Privacy Policy

Mailbox.bot — Outbound Mail and Managed Inbound Mailbox Services
Operated by Golden Ratio, LLC, a Utah Limited Liability Company
Effective Date: February 7, 2026 · Last Updated: September 30, 2026

1. Overview and Commitment

1.1 Our Privacy Commitment

Golden Ratio, LLC ("Company," "we," "us," "our"), the operator of Mailbox.bot, is committed to protecting the privacy and security of your personal information. The Platform's live offering includes outbound mail, inbound mail context capture, and agent mailboxes. You (or your AI agent, MCP client, or REST consumer) submit documents for printing and mailing, and you may forward scans, photos, PDFs, notices, and notes from mailing addresses you already use to your private mailbox.bot alias. Managed mailboxes are live now: a compliant street address and PMB at the Manhattan Beach, CA facility, $15/mo, governed by the human member and that member's agent. The PMB number is assigned after USPS Form 1583 verification. Activation of a particular account remains subject to counsel, postal, City of Manhattan Beach, security, operational, and account approvals. We take seriously the responsibility you place in us when you transmit documents, recipient data, inbound context, agent rules, and credentials to the Platform.

1.2 Scope

This Privacy Policy applies to all information collected through the Mailbox.bot website (mailbox.bot), the Mailbox.bot REST API, the MCP server, the Agent-to-Agent (A2A) endpoint, OpenClaw integrations, the Operator Dashboard, Agent profile pages, and any related services, tools, or communications (collectively, the "Platform").

1.3 Agreement

By using the Platform, creating an account, requesting a mailing address, or interacting with our services in any way, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Platform.

2. Information We Collect

2.1 Information You Provide Directly

We collect information that you voluntarily provide to us, including:

• Account registration information: full legal name, email address, phone number, physical address, and payment information
• Identity verification (KYC) information: government-issued photo identification, biometric selfie photograph, date of birth, and address verification data
• Managed inbound CMRA compliance records: completed USPS Form 1583, clear copies of the two required identification documents, actual home or business address, California private-mailbox acknowledgment and service-of-process agreement, business name and signer authority, witnessing or notarization records, activation status, and termination date
• Agent registration information: agent name, slug, description, webhook URLs, framework identifiers, and capability declarations
• Mailing address request information: email address and any optional information you provide
• Communications: any messages, support requests, or correspondence you send to us
• Payment information: credit card or other payment method details (processed and stored by our payment processor, not stored on our servers)

2.2 Information We Collect Automatically

When you access or use the Platform, we automatically collect:

• Log data: IP address, browser type, operating system, referring URLs, pages visited, timestamps, and request identifiers
• Device information: device type, screen resolution, language preferences, and unique device identifiers
• Usage data: features used, API calls made, webhook events triggered, and interaction patterns
• Cookie data: session identifiers, authentication tokens, and analytics cookies (see Section 9)

2.3 Information Generated Through Our Services

In the course of providing our services, we generate and collect:

• Package data: exterior photographs, tracking numbers, carrier information, dimensions, weight, intake timestamps, and storage location within the Facility
• Managed inbound mail data: addressee and sender information visible on an Item, exterior images, intake and custody events, handling instructions, forwarding destinations, service-of-process records, and opened-mail images, scans, OCR, or derived metadata when you authorize those actions or law otherwise permits them
• Content Scan data: photographs and digitized representations of package contents (only when you request a Content Scan)
• Outbound document data: recipient addresses, document content (as submitted via the API), tracking information, and delivery status
• Webhook logs: event payloads, delivery timestamps, response codes, and retry history
• API access logs: authentication events, endpoints called, request/response metadata, and rate limit status

2.4 Information from Third Parties

We may receive information about you from third-party sources, including:

