Last updated: August 2, 2026
Lullbox, a service operated by SovrinTech LLC, collects only the data necessary to provide email services. This includes your email address, account preferences, and encrypted email credentials. We do not scan the content of your emails for advertising purposes. Mailbox credentials are sent to Lullbox over HTTPS and encrypted at rest with AES-256-GCM in an account-bound service envelope protected by a dedicated server secret. Authorized Lullbox service processes can decrypt that envelope when needed to sync or send mail. Legacy password-derived credential records are migrated to the service envelope after a successful user unlock.
This policy describes Lullbox Personal self-service accounts. Business mailboxes managed by SovrinTech are configured and billed under the customer's separate SovrinTech service agreement and applicable data-processing instructions. A person granted access in Lullbox can use only the managed mailboxes assigned to them; provider, domain, retention, billing, and service-administration controls remain with SovrinTech and the business customer.
Your data is used solely to operate and improve the Lullbox service. AI features process email metadata and content only when you explicitly opt in. We never sell your personal information to third parties. Aggregate, anonymized usage statistics may be used to improve performance and reliability.
We use essential cookies to maintain your session and authentication state. Optional analytics cookies help us understand how users interact with the platform. You can disable non-essential cookies in your browser settings at any time.
To make the mailbox list responsive, Lullbox may store workspace-scoped folder and message-list metadata in your browser, including sender, subject, date, status, and label information. Message bodies, message previews, attachments, and generated AI summaries are not persisted in that browser cache. Mailbox-derived browser state is separated by the signed identity and workspace context and is cleared when you log out or change to an incompatible identity or workspace. Browser or device storage controls may also be used to remove it.
Cancelling Personal Pro does not by itself delete your Lullbox account. When paid access ends, the account moves to the Free plan and remains subject to the Free plan's storage, connected-inbox, and downloaded-history limits. Personal users can export available Personal data or request account deletion from Settings.
We integrate with third-party email providers through standard IMAP and SMTP using provider-issued app passwords. OAuth may be offered only after a connector is configured and verified. These integrations are governed by the respective providers' privacy policies. We use Stripe for payment processing. Payment data is handled directly by Stripe and is never stored on our servers.
If this feature is made available after external legal review, it remains off by default. A Personal user who explicitly enables it may add a small image to outgoing HTML mail. Loading that image records only the first-open time and a shortened browser user-agent value; Lullbox does not retain the recipient IP address for this feature. Senders are responsible for using open tracking only with the notices, consent, or other lawful basis required for their recipients and jurisdiction.
You have the right to access, correct, or delete your personal data at any time. Personal users can export Personal data or request Personal account deletion from Settings. Requests involving managed business mail must be submitted through the business administrator or SovrinTech customer process so the applicable customer agreement and data instructions are followed. For GDPR-related inquiries, contact our Data Protection Officer at the email below.
If you have any questions about this Privacy Policy, please contact us at privacy@lullbox.com.