Last updated: September 23, 2026
Waytoinbox ("Waytoinbox", "we", "us", or "our") provides email verification, email deliverability, email marketing, and sales outreach tools (the "Service"). This Privacy Policy explains what information we collect, how we use it, and the choices you have, based on how Waytoinbox actually operates today.
By creating an account or otherwise using the Service, you agree to the collection and use of information as described in this Policy.
When you sign up, we collect the information you provide, such as your name, email address, and password (stored in hashed/encrypted form, never in plain text). If you purchase a paid plan or credits, billing details are processed by our payment provider, Razorpay (see "Third-Party Service Providers" below).
Core parts of the Service work with lists of email addresses and related contact details you provide — for example, when you upload a file to verify emails, build a campaign contact list, or add prospects to a Sales Outreach list. Depending on the tool, this may include email address, first/last name, company, phone number, and any custom fields you choose to add. You control what you upload, and you are responsible for having the right to share that data with us (see our Terms of Service).
We collect information about how you use the Service, such as verification job results and history, campaign and sequence activity (opens, clicks, bounces, unsubscribes), credit and subscription usage, DMARC/SPF/DKIM and blocklist check results, login activity, and IP address, mainly for security, fraud prevention, billing accuracy, and to operate and improve the Service.
If you choose to connect your own mailbox (for example a Gmail, Microsoft 365, or other provider account) to send campaigns or sales outreach, you do so by entering your email address and an app-specific password/SMTP-IMAP credential directly in your account settings. This is a standard SMTP/IMAP connection that you authorize — it does not use Google's OAuth sign-in.
We use that connection to send messages on your behalf through your mailbox, and, for Sales Outreach, to check your connected mailbox's Inbox and Sent folders (read-only) so we can detect replies and bounces related to your own outreach and show them to you in your account's Inbox view. We do not use a connected mailbox for any purpose unrelated to sending and tracking your own campaigns/outreach. Connected mailbox credentials are stored in encrypted/signed form, never as plain text, and you can disconnect a connected account at any time from your account settings.
Waytoinbox's Inbox Warmup feature relies on a small, shared pool of Gmail "receiver" mailboxes that simulate real inbox engagement so we can measure and improve the deliverability of warmup emails. These receiver mailboxes are connected only by Waytoinbox administrators through Google's OAuth consent screen — individual customers do not connect their own Gmail account through this flow, and this OAuth connection is separate from the SMTP/IMAP mailbox connection described above.
For a connected warmup-receiver mailbox, we request the
https://www.googleapis.com/auth/gmail.modify scope via the Gmail API.
Using that access, our systems only:
This access exists solely to measure whether a warmup test email lands in the Inbox or Spam and to keep the warmup mailbox tidy for the next test. We do not read, export, or otherwise use the content of any email in a connected receiver mailbox; we do not send email through the Gmail API using these accounts; and we do not share Gmail data obtained this way with any third party or use it for advertising. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
OAuth refresh tokens for connected receiver mailboxes are encrypted at rest. An administrator can pause, resume, or permanently disconnect a receiver mailbox at any time from our admin console, and the Google account holder can independently revoke Waytoinbox's access at any time from Google Account permissions.
Separately, Waytoinbox also uses the read-only
https://www.googleapis.com/auth/postmaster.readonly scope to read
aggregate email deliverability and reputation statistics from Google Postmaster
Tools for domains Waytoinbox has verified ownership of. This does not access any
individual user's mailbox or personal data.
We use the information described above to:
We do not sell your personal information.
Data is stored in our database and associated infrastructure. Passwords, connected
mailbox credentials, and OAuth refresh tokens are stored encrypted/signed, never in
plain text. Session cookies are set with HttpOnly and, in production,
Secure flags. Access to production systems is restricted to authorized
personnel. No method of transmission or storage is 100% secure, and we cannot
guarantee absolute security, but we work to protect your information using
commercially reasonable safeguards appropriate to a SaaS platform of this kind.
We work with the following categories of third-party providers to operate the Service:
Each provider processes data only as necessary to perform its function for us and is subject to its own privacy practices.
We retain account data and Service data for as long as your account is active, and for a reasonable period afterward as needed to comply with legal, accounting, or security obligations, resolve disputes, and enforce our agreements. Uploaded contact lists, campaign data, and prospect data are retained until you delete them or request account deletion, as described below.
You can request deletion of your account and associated data at any time from your account settings (Profile → Delete Account), or by emailing support@waytoinbox.com. Deletion requests are reviewed and processed by our team; we may retain limited information where required for legal, billing, or security purposes.
Depending on your location, you may have rights to access, correct, export, or delete your personal information, or to object to or restrict certain processing. You can exercise these rights by updating your account settings where available, or by contacting support@waytoinbox.com. We will respond to verified requests within a reasonable timeframe.
Waytoinbox uses only strictly necessary cookies required to operate the Service: a session cookie to keep you signed in, and a CSRF-protection cookie to secure form submissions. We also use your browser's local storage to remember your light/dark theme preference on this device. We do not use third-party advertising or analytics tracking cookies.
We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice. Continued use of the Service after a change takes effect constitutes acceptance of the updated Policy.
If you have questions about this Privacy Policy or how we handle your data, contact us at support@waytoinbox.com.