• Identity verification provider (Stripe Identity): verification results, risk scores, and document authentication outcomes
• Payment processor (Stripe): transaction status, payment method verification, and fraud detection signals
• Phone carrier verification (Twilio Lookup): line type, carrier name, and fraud risk score for the phone number you provide at signup
• Shipping carriers (USPS, FedEx, UPS): tracking updates and carrier-generated metadata for outbound mail pieces we tender on your behalf
• Analytics providers (Google Analytics, PostHog): aggregated usage statistics, traffic source information, and product-feature interaction telemetry — see Sections 5.6 and 9 for the full disclosure

3. How We Use Your Information

3.1 Service Provision

We use your information to operate, maintain, and improve the Platform, including:

• Verifying your identity and maintaining account security
• Registering and maintaining managed inbound mailbox customers as USPS and California CMRA rules require, including Form 1583 processing, identification review, record retention, and service-of-process administration
• Provisioning Endpoints and processing package intake under bailee custody
• Sending webhook notifications and email alerts about package events
• Processing outbound document requests
• Providing Content Scan services
• Managing billing, payments, and subscription plans
• Facilitating package forwarding and consolidation
• Maintaining Agent profiles and protocol endpoints

3.2 Security and Fraud Prevention

We use your information to protect the Platform and our users, including:

• Screening against OFAC sanctions lists and other watchlists
• Detecting and preventing fraudulent or suspicious activity
• Monitoring for Prohibited Items and prohibited activities
• Enforcing our Terms of Service and Acceptable Use Policy
• Investigating security incidents and unauthorized access attempts

3.3 Communications

We use your information to communicate with you about your account, service updates, security alerts, and other transactional communications. We will never send you unsolicited marketing emails without your explicit opt-in consent.

3.4 Legal Compliance

We use your information to comply with applicable laws, regulations, and legal processes, including responding to lawful subpoenas, court orders, and law enforcement requests (see Section 6).

3.5 Improvement and Analytics

We use aggregated, anonymized data to improve our services, analyze usage patterns, and develop new features. This data cannot be used to identify you individually.

4. We Never Sell or Share Your Data for Marketing

4.1 Limited Disclosure

We disclose your personal information only in the following circumstances:

• Service providers: We share information with third-party service providers who perform services on our behalf (see Section 5), subject to strict contractual obligations to protect your data and use it only for the purposes we specify
• Postal and CMRA compliance: For managed inbound service, we provide Form 1583 information and identification images to USPS systems and make required records available to the Postmaster, Postal Inspectors, the California Department of Consumer Affairs, law enforcement, courts, or other authorities only as permitted or required by applicable law
• Legal requirements: We may disclose information when required by law, regulation, legal process, or governmental request (see Section 6)
• Safety and security: We may disclose only information reasonably necessary, in good faith and as applicable law permits, to investigate, prevent, or address fraud, abuse, or a credible threat to the safety, rights, or property of the Company, our users, or the public
• Business transfers: In a genuine merger, acquisition, reorganization, bankruptcy, or sale of the business, information may transfer only to a lawful successor that assumes the applicable privacy, CMRA, and retention duties. Form 1583 and identification copies will not be separately sold, licensed, or treated as a data asset
• At your specific direction: We may disclose the particular information to the recipient and for the purpose you expressly authorize

4.2 No Third-Party Marketing

We do not provide your name, email address, phone number, physical address, Form 1583 information, identification copies, mail information, or other personal information to third parties for their own marketing, targeted advertising, promotional, profiling, data-brokerage, or AI-model-training purposes. This prohibition does not restrict the limited operational, Customer-directed, safety, transaction, or legal disclosures described in Section 4.1.

5. Third-Party Service Providers

5.1 Service Providers We Use

We work with the following categories of third-party service providers to operate the Platform:

5.2 Identity Verification

Stripe Identity — We use Stripe Identity for KYC identity verification. When you verify your identity through that workflow, Stripe processes your government-issued ID and biometric selfie. Stripe's handling of this data is governed by Stripe's Privacy Policy. We receive the verification result, a session identifier, and extracted identity fields. For an outbound-only account, we do not independently retain a copy of the underlying government-issued identity document after provider verification unless applicable law, valid legal process, or a documented legal hold requires it.

