Privacy Policy

Last updated: January 21, 2025

Welcome to Mbox-Viewer.de. We take your privacy seriously and are committed to protecting your personal data. This privacy policy explains how we collect, use, and safeguard your information when you use our MBOX file viewing service.

1. Controller / Data Controller

The responsible party for data processing on this website is:

2. Data We Collect and Process

2.1 MBOX File Processing

2.2 Account Data (Registered Users)

If you create an account, we collect and store:

• Email address: For authentication and communication
• Full name: For account personalization
• Password: Stored securely using industry-standard encryption (bcrypt hashing)
• Quota usage: To track your upload limits (file sizes only, not content)
• Premium status: Whether you have purchased a premium package
• API token: For desktop app authentication (generated and stored securely)

Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(a) GDPR (consent).

2.3 Payment Data

When you purchase a premium package:

• Billing address: Name, street, city, postal code, country
• Payment information: Processed securely by Stripe (see section 5.2)
• Invoice data: Invoice number, amount, date, package purchased

Legal basis: Art. 6(1)(b) GDPR (contract performance) and tax law requirements.

2.4 Technical Data

Our hosting provider automatically collects:

• IP address
• Browser type and version
• Operating system
• Referrer URL
• Date and time of access
• Pages visited

This data is necessary for the technical delivery of the website and security purposes.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure website operation).

2.5 Desktop Application

When you use our desktop application:

• Download tracking: We track which platform (Windows/Mac/Linux) was downloaded, using anonymized IP hashes for analytics
• Authentication: Desktop app uses secure tokens to sync your account quota
• Usage data: File sizes processed (not content) to update your quota usage

3. Hosting and Infrastructure

3.1 Base44 Platform

Our website and backend services are hosted on the Base44 platform:

Base44 provides the infrastructure for:

• Website hosting and delivery
• User authentication and account management
• Database storage for user accounts and invoices
• Backend functions and API endpoints

Base44 uses Supabase (hosted on AWS in Frankfurt, Germany) for data storage, ensuring your data remains within the EU.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in reliable website operation).

3.2 Supabase (Authentication & Database)

We use Supabase for user authentication and database services, which is integrated via the Base44 platform.

• Services: User authentication, secure data storage
• Data processed: Email address, encrypted passwords, user session data
• Data location: EU (Frankfurt, Germany - AWS eu-central-1)
• Cookies set: sb-access-token, sb-refresh-token

Privacy Policy: https://supabase.com/privacy

3.3 Cloudflare CDN

We use Cloudflare's Content Delivery Network (CDN) to improve website performance and security:

Cloudflare processes technical data (IP addresses, browser information) for security and performance purposes. Cloudflare is GDPR-compliant and has a Data Processing Agreement in place.

Privacy Policy: https://www.cloudflare.com/privacypolicy/

4. Server Log Files

Our hosting provider automatically collects and stores information in server log files that your browser transmits to us. This includes:

• Browser type and version
• Operating system used
• Referrer URL (the previously visited page)
• Hostname of the accessing computer
• Time of the server request
• IP address (anonymized after processing)

This data cannot be associated with specific persons and is merged with other data sources after a short period. We use this data solely to ensure system security and detect abuse.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in ensuring system security and detecting abuse)

Retention period: Log files are automatically deleted after a maximum of 90 days.

5. Third-Party Services

5.1 Google Analytics

We use Google Analytics to understand how visitors use our website. This service:

• Uses cookies to collect anonymized usage data
• Tracks page views, session duration, and user interactions
• IP addresses are anonymized before processing
• Data is stored on Google servers (may include US servers)

Provider:

Cookies used by Google Analytics:

• _ga - Distinguishes users (2 years)
• _gid - Distinguishes users (24 hours)
• _gat - Throttles request rate (1 minute)
• _ga_<container-id> - Session state (2 years)

IP Anonymization:

We have activated IP anonymization (anonymizeIP) on this website. This means your IP address is truncated by Google within member states of the European Union or other parties to the Agreement on the European Economic Area before being transmitted to the United States.

How to opt-out:

You can prevent Google Analytics from collecting your data by:

• Disabling Analytics cookies in our Cookie Settings
• Installing the Google Analytics Opt-out Browser Add-on

Legal basis: Art. 6(1)(a) GDPR (consent via cookie banner)

Privacy Policy: https://policies.google.com/privacy

5.2 Stripe Payment Processing

For payment processing, we use Stripe:

When you make a payment:

• You are redirected to Stripe's secure payment page
• Payment details (card number, etc.) are entered directly on Stripe's servers
• We never see or store your full payment card information
• We only receive confirmation of successful/failed payments and a session ID

Available Products:

• 5 GB Storage - €0.99 (one-time payment)
• 10 GB Storage - €1.99 (one-time payment)
• 50 GB Storage - €2.99 (one-time payment)
• 200 GB Storage - €3.99 (one-time payment)

Legal basis: Art. 6(1)(b) GDPR (payment processing for contract fulfillment).

Privacy Policy: https://stripe.com/privacy

6. Cookies and Similar Technologies

We use cookies and similar technologies to provide and improve our services. You can manage your cookie preferences at any time on our Cookie Settings page.

6.1 Essential Cookies

We use essential cookies that are necessary for the website to function:

• Authentication cookies: Keep you logged in to your account
• Session cookies: Maintain your session state
• Cookie consent preferences: Remember your cookie choices

These cookies do not require consent as they are strictly necessary for the service you requested.

6.2 Analytics Cookies

With your consent, we use analytics cookies (Google Analytics) to:

• Understand how visitors interact with our website
• Identify popular features and improve user experience
• Track conversion rates for premium purchases

You can manage your cookie preferences at any time using the "Cookie Settings" link in the footer.

6.3 Local Storage

We use browser local storage to:

• Store temporary payment session IDs during checkout
• Cache user preferences for better performance
• Remember your cookie consent choices

This data remains on your device and is never transmitted to our servers.

7. Data Retention

We retain your data only as long as necessary:

• Account data: Until you delete your account or request deletion
• Invoice data: 10 years (legal requirement for tax purposes in Germany)
• Technical logs: Maximum 90 days
• Analytics data: 26 months (Google Analytics default)
• Cookie consent: 1 year (stored locally in your browser)

8. Your Rights Under GDPR

You have the following rights regarding your personal data:

9. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption: HTTPS/TLS encryption for all data transmission
• Password security: Passwords are hashed using industry-standard algorithms (bcrypt)
• Access controls: Restricted access to personal data on a need-to-know basis
• Regular security audits: Our hosting provider maintains security certifications
• Secure payment processing: PCI-DSS compliant through Stripe
• Local file processing: MBOX files never leave your device

However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

10. International Data Transfers

Your data is primarily stored within the EU (Frankfurt, Germany via Supabase). However, some service providers may transfer data internationally:

• Google Analytics: May transfer data to the US (Standard Contractual Clauses in place)
• Cloudflare: May process data globally (GDPR-compliant with DPA)
• Stripe: May transfer data to the US (EU-US Data Privacy Framework certified)

All international transfers comply with GDPR requirements through appropriate safeguards (Standard Contractual Clauses or adequacy decisions).

11. Children's Privacy

Our service is not directed to individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately at kontakt@mergim-rexha.de.

12. Changes to This Privacy Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. The updated version will be indicated by the "Last Updated" date at the top of this page.

Significant changes will be communicated via email to registered users.

13. Contact Us

If you have any questions about this privacy policy or how we handle your data, please contact us: