Privacy Policy
1. What makes this service special
Our service consists of receiving, opening and scanning your postal mail under your express mandate. Your correspondence can contain any category of personal data, including sensitive data. We treat all mail content under strict confidentiality, process it only to deliver the service to you, and never use it for any other purpose. Mail content is never used for advertising, profiling or training of any kind, and is never sold or shared.
2. What we process, why, and for how long
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Identification (name, ID document, residential address, NIF) | Onboarding, identity verification, the reception mandate | Art. 6(1)(b) contract; art. 6(1)(c) legal obligations | Duration of contract + legal limitation periods |
| Contact (email) | Delivery of scans and service notices | Art. 6(1)(b) contract | Duration of contract + 1 year |
| Mail scans (envelope and contents) | The service itself | Art. 6(1)(b) contract, executed under your written mandate | While subscription is active; deleted 90 days after termination |
| Physical originals | Temporary storage before destruction or forwarding | Art. 6(1)(b) contract | 60 days after scanning, then confidential destruction |
| Billing data | Payments and invoicing | Art. 6(1)(b) and (c) | 10 years (tax law) |
| Waitlist email | Telling you when the service opens | Art. 6(1)(a) consent | Until launch communication or withdrawal |
3. Processors we use
- Stripe — payments (we never see full card numbers).
- Vercel — website and application hosting.
- Email and storage providers — delivery of scans and secure storage, under data processing agreements, within the EU/EEA or with adequate safeguards.
We share data with authorities only where legally required.
4. Security
Scans are stored encrypted; access to mail content is limited to the minimum staff necessary, bound by confidentiality; originals are kept in locked storage until destruction; destruction is by cross-cut shredding.
5. Your rights
Access, rectification, erasure, portability, restriction and objection — write to ola@portugalmailbox.com. You may complain to the CNPD (cnpd.pt). Withdrawing the mandate stops all mail processing immediately for new mail.
6. Cookies
The site uses only essential cookies and, with your consent, privacy-respecting analytics. No advertising trackers.