Managed inbound CMRA records — A different rule applies when you apply for or use managed inbound mailbox service. USPS Form 1583 requires two acceptable identification documents. We obtain clear copies of those documents and upload the required Form 1583 information and identification images to the USPS CMRA Customer Registration Database. Because the receiving Facility is in California, we retain Form 1583 and copies of both identification documents throughout service and for at least two years after the corresponding mailbox service terminates, even if USPS would otherwise permit earlier local deletion. These records are used only for identity verification, postal and CMRA compliance, account security, fraud prevention, service administration, and legally permitted disclosures described in Sections 4, 6, and 17.5.

5.3 Payment Processing

Stripe Payments — All payment processing is handled by Stripe. Your credit card number, CVV, and full payment details are transmitted directly to Stripe and are never stored on our servers. We receive only a tokenized reference, last four digits, expiration date, and transaction status. Stripe is PCI DSS Level 1 certified.

5.4 Outbound Mail Fulfillment

Outbound mail is fulfilled directly through facilities operated by or contracted with the Company. The PDF you submit, the recipient address, the return address, and any agent-supplied metadata are transmitted to the assigned facility's production system, where the piece is printed, enveloped, weighed, postage-applied, and tendered to the selected carrier (USPS, FedEx, UPS, or another configured carrier) using the service class and cost breakdown shown for the mail piece. We do not transmit the contents of your document to any third-party print-and-mail service such as Lob, PostGrid, or any similar SaaS print broker.

When the selected service class includes carrier tracking, carrier-generated tracking numbers and delivery scans are received from the carrier and surfaced to you via the dashboard, REST API, MCP, and webhooks. Once a mail piece has been handed off to USPS or another carrier, the carrier's privacy practices govern the in-transit handling of the piece and any tracking events.

5.5 File-Format Conversion

If you submit a non-PDF document (DOCX, XLSX, RTF, image formats, etc.) and the Outbound Mail cloud-conversion feature is enabled for your account, the file is transmitted to CloudConvert for conversion to PDF prior to printing. CloudConvert deletes uploaded files automatically per its privacy policy. Submissions in PDF, JPG, PNG, or TXT format are converted locally on our infrastructure and are never sent to a third-party converter.

5.6 Database and Infrastructure

Supabase — Our application database is hosted on Supabase, which provides PostgreSQL with row-level security, encryption at rest, and SOC 2 Type II compliance. Data is stored in secure, access-controlled environments.

Upstash — We use Upstash Redis for rate limiting and Upstash QStash for asynchronous job processing (webhook delivery, outbound mail dispatch, billing sweeps, notifications). QStash signs every job with our signing keys and never receives the contents of your documents.

Resend — Transactional email (verification, security alerts, owner notifications) is sent via Resend. Resend processes recipient addresses and email content solely to deliver the message.

Twilio — SMS notifications, the support-text proxy, and signup-time phone-carrier checks (Twilio Lookup v2) are processed via Twilio.

5.7 Analytics — Google Analytics and PostHog

The Platform uses two and only two analytics providers, both for our own first-party measurement of how the website and product are used. We do not allow either provider to use your data for their own advertising, model training, or third-party sharing.

• Google Analytics 4 (GA4) — captures aggregate website traffic, page views, sessions, traffic sources, and approximate geolocation derived from IP. We have IP anonymization enabled and do not enable Google Signals or advertising features. You can opt out by installing the Google Analytics Opt-Out Browser Add-on, by enabling Do Not Track, or by declining analytics cookies in our cookie banner.
• PostHog — captures first-party product telemetry such as page views inside the dashboard, button clicks, API call counts, and feature-adoption events tied to your account or anonymous session. PostHog is configured as a first-party analytics tool and is not used to build advertising audiences or to share data with third parties. You can opt out of PostHog telemetry by emailing privacy@mailbox.bot.

5.8 Hosting and CDN

Vercel — Our website and API are hosted on Vercel's infrastructure. Vercel may process request logs (IP, user agent, request path) in the course of serving the application.

