Privacy Policy

This Privacy Policy explains which personal data Migrabox (migrabox.com) processes when you use it, why, for how long, and your rights under the General Data Protection Regulation (EU) 2016/679 ("GDPR").

The controller is ComCart S.r.l., Via Giacomo Matteotti 43, 47043 Gatteo (FC), Italy, Tax ID IT04412340400. For any question about your data, write to info@migrabox.com.

• Contact: the email address you give us for notifications. For the free plan we send it a 6-digit verification code, which we store only as a hash and which expires after 15 minutes.
• Access to the mailboxes: the addresses of the source and destination mailboxes, the names of their servers and the usernames. Passwords are stored encrypted with AES-256-GCM, used only to perform the copy and deleted automatically 14 days after it ends (2 days after an order that is never paid). If you sign in with a Google or Microsoft account, we store their access tokens instead of a password, with the same encryption and the same retention, and we revoke them when we delete them.
• The content of your email: messages pass through our servers only while they are being copied, are not kept afterwards and are not read by anyone: they are processed automatically for the sole purpose of transferring them.
• Migration data: folder names, number and size of the messages, progress, errors and the migration's event log. The link to the status page contains a secret code that we store only as a hash.
• Free plan: to prevent repeated use, we keep keyed hashes (HMAC) of the network address, of the source mailbox and of the verified email address, never the values in clear.
• Payments: handled by Stripe. We receive the payment status, the amount and the email address, never the card number.
• Technical logs: our servers record requests (IP address, time, page) for security and troubleshooting, with secret codes and query strings masked.

We use no analytics or advertising tools unless you consent to them in the cookie banner (see the Cookie Policy).

• to perform the migrations you ask for and show their progress
• to send you the emails about your migration (start, verification code, completion, problems)
• to process payments and meet tax and accounting obligations
• to prevent abuse of the free plan and keep the Service secure

• Contract (Article 6(1)(b) GDPR): performing the migration you requested.
• Legitimate interest (Article 6(1)(f) GDPR): security of the Service and prevention of abuse of the free plan.
• Legal obligation (Article 6(1)(c) GDPR): invoices and accounting records.
• Consent (Article 6(1)(a) GDPR): statistics and marketing cookies, only if you accept them; you can withdraw it at any time.

• Contabo GmbH, our hosting provider, which runs our servers and database in Germany (European Union).
• Stripe, for payments.
• The email providers of the two mailboxes you indicate: we connect to them on your behalf to read and copy the messages.
• Google, only if you accept statistics or marketing cookies (see the Cookie Policy).

The emails about your migration are sent by our own mail server. We never sell or rent personal data.

• Passwords and access tokens: deleted 14 days after the end of the copy, or 2 days after an order that is never paid.
• Content of the messages: not kept after the copy.
• Notification email address, migration data and event log: 12 months after the end of the migration, then deleted.
• Email verification codes: 24 hours.
• Free plan hashes: 24 months, to prevent repeated use.
• Payment records and invoices: 10 years, as Italian law requires.
• Technical logs: 30 days.

If you choose to sign in with a Google account, Migrabox asks for access to Gmail through the scope https://mail.google.com/, the only one that allows full access over IMAP. We use it only to read the messages and folders of the mailbox you indicate as the source and copy them into the destination you choose, or to write them into it when the Gmail mailbox is the destination.

Migrabox's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• we use Google user data only to provide the migration you requested and visible in the interface, and for no other purpose
• we do not use it for advertising, we do not sell it and we do not transfer it to third parties, except as necessary to provide the Service, to comply with the law or as part of a merger or acquisition with prior notice to you
• we do not use it to develop, improve or train generalized artificial intelligence or machine learning models
• no person reads your messages, unless you give explicit consent for specific messages, it is needed for security purposes such as investigating abuse, or it is required by law
• access tokens are stored encrypted with AES-256-GCM and deleted, and revoked, 14 days after the end of the migration or earlier if you ask us at the address below; the content of the messages is never kept

You can also revoke Migrabox's access at any time from your Google account's security settings. For questions: info@migrabox.com.

If you choose to sign in with a Microsoft account (Outlook.com, Hotmail, Microsoft 365), Migrabox asks only for the permissions needed to access the mailbox over IMAP and to keep access during the copy. The same rules as in section 8 apply: the data is used only for the migration you requested, never for advertising, not sold, not used to train artificial intelligence models, not read by any person except in the cases described there, and the tokens are encrypted, deleted and revoked 14 days after the end of the migration. You can revoke access at any time from your Microsoft account.

You can ask to access, correct or delete your data, to receive it in a portable format, to restrict its processing or to object to it, and withdraw consent where we rely on it. Write to info@migrabox.com; we answer within 30 days. You can also lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority of your country.

The site uses only the browser storage it needs to work (the language you chose, the data you are entering in the migration form, never passwords). Statistics and marketing cookies are used only if we turn them on and you accept them: the Cookie Policy lists them and explains how to change your choice.

Our servers are in the European Union (Germany). Stripe and Google may process data outside the European Union; such transfers rely on an adequacy decision of the European Commission, such as the EU-U.S. Data Privacy Framework, or on the Standard Contractual Clauses.

Connections are encrypted (TLS); passwords and tokens are encrypted with AES-256-GCM and never passed on a command line; the codes of the status links are stored only as hashes; connections to private or internal network addresses are refused. No system is perfectly secure, but we apply technical and organizational measures appropriate to the risk.

The Service is not meant for people under 18 and we do not knowingly collect their data. If you think we did, write to info@migrabox.com and we will delete it.

We may update this policy. The date of the last change is at the top of this page.

ComCart S.r.l., Via Giacomo Matteotti 43, 47043 Gatteo (FC), Italy, Tax ID IT04412340400 — info@migrabox.com