Privacy policy

Effective 2 November 2026. Inbox Space is operated by EJ Group OÜ, Estonia. This notice covers our restricted testing service at inboxspace.app.

Current service and information

Access is limited to invited testers. Public signup is disabled. Real Instagram connections and incoming messages are limited to the authorized test owner; reviewer accounts use separate workspaces. Outgoing message sending remains disabled until a controlled test is enabled. We process invited users’ names, email addresses, password hashes, session information and test inbox records. Requests also expose IP addresses and browser information to our hosting provider. We use session cookies and security records to authenticate users and limit abusive sign-in attempts.

Why we use information

We use account and session information to provide requested test access, and security information for our legitimate interest in protecting the service. We use information in support requests to respond and administer the service. We do not sell personal data, run advertising trackers or make automated decisions with legal or similarly significant effects.

Instagram and other products

For an authorized test connection, the Instagram integration processes professional-account identifiers, usernames, business identifiers, encrypted access tokens, conversations and messages to provide an inbox. Meta provides login and the Instagram API. Inbox Space does not currently send account or conversation data to DM Faster.

Service providers and international processing

Cloudflare provides our hosting, database, network security and email routing. The sign-in page loads fonts from Google Fonts, which receives the network information needed to deliver them. Support messages are handled in the operator’s business email inbox; business email forwarding does not connect the two products’ customer databases. Providers may process information outside Estonia and the EEA. Contact us for information about the applicable provider arrangements and safeguards; this test service does not promise EU-only storage.

Retention

Test accounts and test inbox records are retained while needed for the testing programme or until a verified deletion request is completed, subject to any applicable legal retention requirement. There is no automatic expiry for test accounts or test conversation history. Reviewer sessions expire after one hour. Sign-in throttling uses short counting windows, which do not by themselves delete stored security records. Disconnecting an integration removes its stored access token but does not erase conversation history. Real test messages follow the same testing retention period: they remain until no longer needed for the testing programme or a verified deletion request is completed. Deletion is administered manually; no automatic message deletion is currently scheduled.

Your choices and rights

You may request access, correction, deletion, restriction, objection or portability where applicable. You can complain to the Estonian Data Protection Inspectorate or your local supervisory authority. Send a request using the contact below; we may need proportionate information to confirm your identity. Do not send your password or an Instagram access token. We respond within the applicable statutory period, normally one month.

Contact

Controller: EJ Group OÜ. Email: hello@inboxspace.app.