5.9 Bot Protection

Cloudflare Turnstile — We use Cloudflare Turnstile to protect signup, contact, and mailing address request forms from automated abuse. Turnstile may collect device and browser signals to distinguish humans from bots, processed by Cloudflare under its privacy policy.

5.10 Contractual Protections

Third-party service providers are subject to contractual obligations or applicable published Data Processing Addenda requiring them to process data only for authorized purposes, maintain appropriate security measures, refrain from selling or using it for their own advertising, marketing, profiling, data brokerage, or model training, report security incidents as required, and return or delete it when instructed and legally permitted. A provider may retain information only for an applicable legal or contractual compliance period and remains subject to its confidentiality and use restrictions during that period.

6. Law Enforcement and Legal Disclosures

6.1 What We May Disclose

In response to valid legal process, we may disclose:

• Member identity verification records and KYC results, including Form 1583 and identification copies when responsive and lawfully required
• Managed inbound CMRA records made available to USPS, the Postmaster, Postal Inspectors, the California Department of Consumer Affairs, or a law enforcement agency conducting an investigation as postal or California law requires
• Account registration information and contact details
• Agent registration information and configuration data
• Package intake logs, photographs, and Content Scan images
• API access logs and webhook event logs
• Payment and billing records
• Communication records between you and the Company
• Any other information in our possession responsive to a lawful request

6.2 Voluntary Reporting

When we in good faith reasonably suspect illegal, fraudulent, dangerous, sanctioned, or abusive activity, we may contact an appropriate governmental agency and disclose information reasonably necessary to investigate, prevent, report, or mitigate that activity, as permitted by law. We may delay or omit notice when law prohibits notice or when notice could compromise an investigation or safety.

6.3 Preservation Requests

We honor lawful preservation requests from law enforcement and will preserve relevant records for the period specified, or 180 days if no period is specified.

7. Data Security

7.1 Encryption

We implement strong encryption to protect your data:

• Encryption in transit: All data transmitted between your browser or application and our servers is encrypted using TLS 1.2 or higher (HTTPS). All API communications require HTTPS. Unencrypted HTTP requests are automatically redirected to HTTPS.
• Encryption at rest: All data stored in our database is encrypted at rest using AES-256 encryption. This includes your personal information, package data, photographs, and all associated metadata.
• Key management: Encryption keys are managed through industry-standard key management practices with regular rotation and strict access controls.

7.2 Access Controls

We maintain strict access controls to protect your data:

• Role-based access control (RBAC): Access to Member data is restricted to authorized personnel on a need-to-know basis
• Row-level security: Our database enforces row-level security policies ensuring that Members can only access their own data through the API
• API authentication: All API access requires valid authentication credentials (API keys or session tokens) scoped to specific permissions
• Multi-factor authentication: Administrative access to our systems requires multi-factor authentication
• Principle of least privilege: Employees and systems are granted the minimum access necessary to perform their functions

7.3 Infrastructure Security

• Our infrastructure is hosted on SOC 2 Type II compliant platforms
• We conduct regular security assessments and vulnerability scanning
• We maintain security monitoring and alerting for suspicious activity
• Database backups are encrypted and stored in geographically separate locations
• We maintain an incident response plan for security events

7.4 Facility Security

Our physical Facilities where packages are received and stored employ security measures including restricted access, security monitoring, and inventory tracking. Only authorized personnel are permitted to handle packages.

7.5 Security Limitations

While we implement commercially reasonable security measures, no system is 100% secure. We cannot guarantee the absolute security of your data. In the event of a security breach that affects your personal information, we will notify you in accordance with applicable law.

The managed inbound mailbox service is not represented as HIPAA-compliant, and Golden Ratio, LLC is not agreeing to act as a HIPAA business associate unless a separate signed agreement expressly says otherwise. The managed inbound operation has not been independently examined under SOC 1 or SOC 2 and does not currently provide a SOC report or attestation. A hosting or infrastructure provider's certification does not make mailbox.bot's own operations SOC-attested.

8. Data Retention

8.1 Retention Periods

We retain your information for the following periods:

• Account information: For the duration of your account plus five (5) years after account closure
• Non-CMRA verification metadata and KYC results: For the duration of your account plus up to five (5) years after account closure when reasonably necessary for fraud investigation, disputes, audit, security, or other disclosed compliance purposes; this category does not include the separate underlying CMRA identification copies described below
• Managed inbound California CMRA records: Each Form 1583 and copies of both identification documents are retained throughout service and for at least two (2) years after service to that specific customer or addressee terminates; the California acknowledgment and related service-of-process record are retained through at least the same two-year post-termination period
• Package records and photographs: For the duration of your account plus five (5) years after account closure
• Content Scan images: For the duration of your account plus five (5) years after account closure
• API access logs: Rolling twelve (12) month retention
• Webhook delivery logs: Rolling twelve (12) month retention
• Payment records: Seven (7) years for tax and accounting compliance
• Mailing address request data: Until you request removal or your account is created
• Analytics data: Aggregated analytics data is retained indefinitely; raw analytics data is retained for twenty-six (26) months per Google Analytics default settings

8.2 Extended Retention

We may retain information beyond the standard retention periods if required by postal or other law, regulation, valid legal process, or a litigation or regulatory hold; reasonably necessary and proportionate to investigate or document suspected fraud, illegal activity, a security or safety incident, or a pending claim or dispute; or subject to a lawful preservation request.

8.3 Deletion

When data reaches the end of its retention period and no exception applies, it is permanently deleted or irreversibly anonymized. Deletion is performed through secure deletion procedures that render the data unrecoverable.

9. Cookies and Tracking Technologies

9.1 What Cookies We Use

We use the following categories of cookies:

• Essential cookies: Required for the Platform to function, including session management and authentication. These cookies cannot be disabled.
• Analytics cookies: Google Analytics cookies (_ga, _gid) and PostHog cookies (used for first-party product telemetry). These can be declined in our cookie banner. See Section 5.7.
• Security cookies: Cloudflare Turnstile cookies used for bot protection on signup, contact, and mailing address request forms.
• Preference cookies: Cookies that store your preferences, such as cookie consent status.

9.2 Cookie Consent

When you first visit our website, we present a cookie consent banner. You may accept or decline non-essential cookies. Your preference is stored and respected across sessions. You can change your cookie preferences at any time by clearing your browser cookies and revisiting the site.

9.3 Do Not Track

We respect Do Not Track (DNT) browser signals. When we detect a DNT signal, we disable non-essential analytics tracking for that session.

9.4 No Cross-Site Tracking

We do not engage in cross-site tracking. We do not use advertising cookies, retargeting pixels, or any technology that tracks your activity across other websites. We do not participate in ad networks or behavioral advertising programs.

10. Your Rights

10.1 Access

You have the right to request access to the personal information we hold about you. We will provide a copy of your data in a structured, machine-readable format within thirty (30) days of a verified request.

10.2 Correction

You have the right to request correction of inaccurate or incomplete personal information. You can update most account information directly through the Operator Dashboard or by contacting us.

10.3 Deletion

You have the right to request deletion of your personal information, subject to the following exceptions:

• For managed inbound California CMRA service, Form 1583 and copies of both identification documents throughout service and for at least two (2) years after service to the corresponding customer or addressee terminates, together with the California acknowledgment and related records during the applicable legal period
• Other verification metadata retained for the disclosed period when reasonably necessary for fraud, security, dispute, audit, or compliance purposes
• Records subject to a legal hold, pending litigation, or law enforcement request
• Information necessary to complete a pending transaction or fulfill a contractual obligation
• Records required for tax, accounting, or regulatory compliance

To request deletion, email with the subject "Data Deletion Request." We will process your request within thirty (30) days and confirm deletion in writing.

10.4 Portability

You have the right to receive your personal data in a portable, machine-readable format (JSON or CSV). This includes your account information, Agent configurations, package records, and API logs.

