billing information

If you subscribe to Plus, Stripe processes your payment. We receive and keep your plan, subscription status, billing dates, and Stripe's identifiers for you and your subscription. We do not receive or store your full card number.

Usage information and technical logs

How much of your plan you use (mailboxes, domains, storage and sent emails), API and MCP request counts used for rate limits, and technical logs of the Service's operation, which can include IP addresses, email addresses, request paths, error details and audit records of changes to your account.

Communications

What you send us when you contact support or use the Contact Sales form: your name, email address, company and message.

3. How we use information

We use information only to:

• provide the Service: receive, deliver, store, display and search your email, run webmail, the Console, the API and the MCP server, and give the access you choose to the apps you authorize;
• authenticate you and keep your account and credentials secure;
• verify your domains and check their DNS records;
• protect you, other customers, email recipients and the Service: filter spam and malicious mail, detect and prevent abuse and fraud, enforce limits, and investigate security incidents;
• manage your plan, process payments and keep billing records;
• operate, monitor, back up, troubleshoot and improve the reliability of the Service;
• communicate with you about your account, the Service and changes to our terms, and answer your requests;
• comply with the law and enforce our Terms of Service.

We do not use your email content for advertising, to build marketing profiles, or to train artificial intelligence or machine-learning models.

4. Confidentiality of your email

We treat the confidentiality of your email as a priority.

• We do not routinely read your email. Reviewing the content of customers' email is not part of how we normally operate the Service, and MailLogic personnel do not read it as part of routine operations.
• Your email is processed automatically. Software processes your email as needed to receive, deliver, store, display, search and protect it, and to give the access you choose through webmail, the API, MCP and webhooks. Automated spam, security and abuse filtering (section 5) is part of that processing; it is not the only processing your email goes through.
• Human access is exceptional. A person at MailLogic may access the content of your email only in narrow circumstances: when you ask us to, for example to help with a support request, and only as far as needed; when needed to investigate or respond to a serious security incident, or a specific report of abuse, affecting the Service or its users; or when required by a valid legal obligation (section 10). Such access is limited to authorized personnel and to what the situation requires.

Box's encryption keys are managed by MailLogic, and Box is not end-to-end encrypted (section 6). Our systems, and the administrators who operate them, are therefore technically able to access stored email. The commitments above are how we limit that access in practice; they do not mean that access is technically impossible.

5. Spam, security and abuse detection

Incoming mail is checked automatically when it arrives by the spam filter built into Stalwart, the open-source mail server software Box runs on. The filter applies rules to the message and its sending server, verifies SPF, DKIM, DMARC and ARC, and scores the message. Box then accepts the message, places it in Junk, or refuses it, according to that score and those checks. Box also refuses mail whose sender cannot be authenticated.

Some of these checks query outside reputation services, sending them limited information:

• the IP address of the sending server, and domain names from the message, including those of links in it, are looked up in public DNS-based reputation lists; and
• a digest (a short fingerprint) of the message body is checked against Pyzor, a public collaborative spam database. The digest cannot be used to reconstruct the message.

Outgoing mail is subject to sending limits and automated checks to prevent spam, phishing and other abuse, including checks of sending patterns and of the links and attachments in outgoing messages. When we add a domain, we also check its name against a domain reputation list.

When a new account is created, we check the IP address the request comes from. We look up its reputation with AbuseIPDB, an IP address reputation service, which receives only the IP address, and we count the accounts recently created from the same network. We may refuse to create an account from an address with a strong recent record of abuse, or from a network from which several accounts were created recently. These checks do not take into account the type of network, such as a VPN or a mobile network, or its country, and they apply only when an account is created, never when you sign in to an existing one.

These checks are automated. They do not use artificial intelligence or machine-learning models, and they do not involve a person reading your email. We record their results, such as scores, the names of the rules that matched and the action taken, rather than the content they examined. A person at MailLogic may review those results, and may access email content only in the circumstances described in section 4.

6. Encryption and security

• Encryption at rest. Mailboxes, including messages and attachments, and the Service's database are stored on encrypted disk volumes. The keys that unlock those volumes are themselves encrypted with a cloud key management service.
• Encrypted backups. Backups are encrypted before they leave our servers and are stored encrypted.
• Encryption in transit. Connections to Box's websites, webmail, Console, REST API and MCP server use HTTPS (TLS). Our network provider, Cloudflare, terminates these connections and forwards them to our servers over a separate encrypted connection.
• Email between mail servers. Box offers and uses TLS encryption when exchanging email with other mail servers. Whether a particular message is encrypted in transit also depends on the other server: if it does not support TLS, email may travel between that server and Box without encryption. After email leaves Box, its protection depends on the recipients' providers.
• Service-managed keys, not end-to-end encryption. MailLogic manages the encryption keys for stored data. Box does not currently offer end-to-end encryption, in which only you would hold the keys.
• Access controls. Administrative access to Box's systems is limited to authorized personnel. Customer credentials are scoped: each API key and authorized app can use only the permissions you granted it, and API keys are stored as secure hashes.
• Logs. Our logs are designed to record operational events, not the bodies or attachments of messages. Some records include metadata, such as email addresses, the subjects of received messages, IP addresses and delivery results.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident that affects your personal information, we will notify you and the authorities as required by applicable law.

7. AI assistants and other apps you authorize

Box is designed to work with AI assistants and other software. Webmail, the REST API and the MCP server all access the same mailboxes.

• An AI assistant, such as Claude or ChatGPT, or another app can access your Box account only after you authorize it on Box's authorization page, and only with the permissions you grant there, such as reading mail or sending it, for one mailbox or for all. Your own scripts and integrations use API keys you create, with the permissions you choose.
• When an app you have authorized uses its access, Box gives it the data its permissions allow, which can include the content of your email and attachments.
• You can see and revoke authorized apps and API keys at any time in the Console. Revoking access stops further access through Box; it does not delete data the app already received.
• AI assistants and other third-party apps are operated by their own providers, not by MailLogic. Data you let them receive from Box is handled under their own terms and privacy policies, including any use of it to train models. Please review those policies before you connect an app.
• Box enforces the permissions you grant, but whether an app asks you to confirm before it acts, for example before it sends email, depends on that app.

8. How we share information

We do not sell your personal information or your email content, to advertisers, data brokers or anyone else, and we do not share it for advertising. We do not treat your email as a product to be monetized.

We share information only:

• As you direct. Email you send goes to its recipients and their mail providers; data goes to the apps you authorize and to the webhook addresses you configure.
• With our service providers, who process it on our behalf and only as needed to operate the Service (section 9).
• With outside reputation services, in the limited form described in section 5.
• For legal reasons, as described in section 10.
• In a business transfer. If MailLogic is involved in a merger, acquisition, reorganization or sale of assets, information may be transferred as part of it, subject to this policy's protections.

9. Service providers

We use the following providers to operate Box:

We may add or replace providers as the Service changes, and will update this list when we do. Google sign-in, Stripe Checkout and your DNS provider, when you use them, also have their own privacy policies.

10. Legal requests

MailLogic does not voluntarily disclose customers' private email to government authorities without a valid legal basis. We may disclose information:

• when required to by valid legal process, such as a court order, warrant, subpoena or equivalent;
• when otherwise required or permitted by applicable law, including where we believe in good faith that disclosure is necessary to prevent an imminent risk of death or serious physical harm; and
• to protect the rights, safety and security of our customers, the public, the Service or MailLogic, as permitted by law.

We evaluate each legal request, may challenge requests we believe are invalid or overbroad, and, where practicable, limit what we disclose to what is legally required. Where the law permits, and unless doing so would be futile, create a risk of harm, or concern an emergency, we will notify the affected customer of a request for their information before disclosing it.

