Privacy Policy
Last updated: October 1, 2026
Privacy is the reason Privbox exists. This policy explains, in plain language, what data we handle, why, and the control you have over it.
1. Who is responsible for your data
[COMPANY NAME], registered under [TAX ID], with its address at [COMPANY ADDRESS], is the controller of the personal data described in this policy. For any privacy question or request, write to [email protected]. Our data protection officer can be reached at the same address.
2. Our approach
- We collect the minimum data needed to run an email service.
- We do not show ads, we do not sell data, and we do not use your messages to profile you.
- You do not need to give us a phone number or another email address to sign up.
- Our servers are in the Netherlands, inside the European Union.
3. What we collect
| Data | Why | Legal basis |
|---|---|---|
| Your address and account settings | To create and run your account | Performance of contract |
| Your password | To let you sign in. It is stored only as a one-way hash by our mail server; we cannot read it | Performance of contract |
| Emails, contacts, calendars and files | To store and deliver them for you | Performance of contract |
| Email metadata (sender, recipient, date, size) | To deliver mail, filter spam and investigate delivery problems | Performance of contract and legitimate interest |
| IP addresses and access logs | To protect accounts against attacks and abuse | Legitimate interest |
| Record of your acceptance of the Terms (version, date, IP) | To prove consent and comply with the law | Legal obligation |
| Billing details (name, billing email, country, payment status) | To charge paid plans and issue invoices. Card data is handled by Stripe; we never see or store your card number | Performance of contract and legal obligation |
4. Your messages
Messages travel encrypted between servers whenever the other server supports it (TLS). Our staff do not read your messages. Automated systems scan incoming mail only to filter spam and malware.
Email is an open protocol: messages you exchange with people on other providers are also stored by those providers, under their own policies. When you forward mail to an external address, a copy is delivered to that provider.
5. Cookies
We use only strictly necessary cookies: one to keep you signed in, and the cookies set by Cloudflare Turnstile to tell people from bots on our sign-up and sign-in forms. We do not use advertising or analytics cookies, so we do not ask for cookie consent.
6. Who we share data with
We share data only with the service providers we need to run Privbox, under contracts that protect your data:
| Provider | Purpose | Location |
|---|---|---|
| Leaseweb Netherlands B.V. | Server hosting | Netherlands (EU) |
| Cloudflare, Inc. | DNS, protection against attacks, bot detection (Turnstile) | Global network |
| Stripe | Payment processing for paid plans | EU and United States |
Some of these providers may process data outside your country or the European Economic Area. When that happens, the transfer is protected by the safeguards required by law, such as standard contractual clauses.
We also disclose data when legally required by a valid order from a competent authority, limited to what the order requires, as explained in our Terms of Service.
7. How long we keep data
- Account and content: while your account exists. You can delete messages at any time.
- After you close your account: your data is deleted within 30 days, and removed from backups within a further [X] days.
- Access and security logs: [X] days.
- Billing records: for the period required by tax law, which may be up to [X] years.
8. How we protect data
We use encryption in transit, strict access controls, firewalls, automatic blocking of attacks, two-factor authentication for administrators, and encrypted off-site backups. Access to production systems is limited to the people who need it to run the Service.
9. Your rights
Under the EU General Data Protection Regulation (GDPR), the Brazilian General Data Protection Law (LGPD) and similar laws, you have the right to:
- know whether we process your data and get a copy of it;
- correct inaccurate or incomplete data;
- have your data deleted or anonymized;
- receive your data in a portable format;
- object to or restrict processing based on legitimate interest;
- withdraw consent where processing is based on consent;
- complain to a data protection authority, such as the ANPD in Brazil or the authority of your EU country.
To exercise any of these rights, write to [email protected] from your Privbox address. We answer within 15 days, or sooner when the law requires it.
10. Children
Privbox is not intended for people under 16. If we learn that an account belongs to someone below that age without valid parental consent, we will close it.
11. Changes to this policy
If we make significant changes to this policy, we will notify you by email or inside the Service at least 30 days before they take effect. The date at the top shows when it was last updated.