Privacy policy

Duobox is a service of MSN Computing LLC, a United States company, at 1209 Mountain Road Place NE, STE N, Albuquerque, NM 87110, United States. We are the controller of the data: the company that decides what gets handled and what for.

For anything on this page, write to legal@duobox.io. We have not appointed a data protection officer: we are a small company and are not required to have one.

It's the first thing you want to know, so it goes first.

Duobox sells email on your domain. For you to open a message and read it, we have to store it. That is everything we do with the content of your mail.

What we do

What we don't do

If you connect an agent, the agent is yours and it runs on your side. You choose what it can do in each inbox — read, write drafts, or send — and every action is logged. Duobox gives no agent access to your mail unless you connected it.

Your name, your email address — which is your inbox address, on your domain — your password, your company's name, and your role inside it: owner, admin or member. The password is stored as a *hash*, a fingerprint that cannot be turned back into the original password. You give us all of this when you create the account.

The domain name, and the owner details the registrar — the company that registers domain names — requires in order to register it. You give us these when you buy or connect a domain.

The content of the messages that come in and go out, with their attachments and headers. You write them, or the person writing to you does.

Payment is handled by Stripe. You give your card details to Stripe, not to us: Duobox does not store card numbers. On our side we keep a Stripe customer identifier and the status of your subscription.

Outgoing mail goes through Amazon SES, which reports bounces and complaints back to us. We store the addresses that hard-bounced — they don't exist — and the ones that marked a message as unwanted, so we stop writing to them. It is a list of addresses, not of content.

When you sign in, an HttpOnly session cookie is left in your browser and the matching row in our database. HttpOnly means no script on the page can read it. We keep no tokens in the browser.

On duobox.io and app.duobox.io we measure visits with Google Analytics. We send the route pattern and not the URL with identifiers: it sees that someone looked at a domain page, not which one. The webmail has no analytics: inside your mail we measure nothing.

Only if you turn it on. It has its own section below.

"Legal basis" is the reason the law lets us handle a piece of data. We use four.

Governing law: the law of the State of New Mexico, United States.

With nobody who wants it for themselves. Only with the companies we need for the service to work. The law calls them processors: they handle data on our behalf, following our instructions, and they cannot use it for anything else.

We don't sell data. We don't hand it over for advertising. If an authority asks for it with a valid order, we give what the law requires and nothing more.

On AWS infrastructure, region us-east-1 (United States), with a PostgreSQL database. That is where your mail and everything else lives.

Duobox is a United States company and it handles the data in its own country. So the one that travels is your data: if you sign up from Latin America, Europe or anywhere outside the United States, your data leaves your country and is handled in the United States, under the laws there. That is an international transfer, and by using Duobox you accept it.

What that means concretely:

Stripe and Google may also process data outside your country.

About your data, you can:

They apply to anyone, wherever they write from. Duobox is a United States company selling to companies in Latin America, Europe and the US, so more than one data protection regime can reach us. We won't ask you to tell us which one you are writing under: you get these rights either way. And if where you live gives you any more, you can use those too.

To use them, write to legal@duobox.io from your account's address. If you can't write from there, tell us how to verify it's you: we don't hand an account's data to someone we cannot identify. We answer on the same channel.

Your contacts' mail. The messages in your inbox are yours: we store them on behalf of your company. If someone who wrote to you wants to know what data of theirs is there, or wants it deleted, your company decides that, not us. If they write to us, we point them to you.

There are two kinds and they don't do the same thing.

The one you need to sign in. The session cookie. Without it you can't sign in: the browser would have no way to say it's you on each request. It is HttpOnly, it can't be read from the page, and it is no use for following you across other sites. It can't be turned off: if you block it, the product can't be used.

The ones that measure. Google Analytics leaves cookies on duobox.io and app.duobox.io to count visits and see which pages get used. They are not needed for the product to work. You can block them in your browser or with an extension, and everything else keeps working the same.

There are no measurement cookies in the webmail. Only the session one is there.

It's optional and it starts off.

If you turn it on, we ask for read-only permission on your Google Search Console and your Google Analytics, to show you inside Duobox how your site is doing: what people search, how many visits you get, where they come from.

What read-only means, concretely: we read those reports and nothing else. We don't write, we don't change anything and we don't delete anything in your Google account. We don't ask for access to your Gmail, your Drive or your contacts.

Duobox's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. In plain words: we use that data to show you how your site is doing inside Duobox, and for nothing else. We do not sell it, we do not use it for advertising, and we do not use it to train models.

You can disconnect it whenever you want, from Duobox or from your Google account's permissions. From that moment we stop asking for that data.

Duobox is a product for companies. It is not meant for minors and we don't deliberately collect data about them. If we learn that an account belongs to a minor, we close it and delete the data.

If we change this policy, we publish the new version on this same page, with the new date at the top. When the change touches something important — new data, a new purpose, a new processor — we don't hide it in a line: we say it.

legal@duobox.io. Write to us in Spanish, English or Portuguese.

Controller: MSN Computing LLC, 1209 Mountain Road Place NE, STE N, Albuquerque, NM 87110, United States. We have not appointed a data protection officer: we are a small company and are not required to have one.