Privacy Policy
Last updated October 27, 2026
This policy explains what information Spinbox collects, how we use it and the choices you have. Spinbox is operated by InnovativeLabs ("Spinbox", "we", "us"). If you have questions, email hello@spinbox.io.
Information we collect
- Account details: your name, work email, company and password (stored scrambled, never in plain text) when you sign up, plus the plan you choose: how many mailboxes, monthly or yearly, and any domains.
- Setup details: the domains and mailbox names you give us so we can build your mailboxes and set up their DNS records.
- Billing information: your plan and billing history. Card payments are handled by our payment processor; we don't store full card numbers.
- Website data: your IP address, browser details and the pages you visit, collected by our web host and, if allowed, by the analytics and advertising tags described below.
How we use information
- To run your account, set up and run your mailboxes, bill you and support you.
- To send service messages such as receipts and failed-payment notices, password reset links and security notices.
- To send you marketing and follow-up emails about Spinbox and our related products, such as tips, product news and offers. See Marketing emails below.
- To protect the service and stop spam and abuse.
- To understand how the site is used and to measure and improve our advertising.
Marketing emails
When you sign up for Spinbox or contact us, we may use your contact details to send you marketing and follow-up emails about Spinbox and our related products, such as tips, product news and offers. Every marketing email has an unsubscribe link, and you can opt out at any time by clicking it or by emailing hello@spinbox.io. Opting out of marketing emails doesn't stop service messages, such as receipts and security notices, which we send while you have an account.
Sharing
We share information with service providers who help us run Spinbox (for example hosting, email delivery and payments), with the analytics and advertising companies listed below when their tags are allowed to run, when you ask us to, when the law requires it, or as part of a merger or sale of the business.
Cookies and tracking
Cookies are small files a website stores in your browser. Some are needed for the site to work. Others come from analytics and advertising companies and help us understand how the site is used and whether our ads work. This section lists the ones we use, or may turn on, on Spinbox's website.
Cookies the site needs
These are always on because the site can't work properly without them. They aren't used for advertising.
| What | What it does | Main cookies | How long | Provider's policy |
|---|---|---|---|---|
| Your cookie choice Spinbox | Remembers whether you accepted or rejected cookies, so we don't ask again. | spinbox_consent (stored in your browser, not sent to us) | Until you clear your browser data or change your choice | This policy |
| Your account Spinbox | Keeps you signed in to your account at app.spinbox.io. It is set only after you sign in, and only on app.spinbox.io. | sbx_session | Until you sign out, or 30 days | This policy |
| Google Fonts | Loads the site's fonts. No cookies are set, but Google receives your IP address and browser details to send the font files. | None | Not applicable | Privacy policy |
| Hosting and security Our web host | Delivers the pages and blocks attacks. It sees your IP address but sets no tracking cookies. | None | Not applicable | This policy |
Analytics and advertising
If you're in the European Economic Area, the UK or Switzerland, none of these run until you click Accept on our cookie banner. Everywhere else they're on by default, and you can turn them off at any time as described below.
| What | What it does | Main cookies | How long | Provider's policy |
|---|---|---|---|---|
| Google Tag Manager | Loads and manages the other tags on this list. It sets no cookies of its own. | None | Not applicable | Privacy policy |
| Google Analytics 4 | Counts visits and shows which pages people use, so we can improve the site. | _ga, _ga_<ID> | Up to 2 years | Privacy policy |
| Google Ads | Measures whether our Google ads lead to sign-ups or orders, and lets us show ads to past visitors. | _gcl_au, _gcl_aw; IDE, test_cookie (on doubleclick.net) | _gcl: 90 days; IDE: up to 13 months; test_cookie: 15 minutes | Privacy policy |
| Meta Pixel Meta (Facebook, Instagram) | Measures our Facebook and Instagram ads and lets us show ads to past visitors. | _fbp; fr (on facebook.com) | 90 days | Privacy policy |
| LinkedIn Insight Tag | Measures our LinkedIn ads, gives us anonymous visitor reports and lets us show ads to past visitors. | li_sugr, bcookie, lidc, UserMatchHistory, AnalyticsSyncHistory, li_fat_id | From 1 day (lidc) up to 1 year (bcookie); most 30 to 90 days | Privacy policy |
| Microsoft Advertising (UET) Microsoft (Bing) | Measures our Bing ads and lets us show ads to past visitors. | _uetsid, _uetvid; MUID (on bing.com) | _uetsid: 1 day; _uetvid and MUID: up to 13 months | Privacy policy |
| X (Twitter) Pixel X Corp. | Measures our ads on X and lets us show ads to past visitors. | personalization_id, muc_ads, guest_id (on x.com / twitter.com) | Up to 13 months | Privacy policy |
| Reddit Pixel | Measures our Reddit ads and lets us show ads to past visitors. | _rdt_uuid | 90 days | Privacy policy |
Sharing with advertising platforms
When the advertising tags run, the companies above receive information such as the pages you visit, your IP address, browser details and the cookie IDs listed, and they may link it to your account with them. We use this to measure our ads and to show ads to people who have visited our site. Each company uses the data under its own privacy policy, linked above.
How to opt out
- Cookie settings: click Cookie settings (also in the footer of every page) to accept or reject analytics and advertising cookies, or to change your mind later.
- Global Privacy Control: if your browser sends the Global Privacy Control (GPC) signal, we treat it as an opt-out and the advertising tags stay off.
- Your browser: you can block or delete cookies in your browser settings. Blocking every cookie may stop parts of some sites from working.
- The companies' own controls: Google Analytics opt-out, Google ad settings, Meta ad preferences, LinkedIn ad opt-out, Microsoft ad settings, X ad settings and Reddit privacy settings. You can also use optout.aboutads.info (US) or youronlinechoices.eu (Europe).
California: Do Not Sell or Share My Personal Information
We don't sell your personal information for money. Letting advertising platforms collect data through the tags above to show you ads on other sites can count as "sharing" under California law. To opt out, click Cookie settings and choose Reject, or turn on Global Privacy Control in your browser, which we honor automatically. You can also email us at hello@spinbox.io.
Retention and deletion
We keep order and account information while you're a customer and for as long as the law requires for records such as invoices. You can ask us to delete your information by emailing hello@spinbox.io.
Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal information, or to object to certain uses. Email hello@spinbox.io and we'll respond within the time the law requires.
Changes
If we make material changes to this policy, we'll update the date above and tell customers by email.
Contact
InnovativeLabs
Email: hello@spinbox.io