Privacy policy.

01Who is responsible

Exige is the controller for the data described on this page, except for the content of the mailboxes we host for customers, where the customer is the controller and we are the processor (section 5). We are a small company and have no appointed data protection officer; the email above reaches the person who runs the service.

02Visiting the site

• Hosting. outboxes.io is served through Cloudflare. To deliver pages and block attacks, hosting providers process your IP address and request headers and keep operational logs.
• Analytics. We use Cloudflare Web Analytics. It sets no cookies, does not fingerprint your browser and does not track you across sites. We see page views, referrers, countries and browser types in aggregate.
• Optional page analytics. Only if you choose “Allow analytics”, we measure the public pages you view, time while the tab is visible, scroll depth, whether you reach pricing, open FAQs, or click checkout or email contact links, and campaign parameters supplied in the link. A random identifier in session storage groups pages in a browser tab for up to 30 minutes. We store these records in our existing Cloudflare database for up to 30 days plus the daily deletion interval. We do not record your screen, typed text, form contents, IP address or raw Google click identifier in these records. We do not track the customer space or payment pages with this feature. Coverage is limited to consenting visits.
• Your analytics choice. Accepting and declining are equally available. We remember your choice in local storage for 180 days, solely to respect that choice. You can change it or withdraw consent at any time using “Analytics preferences” in the footer. Declining or withdrawing stops optional measurement and removes its session identifier. We also respect Do Not Track and Global Privacy Control signals. This optional measurement relies on your consent (Article 6(1)(a) GDPR).
• Fonts. The pages load their typefaces from Google Fonts, so your browser sends its IP address to Google when it fetches them. Google's fonts privacy note describes what it keeps.
• No cookies on the marketing site. outboxes.io sets no cookies of its own and carries no social-media tracking code. The customer space at app.outboxes.io sets one strictly necessary cookie after you sign in (a random session identifier, 30 days, first-party, HttpOnly); it is not used for tracking.
• Ads measurement, without cookies. While we run Google Ads the pages carry Google's conversion tag in its cookieless mode: it sets no cookies and stores nothing in your browser. If you arrive from a Google ad, the click identifier in the link is reported to Google when you click a checkout button and is attached to your Stripe order, so we can count which ads led to orders. It is not used for ad personalisation.

Legal basis for operational hosting and aggregate Cloudflare measurement: our legitimate interest (Article 6(1)(f) GDPR) in running a secure website and knowing roughly how it is used. Optional page analytics uses consent as described above.

03Ordering

• Checkout runs on Stripe. You enter your name, email, company, billing address, VAT number if you have one, your card details, and three answers: sender names, the sequencer you use, and whether you bring domains or we buy them. Card numbers go to Stripe only; we never see them. Stripe Payments Europe Ltd (Dublin) processes payments on our behalf and is also an independent controller for fraud prevention and its own legal duties, under Stripe's privacy policy.
• Our order system, a small application on Cloudflare Workers with a Cloudflare D1 database, stores the order: order number, Stripe customer and subscription identifiers, your name, email, company, plan, quantity, amount, your three answers, the order status and its history, notes we write to you, the DNS records we show you, and the files we deliver (the CSV with your mailbox credentials). Your private order page reads from it.
• Order alerts. When an order arrives, the system sends one message to the WhatsApp account of the person who reviews orders, with the order number, plan, your name and email, and the sender names, so a human can look at it within the hour. That message travels through WhatsApp (Meta Platforms Ireland), end-to-end encrypted, to a single phone.
• Your account. When you pay we create a customer account under the email you paid with: name, company, VAT number and country as entered at checkout, your Stripe customer identifier, and later the password you choose (stored only as a salted hash) or the identifier of the Google account you sign in with. Google sign-in gives us your verified email address and nothing else. We use the account to show you your orders and to email you about them: order confirmation, DNS records to add, delivery of your mailboxes, refusals, password resets. Sign-in sessions live on our servers and expire after 30 days.
• Client registry. We keep the customer data above for the life of the relationship and the accounting retention period, and may contact you by email about the service you bought (changes, renewals, problems with your mailboxes). We do not sell or rent it.
• Invoices and receipts are issued by Stripe and kept for as long as accounting law requires.
• Refused orders keep their record with the status "refused" and the reason, so a repeated attempt is recognised. The refund goes back through Stripe.

Legal basis: performance of the contract (Article 6(1)(b)), our legal obligations for invoicing and accounting (Article 6(1)(c)), and our legitimate interest in preventing abuse of the service (Article 6(1)(f)).

04Domain registration

If you ask us to buy domains, we register them through Cloudflare Registrar with you as the registrant. Your name, company, postal address, email and phone number, where you gave one, go to Cloudflare and to the registry of the domain ending (for example Verisign for .com) as registrant data. Cloudflare redacts the public WHOIS record by default. Legal basis: the contract (Article 6(1)(b)).

05Your mailboxes and the mail in them

• The mailboxes live on servers we operate at Hetzner Online GmbH in Germany. The sender names you give become the display names of the mailboxes; if those are real people at your company, they are their personal data and you are responsible for having a basis to use them.
• The content of what you send and receive, and the people you write to, are your data. You are the controller and we are the processor. The processing agreement is section 11 of the terms.
• We do not read, analyse or sell mailbox content. Automated filters scan for malware, spam signatures and abuse patterns, and enforce sending limits. A person looks at content only when troubleshooting, an abuse complaint or a legal obligation requires it.
• Mail server logs (addresses, timestamps, delivery results, never bodies) are kept for up to 30 days for troubleshooting and abuse investigation.
• Where you asked for it, replies are forwarded to the address you chose; a copy may remain in the mailbox until it is deleted.

06If you received an email from a mailbox we host

In this situation we hold your email address and the messages exchanged with the customer's mailbox, as their processor, for as long as the customer keeps the mailbox (section 10).

07Email and support

[email protected] runs on our own mail servers at Hetzner in Germany. What you write to us, and our replies, stay there as long as the customer relationship needs them and for up to two years after the last exchange, longer only if a dispute requires it. Legal basis: the contract, or our legitimate interest in answering you.

08Who else sees data

We do not sell data, share it with advertising networks, or hand it to anyone else, except authorities when the law obliges us to.

09Data outside the EU

Mail content stays on our servers in Germany. Order data, payment data, the order alert and font requests may be processed in the United States by Stripe, Cloudflare, Meta and Google. Each of them is certified under the EU–US Data Privacy Framework and offers the European Commission's Standard Contractual Clauses, which is what we rely on for those transfers.

10How long we keep things

11Your rights

Under the GDPR you can ask us for access to your data, correction, deletion, restriction, a portable copy, and you can object to processing based on our legitimate interests. Write to [email protected]; we answer within a month. For data in a customer's mailbox, we forward your request to that customer, who decides as controller.

You can also complain to the Luxembourg supervisory authority, the Commission nationale pour la protection des données (CNPD), 15 boulevard du Jazz, L-4370 Belvaux, cnpd.public.lu, or to the authority of your own EU country.

12Security, children, changes

• Security. Encrypted transport (TLS) for the site, the API and mail; DKIM-signed outbound mail; server access restricted to authorised staff; credentials delivered only through your private order page; backups within the EU. If a breach affects you, we tell you without undue delay.
• Children. The service is for businesses and not intended for anyone under 18.
• Changes. This page carries its date at the top. Material changes are emailed to customers before they take effect.