Privacy policy

01Who is responsible

Inlet is a service operated by EAM (“we”). You can reach us at etame.eddy01@gmail.com.

For your developer account and the client contacts you add, we decide how the data is used: we are the controller.

For leads — what visitors type into a form on a site you built — you and your client decide; we only store and deliver them on your instructions, as a processor. The privacy notice those visitors rely on is the one published on that site.

02What we collect

• Developer account: name or company, e-mail address, a password hash (never the password), plan, API keys stored as hashes, the webhook signing secret, and sign-in events (time, IP address) kept for security.
• Clients you add: business name, e-mail address, website, language, and a password hash once they set one for their inbox.
• Leads: the fields the form sends (typically name, e-mail, message, sometimes a file), the time, the visitor’s IP address and a technical fingerprint used only to stop spam, and the spam status we assigned.
• Visits to the public pages: the path, the referring page, the browser’s user agent and a salted hash of the IP address — never the address itself — under a first-party cookie. No advertising network, no cross-site tracking.
• The assistant: the messages you send it, counted against your plan’s quota. Signed-out visitors get a random identifier in a cookie for their trial message.

03Why, and on what basis

• To run the service you signed up for: storing leads, sending notifications and auto-replies, the dashboard, the API and the MCP server (performance of a contract).
• To keep it safe: rate limits, the honeypot, proof-of-work, automatic bans by IP, fingerprint and reverse-DNS host, sign-in protection (our legitimate interest in security, and yours).
• To understand which public pages are read, in aggregate (legitimate interest; the data cannot identify you).
• To meet legal obligations, such as keeping invoicing records.

04Cookies

Inlet sets only first-party cookies: a session cookie for developers, one for client inboxes and one for the operator; the language you chose; the visit identifier for the public pages; the assistant identifier for signed-out visitors; and a short-lived state cookie during Google sign-in. None of them is used for advertising.

05Where the data lives, and for how long

• Hosting, database and file storage run in the European Union.
• Account and client data stay as long as the account exists, and are deleted within 30 days after you ask us to close it.
• Leads are kept for the retention window of your plan: 30 days on Free, one year on Solo, without limit on Pro and Max. Leads past the window may be deleted at any time, together with their attachments. Export is one click, on every plan.
• Security logs and automatic bans expire on their own after a limited time.
• File attachments are stored at unguessable addresses; anyone holding the exact link can open the file, so treat lead e-mails as confidential.

06Who else sees the data

• Our hosting and content-delivery provider (Vercel) and our database and storage provider (Supabase), both configured in European regions.
• E-mail delivery providers, which carry the notifications and auto-replies.
• AI model providers for the assistant (Google Gemini, with Groq as a fallback): they receive the messages you send the assistant. Lead content is sent to a model only when the optional spam classification is switched on; it is off by default.
• Your clients, who receive their leads by e-mail and in their inbox, and the endpoints you configured for webhooks.
• Some providers are established outside the European Union; those transfers rely on the providers’ standard contractual clauses or an adequacy decision. We never sell data.

07Your rights

You can ask for access, correction, deletion, restriction or a copy of your data, and object to processing based on our legitimate interest. Leads export from the dashboard as CSV at any time. Write to etame.eddy01@gmail.com; we answer within a month. You may also complain to your data-protection authority.

If you submitted a form on a site built with Inlet, the site owner is your first contact; we help them answer you.

08Security

Traffic is encrypted in transit. Passwords are hashed with scrypt, API keys are stored as hashes, webhooks are signed, sign-in can require a second factor by e-mail, and every read and write is scoped to the account that owns the data. No system is perfect: if you find a weakness, tell us at etame.eddy01@gmail.com — we fix first and talk after.

09Changes

When this policy changes in a way that matters, we say so in the dashboard and update the date above.