Privacy Policy

1. Introduction and Who We Are

This Privacy Policy explains how DigiTrans Consultants W.L.L ("Company", "we", "us", or "our"), the operator of CORAIBOX, collects, uses, stores, shares, and protects your personal data when you use our Service. We are committed to protecting your privacy and handling your personal data in a transparent, lawful, and responsible manner, in compliance with the Kingdom of Bahrain's Personal Data Protection Law (PDPL) and, where applicable, the European Union's General Data Protection Regulation (GDPR).

2. Data We Collect

2.1 Account and Identity Data

When you register, we collect your email address, display name, and (if you use Google OAuth) your Google account profile information including your name and profile picture URL. We store a hashed version of your password — we never store your password in plain text. We also record your preferred interface language (e.g., English or Polish) at the time of registration to personalise your experience.

2.2 Email Account Credentials

To connect your email accounts, you provide IMAP credentials (email address, password or app-specific password, IMAP server hostname, and port). These credentials are stored in encrypted form and are used solely to access your email accounts on your behalf.

2.3 Email Content and Metadata

When you run the AI triage engine, the Service accesses your unread emails and processes: sender and recipient email addresses, email subject lines, email body text, timestamps, message IDs, folder/label names, and thread context (up to the last 3–5 messages in a thread). This data is processed to deliver AI classification, task extraction, and briefing features.

2.4 Triage and Activity Data

We store records of AI triage decisions (keep/archive), the reasons provided by the AI, tasks extracted from emails, prompt profiles and their version history, your feedback on triage decisions (restore-to-inbox reasons), and Training Mode data — including the training notes you write when correcting AI decisions and the timestamps of those corrections. Training notes are used solely to refine your personal triage prompt and are never shared with third parties or used to train AI models.

2.5 Subscription and Billing Data

We collect and store your subscription plan, billing history, and plan change records. Payment processing is handled by our third-party payment processor. We do not store full payment card numbers or bank account details.

2.6 Integration Data

If you connect Slack or Discord integrations, we store the webhook URLs you provide. These are used solely to send notifications to your designated channels.

2.7 Usage and Technical Data

We automatically collect certain technical data when you use the Service, including your IP address, browser type and version, operating system, device type, pages visited, features used, and timestamps of interactions.

3. How We Use Your Data

We do not use your email content to train AI models, build advertising profiles, or sell your data to third parties.

4. AI Processing and Large Language Models

CORAIBOX uses third-party large language model (LLM) providers to power its AI triage, task extraction, and briefing features. When you run the AI triage engine, email content and metadata are transmitted to these providers' APIs.

5. Data Sharing and Third Parties

We do not sell, rent, or trade your personal data. We share your data only in the following circumstances:

6. Data Retention

7. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include encryption of data in transit using TLS, encryption of sensitive data at rest (including IMAP credentials), access controls limiting employee access on a need-to-know basis, regular security assessments and monitoring, and secure session management using signed JWT tokens.

No method of transmission over the internet is 100% secure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority as required by applicable law.

8. Your Rights

Depending on your location and applicable law, you may have the following rights regarding your personal data:

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days. If you are located in the EEA and believe we have not addressed your concerns adequately, you have the right to lodge a complaint with your local data protection supervisory authority.

9. International Data Transfers

CORAIBOX is operated from the Kingdom of Bahrain. If you are accessing the Service from outside Bahrain — including from the EEA, United Kingdom, or other jurisdictions with data protection laws — your personal data may be transferred to and processed in countries that may not have the same level of data protection as your home country. Where we transfer personal data from the EEA or UK, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) or equivalent mechanisms.

10. Cookies and Tracking Technologies

CORAIBOX uses session cookies and local storage to maintain your authentication state and language preferences. We do not use third-party advertising cookies or tracking pixels. The cookies we use are strictly necessary for the operation of the Service. You can control cookie settings through your browser settings, but disabling cookies may affect the functionality of the Service.

11. Children's Privacy

The Service is not directed to children under the age of 16. We do not knowingly collect personal data from children under 16. If you become aware that a child under 16 has provided us with personal data, please contact us at [email protected] and we will take steps to delete such information.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated Policy on the Service and by sending a notification to your registered email address at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes your acceptance of the changes.