Effective date: [EFFECTIVE DATE]
1. Controller
[COMPANY NAME], [REGISTERED ADDRESS], company number [REGISTRATION NUMBER], is the controller for personal data described in this policy. Contact for privacy questions: privacy@eoinbox.com. [IF REQUIRED: data protection officer contact.]
2. Summary
- Your mail and account data are stored in the European Union.
- We use your data to provide the service, not for advertising. We do not sell data.
- eoinbox does not use end-to-end encryption, so our systems process the content of your mail to deliver, filter and index it. See why.
- This website uses no analytics, no tracking and no cookies. It stores your light / dark theme choice in your browser only.
3. Data we process
| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Account data | Login, recovery address, plan, settings | Running your account | Contract |
| Mail data | Messages, attachments, folders, contacts | Delivering, storing, filtering and searching your mail | Contract |
| Domain data | Domain names, DNS check results, DMARC and TLS reports | Connecting and monitoring your domains | Contract |
| Security data | Sign-in history, IP addresses, devices, audit logs | Protecting your account, preventing abuse | Legitimate interest |
| Billing data | Plan, subscription status, country | Billing, provided through Creem | Contract, legal obligation |
| Support | Messages you send us | Answering you | Contract, legitimate interest |
Payment card details are handled by Creem as merchant of record, not by us.
4. Mail from other people
Messages you receive contain personal data of their senders. We process it on your behalf to provide the service.
5. Spam and abuse filtering
Incoming and outgoing mail is checked automatically for spam, malware and abuse. [DESCRIBE: whether and when a person may look at a specific message, e.g. only at your request in a support case, or when required by law.]
6. Service providers
| Provider | Purpose | Location |
|---|---|---|
| [HOSTING PROVIDER] | Servers and storage | EU, [COUNTRY] |
| [OBJECT STORAGE PROVIDER] | Encrypted storage of messages and backups | EU, [COUNTRY] |
| Creem ([CREEM LEGAL ENTITY]) | Payments, merchant of record | [LOCATION] |
| [EMAIL PROVIDER FOR SYSTEM MESSAGES, IF ANY] | [PURPOSE] | [LOCATION] |
7. Retention
- Mail: until you delete it or close your account.
- Deleted accounts: data removed within [DELETION PERIOD].
- Backups: up to [BACKUP RETENTION].
- Security logs: [LOG RETENTION].
- Billing records: as required by tax law, [PERIOD].
8. Your rights
Under the GDPR you can access, correct, export and delete your data, restrict or object to processing, and complain to a supervisory authority ([LEAD SUPERVISORY AUTHORITY]). Most of this you can do yourself in settings; for anything else write to privacy@eoinbox.com.
9. Requests from authorities
[TO BE WRITTEN: law enforcement request policy, user notification where legally allowed, transparency report.]
10. Changes
We will notify you by email of material changes to this policy.