Skip to content
ZevInbox
Sign in Start a 14-day trial

Legal

Privacy policy

What ZevInbox collects, why, where it is kept, who helps us run the service, and what you can ask us to do with your data.

Last updated

Who we are

ZevInbox is a shared inbox for teams, provided by Zevop Technologies Limited ("Zevop", "we", "us"). Zevop is a company registered in Nigeria (CAC RC 1835627), at 10 Mojidi Street, Allen, Ikeja 101233, Lagos, Nigeria. Zevop is registered with the Nigeria Data Protection Commission (NDPC) as a data controller and processor, registration NDPC/DCP/12372.

This policy covers the ZevInbox web app at app.zevinbox.com, the ZevInbox mobile apps, the mail we receive and send for our customers, and this website. You sign in to ZevInbox with ZevID, the Zevop account used across Zev products. ZevID has its own privacy policy, which covers your ZevID account itself.

Our two roles

Data protection law gives us a different role depending on whose data it is and why we hold it.

  • Controller. We decide how to use your account details, your organization's billing details, how you use the service, and anything you send us directly. This policy explains what we do with that data.
  • Processor. The mail an organization receives and sends through ZevInbox, and the notes, drafts and other work its team adds, belong to that organization. The organization is the controller of that data and decides what happens to it. We process it only to provide the service, on the organization's instructions and under our terms of service.

If you write to a business that uses ZevInbox, that business is responsible for your message. To ask about it, contact the business. If you contact us instead, we will pass your request to them.

What we collect and why

Your account

When you sign in with ZevID, ZevID gives us your name, email address, profile picture and an account identifier. We use them to sign you in, show you to your teammates and send you the emails you ask for. We never see or store your ZevID password.

Your organization and billing

  • The organization's name, address, logo, website and time zone; its teams, inboxes and domains; its members, their roles and the invitations they send.
  • Billing details: the legal name, billing email, postal address, country, tax number and phone number on the billing profile, the plan, invoices, credit notes and payments.
  • Payments are made through ZevPay Checkout. We receive the payment's status, reference, channel and the payer's name. We do not receive or store card or bank account details.

We use this to provide the plan you chose, issue invoices, collect payment, keep accounting records and meet tax law.

Mail and the work around it

For each organization, on its behalf, we store and process:

  • Messages received and sent: the sender and recipients, subject, body, headers, attachments, and a copy of the original message as it arrived.
  • What the team adds: internal notes and mentions, drafts, assignments, tags, snoozes, reminders, signatures, read status and the activity history of each conversation.
  • The results of the checks we run on incoming mail: spam and virus scanning, sender verification (SPF, DKIM and DMARC), and the trust marks those results allow.
  • A search index of the organization's mail, so its members can search it. It is held in our own database and no outside search service is used.

We use mail content only to provide ZevInbox to the organization: to deliver, store, scan, display, search and send it. We do not read it, sell it, use it for advertising or use it to train AI models. Our staff look at an organization's mail only when the organization asks us to for support, when it is needed to keep the service secure, or when the law requires it.

Sender pictures and images in mail

  • To show a picture next to an outside sender, our servers look up a BIMI logo for the sender's domain, then Gravatar, then the icon of the sender's company website. Gravatar receives a one-way hash of the sender's email address, never the address. Freemail domains are never looked up. Your browser or phone never contacts these services.
  • Remote images in a message are hidden until a reader chooses to show them. Our servers then fetch the images on the reader's behalf, so the sender sees a request from us, not the reader's IP address or device. Each image is cached for 7 days.

Devices and push notifications

  • When you sign in on the mobile app, we record the device's name, its platform (iOS or Android), and the IP address and app details it signed in from, so you can see and sign out your devices.
  • If you allow notifications, we store the device's push token to send you push notifications. A push shows the organization's name and a short line saying who did what, with at most the conversation's subject. It never contains the message body or the text of a note. For spam, quarantined mail and release requests, the subject is left out too.
  • If the app crashes, it can send a crash report: the error, the app version, the operating system and the device model. Crash reports contain no message content and are not linked to your name or email address.

Usage, security and logs

When you use ZevInbox, our servers record the IP address and browser or app details of each session, and keep logs of requests and errors. We use them to keep you signed in, protect accounts, prevent abuse, enforce sending limits and fix problems. We count how many emails each organization sends each month, to apply its plan's limits.

When you contact us

If you email us, we keep your message and our reply so we can help you and follow up.

This website

This website has no analytics, no advertising and no tracking. It stores one setting in your browser if you choose a light or dark theme. The hosting provider keeps standard request logs.

Cookies

The ZevInbox web app uses only the cookies it needs to work. There are no advertising or analytics cookies.

zi_console
Keeps you signed in. It cannot be read by scripts on the page and lasts up to 14 days.
zi_oauth
Protects the sign-in step with ZevID. It lasts 10 minutes and is removed when you are signed in.

The app also keeps a few things in your browser's storage: your theme, the organization you last opened, recent searches and unsent draft text. ZevID sets its own cookies when you sign in, as its privacy policy explains.

Who we share it with

We do not sell personal data. We share it only with the providers that help us run ZevInbox, each for the purpose below and bound by a contract to protect it, and with other Zevop services that are part of how ZevInbox works.