10.5 Restriction of Processing

You have the right to request that we restrict the processing of your personal information in certain circumstances, such as when you contest the accuracy of your data or when processing is no longer necessary but you need the data for legal claims.

10.6 Objection

You have the right to object to our processing of your personal information for analytics and improvement purposes. To exercise this right, email .

10.7 Withdrawal of Consent

Where our processing of your information is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing conducted prior to withdrawal.

10.8 Non-Discrimination

We will not discriminate against you for exercising any of your privacy rights. You will not receive a different level of service or pricing for making a privacy request.

10.9 Exercising Your Rights

To exercise any of these rights, contact us at . We will verify your identity before processing any request to protect against unauthorized access. We will respond to all verified requests within thirty (30) days.

11. California Privacy Rights (CCPA/CPRA)

11.1 Categories of Personal Information

Under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), California residents have specific rights regarding their personal information. In the preceding twelve (12) months, we have collected the following categories of personal information:

• Identifiers: name, email address, phone number, home or business address, IP address, account name, government-issued identification number, signature, and visual copies of identification documents
• Personal information under Cal. Civ. Code 1798.80(e): name, address, phone number, signature, government identification information, financial information, and other information contained in customer records
• Biometric information: facial geometry data (processed by Stripe Identity for KYC verification only, not stored by us after verification)
• Sensitive and communication content: the contents of managed inbound mail, scans, images, OCR, legal documents, financial information, health information, credentials, and related handling instructions when collected through the service
• Internet or electronic network activity: browsing history on our site, API usage logs, interaction with the Platform
• Geolocation data: approximate location derived from IP address
• Professional or employment-related information: only if voluntarily provided during registration

11.2 Your California Rights

As a California resident, you have the right to:

• Know what personal information we collect, use, disclose, and sell (we sell none)
• Delete your personal information (subject to legal exceptions)
• Opt out of the sale of your personal information (we do not sell personal information, so no opt-out is necessary, but you may still submit a request)
• Opt out of sharing for cross-context behavioral advertising (we do not share for this purpose)
• Correct inaccurate personal information
• Limit use and disclosure of sensitive personal information to what is necessary for the services
• Non-discrimination for exercising your CCPA/CPRA rights

11.3 Authorized Agents

California residents may designate an authorized agent to submit privacy requests on their behalf. Authorized agents must provide written authorization from the consumer and verify their own identity. We may deny requests from agents who cannot provide adequate proof of authorization.

11.4 California Consumer Complaint

Pursuant to California Civil Code §1789.3, California residents may contact the Complaint Assistance Unit of the Division of Consumer Services at 1625 North Market Blvd., Suite N 112, Sacramento, CA 95834, or by telephone at (800) 952-5210.

11.5 Shine the Light

Under California Civil Code §1798.83, California residents may request information regarding the disclosure of personal information to third parties for direct marketing purposes. As stated in this Policy, we do not disclose personal information to third parties for their direct marketing purposes.

12. International Users

12.1 Data Location

The Platform is operated from the United States. If you access the Platform from outside the United States, your information will be transferred to, stored, and processed in the United States. By using the Platform, you consent to this transfer.

12.2 GDPR (European Users)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, the following additional provisions apply:

• Legal basis: We process your personal data based on contractual necessity (to provide the services you requested), legitimate interests (security, fraud prevention, service improvement), legal obligations (KYC, sanctions screening, law enforcement cooperation), and consent (where applicable, such as for analytics cookies)
• Data transfers: Transfers of personal data from the EEA to the United States are conducted in compliance with applicable data transfer mechanisms
• Data Protection Officer: For GDPR-related inquiries, contact
• Supervisory authority: You have the right to lodge a complaint with your local data protection supervisory authority

13. Children's Privacy

The Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we learn that we have collected personal information from a child under 18, we will promptly delete that information. If you believe a child under 18 has provided us with personal information, please contact us at .

