Privacy policy

Last updated: 14 October 2026

This policy explains how Individual Entrepreneur BLANKET BYTE ("we") handles personal data when you use Poofbox at poofboxmail.com, its mail domains and its MCP server. The short version: we collect as little as possible, keep it in Germany, delete it when your access ends, never sell it and do not track you.

Controller

Individual Entrepreneur BLANKET BYTE, identification number 305834292, University Street 17a, Floor 10, Vake district, Tbilisi, Georgia. Contact: poofbox@blanketbyte.com.

What we process and why

• Subscription data. When you subscribe, our payment provider Creem shares with us your email address, its customer, order and subscription identifiers, and the plan and renewal dates. We use them to run your subscription, to send you your license key and, if you ask, a link to replace a lost key (legal basis: performance of a contract, Art. 6(1)(b) GDPR). We generate the license key ourselves and store only a keyed hash of it. To show it to you once after payment, we keep an encrypted copy for at most one hour, deleted as soon as it is shown.
• Emails received in your mailboxes. Messages sent to your Poofbox addresses, including sender, subject, body, attachments and headers, plus verification codes and links extracted from them. This is the service itself (Art. 6(1)(b) GDPR). Mail sent to addresses that do not exist is rejected and never stored.
• Account data. Your mailboxes, the apps you connect through OAuth, bearer tokens you create (stored as hashes) and a session cookie that keeps you logged in.
• Technical logs. Server and mail logs can contain IP addresses, timestamps and error details. We use them to keep the service secure and working, for example rate limiting and abuse prevention (legitimate interest, Art. 6(1)(f) GDPR). They are kept for at most 14 days.

We do not use analytics, advertising, tracking pixels or third-party scripts. The only cookie is a strictly necessary session cookie set when you log in, so no cookie banner is needed.

Where your data is stored

All service data, including backups, is stored on servers of Hetzner Online GmbH in Germany (EU).

How long we keep it

• Emails and attachments: until you delete the mailbox, the per-mailbox limit pushes them out (oldest first), or your access ends, whichever comes first. Then they are deleted immediately.
• Your account (email address, identifiers, mailboxes, tokens): until your access ends (after cancellation, a failed renewal or a refund). At that moment everything is deleted. We keep only an irreversible hash of your license key so the login page can tell you the token expired; no email address is kept with it.
• Backups: daily backups are kept for up to 30 days, after which deleted data is gone from them too.
• Technical logs: at most 14 days.
• Payment records are kept by Creem as merchant of record, under its own legal obligations.

Who receives data

• Creem (payments, merchant of record): processes your payment and invoice. You enter card details on Creem's hosted checkout; they never reach us. See Creem's privacy policy.
• Hetzner Online GmbH (hosting and backup storage in Germany), as our processor.
• Fastmail Pty Ltd (Australia), which sends our transactional emails (your license key and the recovery links you request) from our support address. Australia is outside the EU; Fastmail processes these messages (your email address, your license key or recovery link) under its data processing terms and standard contractual clauses.

We do not sell personal data or share it with anyone else, unless we are legally required to.

Your rights

You can ask for access to, correction or deletion of your data, restriction of or objection to processing, and a copy of your data. You can delete mailboxes and their mail yourself at any time from the dashboard. Write to poofbox@blanketbyte.com. You can also complain to a data protection authority.

Changes

If we change this policy we will update the date above. Material changes will be announced on this page.