Privacy Policy

Effective 3 November 2026

This policy explains what personal data Agent Outbox, made up of the bot @agentoutbox_bot and its MCP server at https://outbox.roxinbox.io/mcp ("the service"), processes, why, and your rights under the EU General Data Protection Regulation (GDPR).

1. Controller

CloudLab Studio, Netherlands. Email: payments@wonderu.com.

2. What we store

• Account: your Telegram user ID, username and first name, as Telegram gives them to the bot when you send /start.
• Destinations: the chat IDs, types and names of your private chat, groups and channels you add, and which one is your default.
• Usage: how many messages you sent in your current quota window (today for Free, the billing period for Pro). Older counts are deleted.
• Payments: for each Telegram Stars payment, the Telegram payment ID, amount, currency, date, whether it renews a subscription, and any refund; and your subscription's end date and status.
• AI assistant connections: for each assistant you connect, an OAuth grant with the app's name and ID and your Telegram user ID (encrypted). Access and refresh tokens are stored only as hashes.
• Login: your current 6-digit login code (deleted when used, or after 10 minutes), and for each login page the connecting app's name, domain and redirect host and the number of wrong codes entered (deleted after 10 minutes). Your IP address is used, but not stored by us, to rate-limit wrong codes.

3. What we do not store

The text your AI assistant sends is relayed to Telegram and not stored by the service: it is held in memory only while it is being formatted and sent. Telegram stores it in the destination chat like any other message. We do not read your chats: the bot ignores everything except what you send to it in your private chat with it and, in groups, the /link command.

4. Why we process it (legal basis)

• To provide the service you asked for: account, destinations, connections, delivering messages, plan limits and Pro (performance of a contract, Art. 6(1)(b) GDPR).
• To keep payment records as tax and accounting law requires (legal obligation, Art. 6(1)(c)).
• To keep the service secure and prevent abuse, such as rate-limiting login attempts and enforcing limits (legitimate interests, Art. 6(1)(f)).

We do not use your data for advertising or profiling, and we do not sell it.

5. How long we keep it

• Account, destinations, usage and connections: until you delete them with /deleteme (or remove a destination, or /disconnect your assistants).
• Login codes and login page records: at most 10 minutes.
• Payment and subscription records: 3 years after the payment, as required by tax and accounting law, even after /deleteme.

6. Who processes it for us

• Cloudflare, Inc. hosts the service (Workers, Pages, D1 database, KV storage) on its global network. See the Cloudflare Privacy Policy.
• Telegram delivers the bot's messages, processes Stars payments and stores chats. See the Telegram Privacy Policy.
• Google Ireland Limited provides Google Analytics for the website, only if you accept cookies there (see section 7).

Some of this processing may take place outside the European Economic Area. Where it does, it relies on the safeguards these providers offer, such as the European Commission's Standard Contractual Clauses or an adequacy decision. The AI assistant you connect is your own choice and processes your data under its own terms, not on our behalf.

7. Website analytics

On the website at https://outbox.roxinbox.io we use Google Analytics 4 to count visits and see which pages are used, only if you accept in the cookie banner. Until you do, Google Analytics is not loaded and sets no cookies. The bot, the MCP server and the messages your assistants send are never tracked by Google Analytics.

• Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, processes this data for us as our processor; its parent Google LLC (USA) may process it too.
• What is collected: the pages you view, the site you came from, your device type, browser and operating system, your approximate location (country and region, derived from your IP address, which Google Analytics does not store), and a random identifier kept in cookies. We send no name, Telegram ID or message content. Google signals and all advertising features are turned off.
• Legal basis: your consent (Art. 6(1)(a) GDPR, and Art. 11.7a of the Dutch Telecommunications Act for the cookies).
• Cookies: _ga and _ga_<ID>, which recognise your browser on later visits. They expire after 2 years, or earlier when you withdraw consent. Your choice itself is stored in your browser's local storage, not in a cookie.
• Retention: Google Analytics keeps this data for 2 months, then deletes it.
• Transfers: transfers to Google LLC in the United States rely on its certification under the EU-US Data Privacy Framework.
• Withdrawing consent: choose Cookie settings at the bottom of any page of the website and press Reject. Google Analytics then stops and its cookies are deleted. You can also clear the site's cookies and storage in your browser.

8. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format. Send /deleteme to the bot to delete your account, destinations, usage and connections at once. For anything else, email payments@wonderu.com; we answer within one month. To withdraw consent to website analytics, see section 7. You also have the right to lodge a complaint with a data protection authority, in particular in the EU country where you live or work, or in the Netherlands.

9. Children

The service is not for children under 16.

10. Changes

We will announce material changes to this policy in the bot before they take effect.