11. Retention and deletion

• Email stays in your mailboxes until you delete it. Messages in Trash and Junk may be deleted automatically after a period of time. Permanently deleting a message, emptying Trash, or deleting a mailbox removes that mail from Box's mail servers.
• Account information is kept while your account exists. You can delete your mailboxes, domains, API keys and authorized apps yourself in the Console, and ask us to close your account (section 13).
• Event history that names a message's sender and subject is kept while the message exists; when the message is permanently deleted, or its mailbox is deleted, those details are removed from it.
• Records we keep after deletion. We keep delivery records (envelope addresses, IP addresses, timestamps and delivery results), audit records and records of abuse decisions after the related mail, mailbox or account is deleted, to protect the Service, prevent abuse, and meet legal and accounting obligations. We keep billing records for as long as tax and accounting law requires.
• Account-creation checks. The record of the network an account was created from, and of the checks' results, is deleted after 31 days. IP address reputation results are deleted after 24 hours. An encrypted copy of the IP address, which only these checks can read, is attached to a new account until its first sign-in, which removes it.
• Logs are kept for a limited period and then deleted.
• Backups. Deleted data can remain in our encrypted backups until those backups are replaced in the normal course of our backup schedule.

12. International transfers

Box's servers are hosted in the European Union. Our service providers, including Cloudflare, Supabase, Google, Stripe and AbuseIPDB, may process information in other countries, including the United States. Those countries may have data protection laws different from those where you live. Where the law requires it, we rely on appropriate safeguards for these transfers, such as standard contractual clauses.

13. Your rights and choices

You can, at any time:

• read, export and delete your email through webmail, the REST API or the MCP server;
• delete mailboxes and domains, revoke API keys and authorized apps, and cancel Plus, in the Console.

Depending on where you live, you may also have the right to request access to the personal information we hold about you, to have it corrected or deleted, to receive a copy of it, to restrict or object to certain processing, and to withdraw consent you have given. You will not be discriminated against for exercising these rights.

To make a request, or to ask us to close your account, email support@maillogic.io from your account's sign-in address. We may need to verify your identity before acting on a request, and we will respond within the time required by applicable law. If you are not satisfied with our response, you may have the right to complain to your data protection authority.

If you email a Box customer or receive email from one, that customer controls their mailbox and the messages in it. Requests about those messages are best sent to that customer; we will help them respond where appropriate.

14. Cookies and browser storage

• Box's public pages, including this one, set no cookies, and Box does not use advertising or analytics scripts of its own.
• Cloudflare, our network provider, currently adds a reference to its Web Analytics script to the pages it delivers for Box. Each page's security policy stops your browser from loading or running that script, so it is not downloaded, sets no cookies and collects or sends nothing. Separately, Cloudflare processes request data, including IP addresses, to deliver and protect Box's traffic (section 9).
• Webmail and the Console keep your sign-in session in your browser's local storage, so you stay signed in in every tab and after you close the browser. It is removed when you sign out, in any tab, or when the session ends, for example because it was revoked. On a shared computer, sign out when you finish. Box's authorization page keeps its sign-in session in your browser's session storage, for that tab only; it is removed when you sign out or close the tab. While a sign-in is in progress, a short-lived record is kept in your browser's local storage so that the emailed link, or Google sign-in, can bring you back to it; it is removed when the sign-in finishes. This storage is necessary for signing in.
• Cloudflare may use strictly necessary cookies to protect the Service from attacks. Stripe Checkout and Google sign-in, when you use them, are provided on their own sites under their own cookie policies.

15. Children

Box is not directed to children. You must be at least 18 years old to create an account, and we do not knowingly collect personal information from children. If you believe a child has given us personal information, please contact us and we will delete it.

16. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page with a new "Last updated" date and, if the changes are material, notify the account owner by email or in the Console before they take effect.

17. Contact

Questions and requests about privacy can be sent to: