Hosted inbox privacy notice

This notice is about you, the person who sets up a hosted inbox, and about your business. For this data Surfing Dog Lda, Portugal, is the controller. Your customers’ data inside your inbox is yours to control, and we process it for you under the processing agreement. Our general privacy page covers the website and the network.

What we keep, and why

• Your email address, stored encrypted, and a keyed hash of it to find your account. We use it to sign you in, to send you codes and notices about your inbox, and to tell you about changes to the service. Basis: our contract with you.
• Your domain and the hostname you chose, and what our checks see in its DNS (the record you added, your DNS provider’s name servers, whether the certificate was issued). Basis: our contract with you.
• What we read from your public website to fill in your inbox’s starting details: your kind of business, hours, services and other facts your site publishes, each with where and when we read it. You check them before anything is used. Basis: our contract with you, and our legitimate interest in saving you the typing.
• The steps you took and when: that a card was shown, a code sent, a record seen, the inbox gone live. Counts and times, nothing more, kept by us, with no analytics company involved. Basis: our legitimate interest in knowing where setup gets stuck.
• Usage counts: confirmed items, items, emails sent and the size of your inbox, per month. Basis: our contract with you (the pilot is free; the counts are what a future price would follow).
• Security signals: the bot check on the sign-up form, your address’s network for rate limits, and failed code attempts. Kept briefly, and used to stop abuse and for nothing else. Basis: our legitimate interest in keeping the service safe.
• Reports and our decisions about them, if anyone reports your inbox. Basis: our legal duties under the Digital Services Act.

How long

• A sign-up you never confirm: deleted after 24 hours. A code: 10 minutes.
• Your account: while your inbox exists, and for the 30 days of read-only after you close it; then deleted, with backup copies gone within 30 more days.
• The step and usage counts: kept without your address once your inbox is closed.
• Reports and decisions: as long as the law asks us to keep them.

Who else sees it

Our edge network carries every request to the service and the codes and notices we send you, runs the bot check on the sign-up form, and holds your hostname so that it can route your inbox’s traffic. It can do this from its locations outside the European Union. It also keeps its own records, which can be kept outside the European Union: of requests (addresses, times and the pages asked for), to run and protect its network, and of the email it delivers (sender, recipient, subject and whether it arrived) for about a month, with a list of addresses that bounced or reported mail as spam.

The company that rents us our servers holds the database, in the European Union, and our backups of it are stored in the European Union. The processing agreement describes both companies.

When your website’s own data does not say what your business is, a language-model company may read a short digest of its public pages, with contact details taken out, to help fill in your starting details. It can be outside the European Union. You check every value before it is used.

Public DNS resolvers answer our checks of your hostname. A certificate authority issues the certificate for it, and, as for every certificate, your hostname is then listed in public certificate logs.

Mail you write to our addresses is kept in our mailbox at an email company, which may store it outside the European Union.

We sell nothing and share nothing else.

Your rights

You can ask to see, correct or delete what we hold about you, to receive it in a portable form, and to object to what we do on the basis of our legitimate interest. Write to privacy@surfingdog.ai. You can also complain to the Comissão Nacional de Proteção de Dados (CNPD) in Portugal, or to the authority where you live or work.