privacy policy

who we are

adbtd is operated by an individual sole trader based in France. For any privacy question, data export, or deletion request, write to koren@pukogames.com. We will reply within 30 days, which is the GDPR statutory limit.

what we collect

account data

• email address and password hash, used to sign in
• workspace name, billing currency, and Stripe customer id
• order history (mailbox count, domains, dedicated IPs, prices)

billing data

Payments go through Stripe. We never see or store your card number. We keep the Stripe customer id, subscription id, and invoice metadata so we can show your billing history and process refunds. Stripe Tax computes VAT and sales tax on our behalf, so your billing country and (where required) tax id reach Stripe.

email content and logs

The mailboxes we provision belong to you. They contain whatever you send and receive: From / To / Subject headers, message bodies, attachments. To deliver and secure those mailboxes we keep:

• maildir storage on disk for as long as the mailbox exists
• SMTP and IMAP transaction logs (connect, auth, deliver, fail) for 90 days
• bounce, complaint, and reputation signals long-term, because deliverability requires history
• DKIM keys, which sign your outbound mail

We do not read your messages. We do not feed them to any AI model, ours or anyone else's. We do not sell or share them.

operational telemetry

Standard server access logs (IP, timestamp, route, response) for security and debugging, kept 30 days. Error reports may include a stack trace and a request id. No third-party trackers, no advertising pixels, no analytics SDKs on the marketing site at this time.

why we collect it

• contract performance — to actually run the mailboxes and IPs you ordered (account, billing, mail data)
• legal obligation — to keep invoices for the period required by tax law, and to respond to lawful requests from authorities
• legitimate interest — fraud prevention, abuse handling, deliverability protection (logs, reputation history)

where the data lives

All servers are in the European Union (France). Stripe processes payments globally and may transfer data outside the EU under its own published transfer mechanisms. We do not currently use US-based analytics, hosting, or AI processors.

who we share with

Only the processors we need to run the service:

• Stripe — payments, invoicing, tax
• infrastructure providers — to host the servers, IPs, and DNS that deliver your mail. They never see decrypted message content beyond what transits a single physical box.
• recipients of your outbound mail — by definition, anything you send leaves our systems and reaches them

We do not sell personal data. We do not share it with advertisers. If we ever bring on a new processor that touches your data, we will list it here and email account holders before it goes live.

how long we keep it

Your account and your mailbox content stay with us until you delete them — once you do, they are removed from our live systems and from backups on the next backup rotation. SMTP and IMAP transaction logs are kept for 90 days, then dropped. Bounce and complaint history is kept for as long as your workspace exists because we need it to protect your deliverability, and is anonymised when the workspace is closed. Invoices are retained for the period required by French tax law (currently 10 years).

your rights

Under GDPR you can ask us to:

• show you the data we hold about you
• correct anything inaccurate
• delete your account and the data tied to it
• export your account data and mailbox content in a machine-readable form
• restrict or object to specific processing

Email koren@pukogames.com. We respond within 30 days. If we get something wrong you can complain to the CNIL (the French data protection authority) at cnil.fr.

cookies

One cookie: the session cookie that keeps you signed in. It is HttpOnly, Secure, and SameSite=Lax. No analytics or marketing cookies.

security

Mailbox tenants are isolated per workspace. Passwords are hashed with a modern KDF. OAuth and provider credentials are encrypted at rest with AES-256-GCM. TLS 1.2+ in transit. Production access is restricted and audited. We will publish any breach that affects you within 72 hours of discovery, as GDPR requires.

changes

If we change this policy in a way that affects what we do with your data, we will email account holders before the change takes effect. The effective date at the top reflects the latest version.