Privacy policy

InboxPanda is run by Pwnera SAS, 47 rue Vivienne, 75002 Paris, France, SIREN 108 433 426, VAT FR23108433426 ("we"). This policy covers two groups of people: customers who create forms, and senders who fill them in.

Senders: you filled in a form

The website owner who made the form decides what it asks and what happens with your answers; they are the controller and we process your submission for them. We store what you typed and the time it arrived. We do not store your IP address with the submission.

To sort the owner's inbox, Claude (Anthropic) reads your submission once to label its intent, write a short summary and, if the owner asks, draft a reply. The owner can set submissions to be deleted automatically after 30 to 365 days. To access or delete what you sent, contact the website owner; we will help them answer you.

Customers: you created a form

• Account: your email address, used to sign you in with one-time links and to send you submissions.
• Your forms and their submissions: stored to run the service, for as long as you keep them or your retention setting allows.
• Product analytics: named events such as "form created" or "submission opened". Visitors are counted without cookies or any storage on their device, using a hash that changes every day; signed-in events are recorded on our servers against a one-way hash of your email. No session recording, no automatic click tracking. Opt out of analytics in this browser.
• Account milestones: our servers count three events (form created, form claimed, first submission received) against the same hash, to measure whether InboxPanda works for new customers. No submission content is included. Email us to object.
• Operational logs: request logs kept 7 days to keep the service secure and running. Our firewall sees IP addresses to rate-limit abuse; they are not stored with your data.

Legal bases: performing our contract with you (running the service), and our legitimate interest in security, preventing abuse and understanding how the product is used (analytics and the milestones above), which you can object to at any time.

AI processing

Submissions are sent to Anthropic's API to classify and summarise them. Neither we nor Anthropic use your submissions to train AI models. Anything the AI infers is labelled in the product and can be overruled.

Cookies

One strictly necessary cookie keeps you signed in. Analytics sets no cookies and stores nothing on your device, which is why there is no cookie banner. If you opt out, we remember that choice in your browser so we can honour it. The form pages we host set no cookies.

Your rights

You can export all your data (Account → Export data), delete any submission or form, and delete your account and everything in it permanently (Account → Delete account). You can also ask us for access, correction, deletion, restriction or portability, object to processing, and complain to your data protection authority.

Where data is processed

Our infrastructure runs on AWS in the United States. Transfers outside the EEA rely on the EU Standard Contractual Clauses. See the subprocessors.

Security

All traffic uses HTTPS. Data is encrypted at rest by AWS. Webhooks are signed with HMAC-SHA256. Access to production is limited to the people who run the service.

Last updated 22 October 2026. Questions: privacy@inboxpanda.io