14. Data Breach Notification

14.1 Our Commitment

In the event of a data breach that compromises your personal information, we will:

• Notify affected individuals via email within seventy-two (72) hours of discovering the breach, or as soon as reasonably practicable
• Notify applicable regulatory authorities as required by law
• Provide a clear description of what happened, what information was involved, what we are doing to address it, and what steps you can take to protect yourself
• Offer appropriate remediation, which may include credit monitoring services for breaches involving sensitive personal information

14.2 Incident Response

We maintain a documented incident response plan that includes procedures for identifying, containing, investigating, and remediating security incidents. Our response team is trained and prepared to act swiftly in the event of a breach.

15. Aggregated and Anonymized Data

15.1 Use of Aggregated Data

We may create aggregated, anonymized, or de-identified data from your personal information. This data cannot reasonably be used to identify you. We may use aggregated data for:

• Service improvement and feature development
• Industry reports and benchmarking (e.g., average package volumes, carrier distribution statistics)
• Training and improving AI models used in the Platform
• Marketing and promotional materials (only aggregate statistics, never individual data)

We do not use Form 1583 records, identification-document copies, biometric verification data, or identifiable mail contents to train AI models, create advertising audiences, or build data-broker products. We maintain de-identified information in de-identified form and do not attempt to reidentify it except when reasonably necessary to test whether the de-identification process remains effective.

15.2 Opt-Out of Aggregated Data Use

You may opt out of having your data included in aggregated datasets by emailing with the subject "Opt-Out: Aggregated Data." We will honor your request within thirty (30) days.

16. Agent, API, MCP, and A2A Data

The Platform exposes its outbound mail capabilities to AI agents and developers via REST API, MCP (Model Context Protocol), A2A (Agent-to-Agent), and OpenClaw. This section describes the data we collect and retain in connection with those programmatic interfaces.

16.1 Agent Profile Data

Agent profiles hosted at [agent-slug].mailbox.bot may be publicly accessible. Information you include in an Agent's profile (name, description, capabilities, protocol endpoints) is visible to anyone who accesses the profile URL. Do not include sensitive personal information in Agent profiles.

16.2 API, MCP, and A2A Request Data

Data transmitted through the REST API, MCP server, A2A endpoint, or OpenClaw integration (including outbound mail submissions, recipient addresses, document files, agent metadata, and webhook payloads) is encrypted in transit (TLS 1.2+) and at rest (AES-256). We log request/response metadata (endpoint, status code, latency, IP, user agent, agent identifier, idempotency key) to operate, secure, and bill the Platform. API access logs are retained for twelve (12) months. We do not read or analyze the body of your document submissions beyond what is necessary to print, address, weigh, postage, and dispatch the piece.

16.3 API Keys and Credentials

API keys (member, agent, and facility scopes) and webhook signing keys are issued by the Platform and shown only once at creation. We store a salted hash of the secret portion server-side; we cannot recover the original secret. You are responsible for protecting these credentials. See the Terms of Service for the full credential-security obligations and the Company's position on liability for credential compromise.

16.4 Agent Decision and Activity Logs

For accounts with agents configured, decision logs — which rule triggered, what action was taken, the MAILBOX.md version in effect at the time, and the corresponding API/MCP context — are available to the Account Holder via the dashboard and API. Decision logs are retained for the duration of your account plus five (5) years.

16.5 Webhook Security

Webhook payloads are signed with your webhook signing key (HMAC-SHA256, format whsk_prefix:t=ts,v1=hmac) so that you can verify their authenticity. We recommend always verifying webhook signatures and rotating signing keys periodically. Webhook delivery logs (event metadata, delivery attempts, response status) are retained for twelve (12) months and are also surfaced to you via the dashboard's API Logs / Webhook Sandbox view.

17. Mail and Document Privacy

17.1 Outbound Document Content

When you submit a document for outbound mailing, the PDF (or other supported format) is uploaded to our private object storage, encrypted at rest, and transmitted to the assigned facility's production system for printing. The document is accessible only to (a) you and any agent credentials you have authorized, (b) authorized Company personnel and the facility's production staff with a legitimate operational need to print, envelope, weigh, and dispatch the piece, and (c) law enforcement pursuant to valid legal process. We do not read, parse, train models on, or sell the contents of your documents.