ZevID (Zevop)
Sign-in, your account profile, and invitation emails.
ZevSend (Zevop)
The emails ZevInbox sends you: notifications and billing emails.
ZevPay Checkout (Zevop)
Invoices and payments, with its licensed banking partners.
Amazon Web Services
Amazon SES sends the mail your team writes, from the EU (Ireland) region.
Cloudflare
R2 storage, in its EU jurisdiction: original messages, attachments, logos, pictures, cached images and invoice files.
Our hosting provider
Our servers, in data centres in the EU: the mail server that receives and scans incoming mail, and the servers that run ZevInbox and its database.
Vercel
Hosting for the web app and this website. Requests from the web app pass through it.
Expo
Delivers push notifications to the mobile apps.
Apple and Google
Apple Push Notification service and Firebase Cloud Messaging carry push notifications to iPhones and Android phones.
Sentry
Crash reports from the mobile apps.
Better Stack
Application logs, used to find and fix errors.
Gravatar
Sender pictures, looked up with a hash of the sender's address.
ZevCloud (Zevop)
Adds the DNS records for a domain hosted on ZevCloud, when you ask it to.
Blocklist services
Our mail server checks the IP addresses and domains that send mail to you against public spam blocklists. No message content is sent.

We may also share data when the law requires it, to protect people or the service from harm or fraud, with professional advisers under confidentiality, or as part of a merger or sale of Zevop's business, in which case this policy continues to apply.

Where it is stored

  • Original messages, attachments and other files are stored in Cloudflare R2's EU jurisdiction.
  • Incoming mail is received and scanned on our mail server in an EU data centre.
  • Mail your team sends leaves through Amazon SES in Ireland.
  • Some of our providers, such as Vercel, Expo, Sentry and Better Stack, process data in other countries, including the United States.

When personal data leaves the European Economic Area or Nigeria, we protect it as the law requires: by using countries with an adequacy decision, or the European Commission's standard contractual clauses and equivalent safeguards under the NDPA.

How long we keep it

We keep data only as long as we need it for the purposes above.

Conversations and attachments
As long as the organization keeps them. They are deleted when their inbox is deleted, or when the organization is purged.
Original messages
The original file is deleted 30 days after it arrives. The message and its headers stay in the conversation.
Spam
Deleted 30 days after it reaches the Spam folder.
Unsent attachments
Files uploaded to a draft that was never sent are deleted after 24 hours.
Cached images
7 days.
Sender pictures
Kept as a cache and refreshed every 7 days.
Notifications
In-app notifications for 90 days. Records of notification emails for 90 days.
Sessions and devices
A web session lasts up to 14 days. A device stays signed in while it is used at least every 30 days, for up to a year. Records are deleted a week after a session ends. Push tokens are deleted when you sign out or turn notifications off.
A deleted organization
Can be restored by its owner for 30 days, then its mail, members, teams, inboxes and files are permanently deleted.
Invoices and billing records
For as long as company and tax law require, currently six full calendar years after the year of the last activity, even after the organization is deleted.
Logs
For a short period, for security and to fix problems, then deleted.
Bounces and complaints
Addresses that bounced or reported mail as spam stay on the organization's suppression list while the organization exists, so they are not mailed again.
Staff actions
A record of what our staff do in our admin tools, with the time and IP address, is kept as an audit trail.
Your account details
While you are a member of an organization, and then as long as your name is needed to show who wrote what in that organization's history.

Backups follow the same rules and are overwritten on a rolling basis.

How we protect it

  • Data is encrypted in transit with TLS and encrypted at rest by our storage providers.
  • Every organization's data is kept apart, and each member sees only the inboxes their teams give them.
  • Sign-in goes through ZevID. ZevInbox has no passwords of its own to steal.
  • Session cookies cannot be read by scripts, and the mobile app keeps its tokens in the phone's secure storage.
  • Incoming mail is scanned for viruses, dangerous attachments and phishing before anyone opens it.
  • Access to production systems is limited to the staff who need it.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the authorities when the law requires it. When it affects mail an organization controls, we will tell that organization without undue delay.

Your rights

Under the GDPR, the UK GDPR and the Nigeria Data Protection Act 2023, you have the right to:

  • be told how your data is used, as this policy does;
  • get a copy of your personal data;
  • have inaccurate data corrected;
  • have your data deleted, where we have no legal reason to keep it;
  • restrict or object to how we use it, including for our legitimate interests;
  • receive your data in a portable format;
  • withdraw consent at any time, where we rely on it;
  • not be subject to a decision based only on automated processing that significantly affects you.

To use any of these rights, email privacy@zevop.com or hello@zevinbox.com from the address you sign in with. We may ask you to confirm it is you. We answer within one month, and there is normally no charge. For mail held by an organization, we will pass your request to that organization and help it respond.

You can also complain to the Nigeria Data Protection Commission, or to the data protection authority where you live or work. We would like the chance to help first.

Deleting your account or organization

  • Leaving an organization: any member except the owner can leave in Settings, General. An owner or admin can remove a member. Your access ends at once. What you wrote stays in the organization's conversations, under your name.
  • Deleting an organization: the owner can delete it in Settings, General. It can be restored for 30 days, and is then permanently deleted. Invoices are kept as described above.
  • Deleting your ZevID account: email privacy@zevop.com from the address on the account. See how to delete your account for the steps.

Children

ZevInbox is a service for businesses and is not meant for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

We will update this policy when the service or the law changes, and change the date at the top. If a change is significant, we will tell owners and admins by email or in the app before it takes effect.

Contact us

Company
Zevop Technologies Limited, 10 Mojidi Street, Allen, Ikeja 101233, Lagos, Nigeria
Data protection officer
privacy@zevop.com
NDPC registration
NDPC/DCP/12372