Privacy Policy

This policy explains how Corals, [legal entity type, registration number, address] (“Corals”, “we”, “us”), handles personal data when you use MoveMyInbox at movemyinbox.com (the “Service”). For the purposes of data protection law, Corals is the controller of your account and billing data, and processes the mailboxes you upload for conversion on your behalf, as a processor where that distinction applies.

The short version

• We process your uploaded mail for one purpose only: converting it into the format you chose (such as a PST, MBOX, EML, PDF or CSV file) for you.
• Conversion is automated. Our staff do not read your mail.
• Uploaded files are deleted automatically within 3 days. Converted files are deleted after the retention period (7 days by default).
• Data is encrypted in transit (TLS) and at rest.
• We don’t sell your data, don’t show ads and don’t use advertising or analytics trackers.

1. What we collect

We do not receive your card details: payments are handled directly by Stripe. Your mailbox content may contain personal data about other people (your correspondents); we process it only to convert it for you, as described here.

2. How long we keep data

• Uploaded mailbox files: deleted automatically within 3 days of upload, usually much sooner after conversion.
• Converted files: deleted automatically at the end of the retention period shown on your conversion page (7 days by default).
• Temporary working copies on conversion servers are destroyed when the conversion task ends.
• Account data and conversion records: kept while your account exists, and deleted or anonymised within [30] days after you ask us to close your account, except where we must keep them longer.
• Payment records: kept for as long as tax and accounting law requires (typically [7–10] years).
• Technical logs: kept for up to 14 days.

3. Who we share data with

We use a small number of service providers (“sub-processors”) who process data for us under contracts that require them to protect it:

• Amazon Web Services, Inc.: hosting, storage (Amazon S3), conversion servers, databases and account authentication (Amazon Cognito), in the AWS US East (N. Virginia) region, United States.
• Google LLC: only if you choose “Continue with Google”, to confirm your identity. Google shares your name, email address and account ID with us; we don’t get access to your Gmail or other Google data.
• Stripe, Inc.: payment processing, receipts and refunds.
• Email delivery for verification codes and service emails, provided through Amazon Web Services.

We may disclose data if required by law or a valid legal request, or to protect the rights and safety of our users and the Service. If Corals is involved in a merger or acquisition, data may be transferred, subject to this policy. We never sell personal data.

4. International transfers

The Service is hosted in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, transfers to the US rely on the EU-US Data Privacy Framework (and its UK and Swiss extensions) where our providers are certified, and/or Standard Contractual Clauses.

5. Security

All traffic uses HTTPS/TLS. Stored files and databases are encrypted at rest. Files are uploaded directly to private storage using short-lived, single-purpose links, and downloads use links that expire after one hour. Each conversion runs in an isolated, short-lived container. Staff access to systems is restricted and logged. Read more on our Security page.

6. Cookies and local storage

We use only what’s strictly necessary for the Service to work: when you sign in, your browser’s local storage keeps authentication tokens so you stay logged in. Stripe may set its own cookies on its checkout pages to process payments and prevent fraud. We do not use advertising cookies, cross-site tracking or third-party analytics, so we don’t show a cookie consent banner.

7. Your rights

Depending on where you live, you have the right to:

• access the personal data we hold about you and get a copy of it;
• correct inaccurate data (you can change your name in your account settings);
• have your data deleted;
• restrict or object to certain processing, including processing based on legitimate interests;
• data portability; and
• withdraw consent where processing is based on consent.

EEA/UK residents may also lodge a complaint with their local data protection authority. California residents have the right to know, delete and correct personal information and to not be discriminated against for exercising these rights. We do not sell or “share” personal information for cross-context behavioural advertising as defined by the CCPA/CPRA.

To exercise any right, email privacy@movemyinbox.com from the address on your account. We respond within one month (or 45 days where the CCPA applies) and may need to verify your identity.

8. Children

The Service is not directed at children under 16, and we do not knowingly collect their data.

9. Changes

We will post changes to this policy on this page and update the date above. If a change is significant, we will notify you by email or in the Service.

10. Contact

Privacy questions or requests: privacy@movemyinbox.com. Postal address: Corals, [address]. [EU/UK representative, if required: name and address.] [Data protection officer, if appointed: contact details.]