Privacy Policy

Last updated: October 4, 2026

1. Introduction

Shadow Inbox ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered lead generation service.

Shadow Inbox is operated by Bunny Honey Club SRL, Strada Petricani 4, 023842 Bucharest, Romania (Trade Register No. J40/9993/2024), which is the controller of the personal data described in this policy. You can reach us at support@getshadowinbox.com.

By using Shadow Inbox, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Account Information

When you create and use an account, we store:

  • Email Address: Used to sign in, for account e-mails and, if you turn them on, for lead digests.
  • Password: Stored by Supabase Auth (we never store plaintext passwords).
  • Google Sign-In: If you sign in with Google, Google shares your name, e-mail address, profile picture link and Google account ID with us, and Supabase Auth stores them with your login.
  • Search Profiles: The profile name, business description, keywords and, if you give one, service area you enter, and the up to 5 AI search phrases we generate from them.
  • Billing: Your Stripe customer and subscription IDs, plan, subscription status and credit balance. Your card details, name and billing address are entered on Stripe's checkout page and stay with Stripe.
  • Settings: Whether lead digests and Auto-Pilot are switched on and, if you delete your account, the date on which it will be deleted.

2.2 Usage Data

  • Your credit history: every unlock, AI message, credit purchase, subscription credit grant and refund, with its date and amount
  • The leads you unlocked and when, and the AI outreach messages you generated (stored for your account only)
  • Page views, counted by Vercel Web Analytics: the page address, referring site, approximate location (country, region, city), browser, operating system and device type (see section 10)
  • Like any web server, our hosting (Vercel) and login (Supabase) providers receive your IP address and browser details with every request

2.3 Public Posts (Leads)

Shadow Inbox searches Reddit and Hacker News every hour with each customer's search phrases, and an AI model rates every new post against that customer's business description. For every post it rates, whatever the score, we store:

  • the title and the text of the post
  • the link to the post, the subreddit, the time it was posted and the time we found it
  • the search phrases that found it, and the score and topic tags the AI gave it for each customer it was rated for

A post rated 70% or higher for a customer becomes a lead for that customer. For a lead we also store keywords and a short rationale written by the AI, and we keep it as described in section 7. A post that did not become a lead for anyone is deleted 14 days after we found it.

When we choose the search phrases for a profile, we try candidate phrases and have the AI rate a sample of the posts each one finds. Those posts are not stored; only the counts are.

Posts can contain personal data. We do not store the author's username with a post: Reddit ends the text of each post it sends us with a line naming the author ("submitted by /u/…"), and we remove that line before the post is rated or stored. One exception: when someone posts on their own Reddit profile instead of in a subreddit, Reddit gives that profile (u_…) in place of the subreddit, so their username is part of the subreddit and the link we store. Anything an author wrote into a post, such as a name or an e-mail address, is stored with it. The link leads to the original post, which shows the author's username on both sites. We do not collect profile pages, private messages or anything that is not part of a public post.

A customer sees only the posts that matched their own search profiles. A post's title, text and link stay hidden until the customer unlocks it or 72 hours have passed since we found it; until then the customer sees only the AI's score and topic tags, the platform and whether we found it in the last 24 or 72 hours. By e-mail, customers with lead alerts on are told only how many new leads they have; customers with Auto-Pilot on receive each post's title, the first 200 characters of its text and its link.

We also use these posts ourselves. Bunny Honey Club SRL markets Shadow Inbox and its other services with the same system: our own tools read all stored posts, including posts that matched a customer's search profile and posts that did not become a lead, and we reply publicly to some of them on the site where they were written. We record which of our tools used which post.

We process this data under the basis of legitimate interest to help businesses connect.

If you wrote a post and want it removed from Shadow Inbox, e-mail us the link to the post at support@getshadowinbox.com.

3. How We Use Your Information

We use your information for the following purposes:

  • Authentication: To verify your identity and secure your account
  • Service Provision: To find, score and show you matching posts, and to write AI outreach messages when you ask for them
  • Billing: To process payments and manage your subscription and credits
  • Communications: To send lead digests (if you turn them on), account e-mails such as sign-up confirmation and password reset, and replies to your messages
  • Improvement: To see which pages are used (page-view statistics) and how credits are spent

4. Service Providers

We use the following service providers to run Shadow Inbox:

  • Supabase: Database and login. Stores your account data, search profiles, credit history and AI messages, and the public posts described in section 2.3. Our database runs in Zurich, Switzerland.
  • Vercel: Hosts our website. Every page request passes through Vercel, and our server functions run in Washington, D.C., USA. Vercel also provides our page-view statistics.
  • Stripe: Payments. Receives your e-mail address and the name, billing address and card details you enter at checkout. Stripe may process this data in the USA. We keep only your Stripe IDs, plan and subscription status, and we never see or store your card number.
  • Resend: Sends lead digests. Receives your e-mail address and the digest content (post titles, excerpts and links). Our sending domain is set up in Resend's US region.
  • DeepSeek: AI processing, provided by Hangzhou DeepSeek Artificial Intelligence Co., Ltd., which states that it stores data in the People's Republic of China. It receives your business description and keywords (to generate search phrases and to check that the description says what you sell); each post's title, subreddit and first 1,000 characters of text together with your business description and service area (to score the post); and the full post with your business description when you ask for an AI message. DeepSeek does not receive your e-mail address or payment data.
  • Hostinger: Our pipeline server in Germany, which runs the hourly searches, the AI scoring and the digest e-mails. It holds log files, which include customers' e-mail addresses, and a copy of the database made every night.
  • MarsProxies: Our Reddit searches are routed through this proxy service, operated by Comet Tech Inc., Panama. The connection is encrypted end to end, so the proxy sees only that we connect to reddit.com, not the search terms, the posts or any customer data.
  • Cloudflare: Runs our domain's DNS and forwards e-mail sent to support@getshadowinbox.com to our inbox. When you sign in, sign up or reset your password, Cloudflare Turnstile checks that the request comes from a person and not a bot; for this it receives your IP address and browser and device characteristics. We use it to protect the login against abuse.
  • Google: Only if you choose "Sign in with Google": Google confirms your identity and shares the data listed in section 2.1.

5. Processing Outside the EU

Our pipeline server (Hostinger) is in Germany. Other providers process data outside the European Union:

  • Switzerland: Supabase (our database)
  • United States: Vercel (server functions and page statistics), Resend (digest e-mails) and Stripe (payment data); Cloudflare (e-mail forwarding) and Google (only for Google sign-in) are US companies
  • People's Republic of China: DeepSeek (AI processing)
  • Panama: MarsProxies, which receives no personal data (see section 4)

6. Data Security

We implement appropriate technical and organizational measures to protect your personal information:

  • Connections between your browser, our servers and our providers are encrypted with HTTPS/TLS
  • Database connections are secured and authenticated
  • We use Row Level Security (RLS) policies so that each customer can read only their own data
  • The system was audited for security in September 2026, and all critical and high-severity findings were fixed

7. Data Retention

We keep your account data for as long as your account exists.

You can delete your account in Settings. Your subscription is cancelled immediately and the account is marked for deletion. 30 days later, a daily job permanently deletes your login, your account record, your search profiles, your lead matches, your AI messages and your credit history. This deletion does not reach:

  • the records Stripe keeps about your payments
  • e-mails already sent to you, in your inbox and in Resend's sending logs
  • log files on our pipeline server, which show e-mail addresses only shortened (first letter and domain) and are rotated daily and deleted after 14 days. Two exceptions have no fixed deletion date: log files that are no longer written to, and copies of older logs made during maintenance work in September 2026, which include full e-mail addresses
  • the nightly copies of the database on our pipeline server, each of which is deleted automatically once it is 30 days old. A deleted account is therefore gone from the last copy 30 days after its deletion

Posts that did not become a lead are deleted after 14 days (section 2.3). Posts that became a lead are currently kept with no fixed deletion date. Deleting a customer account removes that customer's matches, not the post itself, which may also be matched to other customers. Authors can ask us to remove a post (see section 2.3).

8. Your Rights

You have the right to:

  • Access your personal data
  • Correct inaccurate data
  • Request deletion of your data
  • Export your data
  • Opt-out of non-essential communications

To use these rights, e-mail us at support@getshadowinbox.com. You can also delete your account yourself in Settings.

9. GDPR Compliance and Data Roles

Under the General Data Protection Regulation (GDPR), we act as the Data Controller for the personal information you provide to create an account.

For any third-party public data indexed by our service, we process this under the basis of Legitimate Interest.

We do not sell or rent our customers' account data. The public posts described in section 2.3 are made available to the customers whose search profiles they matched; that access is what customers spend credits on. We also use them for our own marketing (section 2.3).

10. Cookies and Tracking

Pages you visit before signing in set no cookies. When you sign in, Supabase sets a login cookie whose name starts with "sb-" and ends with "-auth-token" (a large session is split into "-auth-token.0", "-auth-token.1"). It keeps you logged in, is set to expire after 400 days and is removed when you sign out. Google sign-in and password reset also use a "-auth-token-code-verifier" cookie for the sign-in step. These cookies are necessary for the Service to function properly and cannot be disabled.

The dashboard stores one entry in your browser's local storage ("shadow_inbox_onboarded") so that it does not show the welcome wizard again.

Our page-view statistics come from Vercel Web Analytics, which sets no cookies. According to Vercel, it recognizes a visitor by a hash of the incoming request, discards it after 24 hours and does not track visitors across other websites.

We do not use tracking cookies for advertising purposes or share your browsing data with third-party advertisers. Stripe (checkout) and Google (sign-in) set their own cookies on their own pages.

11. Contact Us

If you have any questions about this Privacy Policy or your data, contact Bunny Honey Club SRL, Strada Petricani 4, 023842 Bucharest, Romania, at support@getshadowinbox.com.