Privacy Policy

1 Information We Collect

We collect personal and technical information when Users register on our platform, configure sending identities, import contact lists, or interact with our autonomous email engine:

• Personal & Billing Data: User full name, professional email address, phone number, physical company address, and tax/billing identifiers (such as GSTIN for Indian merchants).
• Platform & Audience Data: Email contact lists, audience segment metadata, behavioral triggers, draft campaign sequences, and sender domain DNS verification records (SPF, DKIM, DMARC).
• E-Commerce Synchronization Data: Customer identifiers, abandoned checkout events, purchase histories, and catalog metadata synchronized via permitted Shopify or custom webhook API endpoints.
• Technical & Telemetry Data: IP addresses, browser types, user agents, operating systems, and email delivery telemetry (bounce classifications, complaint reports, and delivery confirmation timestamps).

2 Payment Information & RBI Guidelines

Our service operates using a prepaid wallet credit mechanism. Users purchase credits via authorized, PCI-DSS certified payment aggregators (such as Razorpay, Cashfree, Stripe, or PayPal).

3 How We Use Your Information

We utilize the collected information strictly for operational and service delivery purposes:

• To power autonomous email campaigns, audience segmentation, abandoned checkout recovery, and delivery via certified MTAs (e.g. Amazon SES).
• To maintain wallet balances, calculate usage fees based on sent messages, and prevent account balance overdrafts.
• To enforce domain reputation safeguards, calculate complaint rates, and safeguard sender IPs.
• To communicate critical system alerts, maintenance notifications, and deliverability advisories.
• To comply with statutory legal requirements under applicable Indian and international law.

4 Third-Party AI APIs & Zero Training Policy

OGINBOX integrates with enterprise Artificial Intelligence APIs (including Google Vertex AI, Anthropic Claude, and OpenAI) to synthesize campaign strategies and draft high-converting copy from user prompts.

Our Zero-Training Commitment: We connect strictly through enterprise API endpoints that guarantee data confidentiality. We do not sell, rent, or provide your audience lists, email drafts, or proprietary business data to third-party AI vendors to train public foundational models without your explicit, opt-in consent.

5 Deliverability, Consent & RFC 8058 Mandate

In alignment with modern bulk sender mandates enforced by Google and Yahoo:

• One-Click Unsubscribe (RFC 8058): All marketing messages automatically include standard List-Unsubscribe: <https://...> and List-Unsubscribe-Post: List-Unsubscribe=One-Click headers.
• Automated Suppression: Any contact who unsubscribes or registers a hard bounce is immediately written to a global suppression table, preventing future accidental sends.
• Spam Complaint Threshold: Sending domains must maintain a complaint rate strictly below 0.08% to ensure uninterrupted delivery.

6 Data Security & Storage Practices

We maintain rigorous organizational and technical safeguards to protect your personal information against unauthorized access, destruction, or tampering. All web traffic is strictly encrypted using TLS 1.3. Local passwords are cryptographically hashed using Argon2/Bcrypt algorithms, and cloud service account credentials are stored in isolated, permission-locked secure directories.

7 Data Retention, Deletion & GDPR

Users possess the right to export or request full deletion of their audience lists and account records at any time. When a merchant disconnects a third-party integration or uninstalls our Shopify application, automated GDPR webhook routines trigger the systematic purging of synchronized customer data within the statutory grace period.

8 Grievance Officer & Governing Jurisdiction

In accordance with the Information Technology Act, 2000 and rules made thereunder, any privacy grievances or compliance questions should be directed to our designated Grievance Officer: