Privacy policy.

01Who is responsible

Exige is the controller for the data described on this page, except for the content of the mailboxes we host for customers, where the customer is the controller and we are the processor (section 5). We are a small company and have no appointed data protection officer; the email above reaches the person who runs the service.

02Visiting the site

• Hosting. outboxes.io is served by Cloudflare. To deliver pages and block attacks, Cloudflare processes your IP address and request headers and keeps short-lived logs. We do not see individual visitors.
• Analytics. We use Cloudflare Web Analytics. It sets no cookies, does not fingerprint your browser and does not track you across sites. We see page views, referrers, countries and browser types in aggregate.
• Fonts. The pages load their typefaces from Google Fonts, so your browser sends its IP address to Google when it fetches them. Google's fonts privacy note describes what it keeps.
• No cookies, no pixels. The site sets no cookies of its own and carries no advertising or social-media tracking code. If you arrive from an ad, the link carries campaign tags that our analytics counts in aggregate; nothing is stored in your browser.

Legal basis: our legitimate interest (Article 6(1)(f) GDPR) in running a secure website and knowing roughly how it is used.

03Ordering

• Checkout runs on Stripe. You enter your name, email, company, billing address, VAT number if you have one, your card details, and three answers: sender names, the sequencer you use, and whether you bring domains or we buy them. Card numbers go to Stripe only; we never see them. Stripe Payments Europe Ltd (Dublin) processes payments on our behalf and is also an independent controller for fraud prevention and its own legal duties, under Stripe's privacy policy.
• Our order system, a small application on Cloudflare Workers with a Cloudflare D1 database, stores the order: order number, Stripe customer and subscription identifiers, your name, email, company, plan, quantity, amount, your three answers, the order status and its history, notes we write to you, the DNS records we show you, and the files we deliver (the CSV with your mailbox credentials). Your private order page reads from it.
• Order alerts. When an order arrives, the system sends one message to the WhatsApp account of the person who reviews orders, with the order number, plan, your name and email, and the sender names, so a human can look at it within the hour. That message travels through WhatsApp (Meta Platforms Ireland), end-to-end encrypted, to a single phone.
• Invoices and receipts are issued by Stripe and kept for as long as accounting law requires.
• Refused orders keep their record with the status "refused" and the reason, so a repeated attempt is recognised. The refund goes back through Stripe.

Legal basis: performance of the contract (Article 6(1)(b)), our legal obligations for invoicing and accounting (Article 6(1)(c)), and our legitimate interest in preventing abuse of the service (Article 6(1)(f)).

04Domain registration

If you ask us to buy domains, we register them through Cloudflare Registrar with you as the registrant. Your name, company, postal address, email and phone number, where you gave one, go to Cloudflare and to the registry of the domain ending (for example Verisign for .com) as registrant data. Cloudflare redacts the public WHOIS record by default. Legal basis: the contract (Article 6(1)(b)).

05Your mailboxes and the mail in them

• The mailboxes live on servers we operate at Hetzner Online GmbH in Germany. The sender names you give become the display names of the mailboxes; if those are real people at your company, they are their personal data and you are responsible for having a basis to use them.
• The content of what you send and receive, and the people you write to, are your data. You are the controller and we are the processor. The processing agreement is section 11 of the terms.
• We do not read, analyse or sell mailbox content. Automated filters scan for malware, spam signatures and abuse patterns, and enforce sending limits. A person looks at content only when troubleshooting, an abuse complaint or a legal obligation requires it.
• Mail server logs (addresses, timestamps, delivery results, never bodies) are kept for up to 30 days for troubleshooting and abuse investigation.
• Where you asked for it, replies are forwarded to the address you chose; a copy may remain in the mailbox until it is deleted.

06If you received an email from a mailbox we host

In this situation we hold your email address and the messages exchanged with the customer's mailbox, as their processor, for as long as the customer keeps the mailbox (section 10).

07Email and support

[email protected] runs on our own mail servers at Hetzner in Germany. What you write to us, and our replies, stay there as long as the customer relationship needs them and for up to two years after the last exchange, longer only if a dispute requires it. Legal basis: the contract, or our legitimate interest in answering you.

08Who else sees data

We do not sell data, share it with advertising networks, or hand it to anyone else, except authorities when the law obliges us to.

09Data outside the EU

Mail content stays on our servers in Germany. Order data, payment data, the order alert and font requests may be processed in the United States by Stripe, Cloudflare, Meta and Google. Each of them is certified under the EU–US Data Privacy Framework and offers the European Commission's Standard Contractual Clauses, which is what we rely on for those transfers.

10How long we keep things

11Your rights

Under the GDPR you can ask us for access to your data, correction, deletion, restriction, a portable copy, and you can object to processing based on our legitimate interests. Write to [email protected]; we answer within a month. For data in a customer's mailbox, we forward your request to that customer, who decides as controller.

You can also complain to the Luxembourg supervisory authority, the Commission nationale pour la protection des données (CNPD), 15 boulevard du Jazz, L-4370 Belvaux, cnpd.public.lu, or to the authority of your own EU country.

12Security, children, changes

• Security. Encrypted transport (TLS) for the site, the API and mail; DKIM-signed outbound mail; server access restricted to authorised staff; credentials delivered only through your private order page; backups within the EU. If a breach affects you, we tell you without undue delay.
• Children. The service is for businesses and not intended for anyone under 18.
• Changes. This page carries its date at the top. Material changes are emailed to customers before they take effect.