17.2 Fulfillment Photo Proof

For each outbound mail piece, the facility may capture photo evidence of one or more steps in the production lifecycle (printed pages, sealed envelope, postage label, carrier drop-off). These photos are stored with the same encryption and access controls as your document and are surfaced to you via the dashboard, REST API, MCP, and webhooks. Photo proof documents the drop-off event and does not constitute proof of delivery.

17.3 Recipient Address Data

Recipient addresses you submit are used solely to address and dispatch the corresponding mail piece, to compute postage, and to satisfy carrier tendering requirements. We do not enrich, sell, share, or repurpose recipient address data for marketing, advertising, list-building, or any other purpose.

17.4 Document Retention

Outbound document files are retained for the duration of your account (so that you and your agent can audit historical sends) plus up to seven (7) years for tax, billing-dispute, and audit purposes, after which they are deleted or irreversibly anonymized. You may request earlier deletion of specific document files by emailing , subject to legal-hold and active-litigation exceptions described in Section 8.

17.5 Inbound Mail Evidence and Managed Receiving

Inbound forwarding aliases are used for digital context that you or your provider choose to send to mailbox.bot, such as envelope photos, opened-mail photos, scan PDFs, provider notices, and notes. Managed mailboxes and eligible physical-package receiving are governed by the accepted Inbound Mailbox Rental Terms. Those services may generate exterior images, intake and custody records, sender and addressee information, handling instructions, forwarding data, and, when authorized or otherwise lawful, opened-mail images, scans, OCR, and related metadata.

We do not intentionally read or analyze the substantive contents of managed inbound mail or packages for curiosity, advertising, profiling, AI-model training, competitive intelligence, or another purpose unrelated to providing, securing, or lawfully administering the service. Physical-mail operations cannot be entirely content-blind, however. Authorized Company and Facility personnel and purpose-limited contracted processors may see labels, identification records, words, images, or other mail or package contents, directly or incidentally, only to the extent reasonably necessary to verify identity; comply with USPS and California CMRA requirements; receive, secure, open, position, scan, photograph, count, quality-check, forward, return, or otherwise perform an authorized action; provide Customer-requested support; prevent fraud or safety threats; or comply with law. By accepting the Inbound Mailbox Rental Terms and requesting or, after approval, provisioning a mailbox, the Customer acknowledges and permits that limited necessary access. Renting a mailbox alone is not blanket authorization to open every sealed Item; opening still requires an authenticated Customer instruction or another lawful basis under the Inbound Mailbox Rental Terms. We do not sell or rent these records, use them for advertising or AI-model training, or disclose them for another party's own unrelated commercial purpose.

For managed inbound service at the California Facility, we upload required Form 1583 information and clear copies of both required identification documents to the USPS CMRA Customer Registration Database and retain Form 1583 and both identification copies throughout service and for at least two years after service to the corresponding customer or addressee terminates. We may make those records available to USPS, the Postmaster, Postal Inspectors, the California Department of Consumer Affairs, investigating law enforcement, courts, regulators, or other authorities only as postal or other applicable law permits or requires. These are limited compliance and legal disclosures; the records are not public and are not provided to ordinary private inquirers.

18. Changes to This Privacy Policy

18.1 Notification of Changes

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Post the updated Privacy Policy on this page with a new "Last Updated" date
• Notify you via email at least thirty (30) days before the changes take effect
• Provide a summary of material changes
• For significant changes affecting your rights, give you the opportunity to review and consent before the changes take effect

18.2 Continued Use

Your continued use of the Platform after the effective date of an updated Privacy Policy constitutes your acceptance of the updated terms. If you disagree with any changes, you may terminate your account before the effective date.

19. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Golden Ratio, LLC dba Mailbox.bot
Privacy Inquiries
3556 S 5600 W #1-1038
West Valley City, UT 84120
Email:
General Support:

We will acknowledge receipt of all privacy-related inquiries within two (2) business days and provide a substantive response within thirty (30) days.