Privacy Policy

Last Updated: November 14, 2025

1. Introduction

Welcome to Mbox-Splitter.com. We take your privacy seriously and are committed to protecting your personal data. This privacy policy explains how we collect, use, and safeguard your information when you use our MBOX file splitting service.

Key Privacy Principle: Your MBOX files are processed entirely in your browser. We never upload, store, or have access to the contents of your email files.

2. Controller / Data Controller

The responsible party for data processing on this website is:

3. Data We Collect and Process

3.1 MBOX File Processing

Important: When you upload an MBOX file to split:

• Your file is processed entirely in your browser using JavaScript
• The file content never leaves your device
• We do not upload, store, or have any access to your email content
• Split files are generated locally and remain on your device

3.2 Account Data (Registered Users)

If you create an account, we collect and store:

• Email address: For authentication and communication
• Full name: For account personalization
• Password: Stored securely using industry-standard encryption
• Quota usage: To track your upload limits (file sizes only, not content)
• Premium status: Whether you have purchased a premium package

Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(a) GDPR (consent).

3.3 Payment Data

When you purchase a premium package:

• Billing address: Name, street, city, postal code, country
• Payment information: Processed securely by Stripe (see section 5.2)
• Invoice data: Invoice number, amount, date, package purchased

Legal basis: Art. 6(1)(b) GDPR (contract performance) and tax law requirements.

3.4 Technical Data

Our hosting provider automatically collects:

• IP address
• Browser type and version
• Operating system
• Referrer URL
• Date and time of access
• Pages visited

This data is necessary for the technical delivery of the website and security purposes.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure website operation).

3.5 Desktop Application

When you use our desktop application:

• Download tracking: We track which platform (Windows/Mac/Linux) was downloaded, using anonymized IP hashes for analytics
• Authentication: Desktop app uses secure tokens to sync your account quota
• Usage data: File sizes processed (not content) to update your quota usage

Important: Like the web version, the desktop app processes files locally. Your files never leave your computer.

4. Hosting and Infrastructure

4.1 Base44 Platform

Our website and backend services are hosted on the Base44 platform:

Base44 provides the infrastructure for:

• Website hosting and delivery
• User authentication and account management
• Database storage for user accounts and invoices
• Backend functions and API endpoints

Base44 uses Supabase (hosted on AWS in Frankfurt, Germany) for data storage, ensuring your data remains within the EU.

Data Processing Agreement: We have a Data Processing Agreement (DPA) with Base44 that ensures compliance with GDPR requirements.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in reliable website operation).

4.2 Cloudflare CDN

We use Cloudflare's Content Delivery Network (CDN) to improve website performance and security:

Cloudflare processes technical data (IP addresses, browser information) for security and performance purposes. Cloudflare is Privacy Shield certified and complies with GDPR.

Privacy Policy: https://www.cloudflare.com/privacypolicy/

5. Third-Party Services

5.1 Google Analytics

We use Google Analytics to understand how visitors use our website. This service:

• Uses cookies to collect anonymized usage data
• Tracks page views, session duration, and user interactions
• IP addresses are anonymized before processing
• Data is stored on Google servers (may include US servers)

Legal basis: Art. 6(1)(a) GDPR (consent via cookie banner).

You can opt out of Google Analytics tracking using our cookie settings or the Google Analytics Opt-out Browser Add-on.

Privacy Policy: https://policies.google.com/privacy

5.2 Stripe Payment Processing

For payment processing, we use Stripe:

When you make a payment:

• You are redirected to Stripe's secure payment page
• Payment details (card number, etc.) are entered directly on Stripe's servers
• We never see or store your full payment card information
• We only receive confirmation of successful/failed payments and a session ID

Legal basis: Art. 6(1)(b) GDPR (payment processing for contract fulfillment).

Privacy Policy: https://stripe.com/privacy

6. Cookies and Similar Technologies

6.1 Essential Cookies

We use essential cookies that are necessary for the website to function:

• Authentication cookies: Keep you logged in to your account
• Session cookies: Maintain your session state
• Cookie consent preferences: Remember your cookie choices

These cookies do not require consent as they are strictly necessary for the service you requested.

6.2 Analytics Cookies

With your consent, we use analytics cookies (Google Analytics) to:

• Understand how visitors interact with our website
• Identify popular features and improve user experience
• Track conversion rates for premium purchases

You can manage your cookie preferences at any time using the "Cookie Settings" link in the footer.

6.3 Local Storage

We use browser local storage to:

• Store temporary payment session IDs during checkout
• Cache user preferences for better performance

This data remains on your device and is never transmitted to our servers.

7. Data Retention

We retain your data only as long as necessary:

• Account data: Until you delete your account or request deletion
• Invoice data: 10 years (legal requirement for tax purposes in Germany)
• Technical logs: Maximum 90 days
• Analytics data: 26 months (Google Analytics default)

8. Your Rights Under GDPR

You have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR): Request a copy of your personal data
• Right to rectification (Art. 16 GDPR): Correct inaccurate personal data
• Right to erasure (Art. 17 GDPR): Request deletion of your data (with legal exceptions for invoices)
• Right to restriction (Art. 18 GDPR): Request restriction of processing
• Right to data portability (Art. 20 GDPR): Receive your data in a structured format
• Right to object (Art. 21 GDPR): Object to processing based on legitimate interest
• Right to withdraw consent (Art. 7(3) GDPR): Withdraw consent at any time

To exercise these rights, please contact us at: kontakt@mergim-rexha.de

You also have the right to lodge a complaint with a supervisory authority:

9. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption: HTTPS/TLS encryption for all data transmission
• Password security: Passwords are hashed using industry-standard algorithms
• Access controls: Restricted access to personal data on a need-to-know basis
• Regular security audits: Our hosting provider maintains security certifications
• Secure payment processing: PCI-DSS compliant through Stripe

However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

10. International Data Transfers

Your data is primarily stored within the EU (Frankfurt, Germany via Supabase). However, some service providers may transfer data internationally:

• Google Analytics: May transfer data to the US (Standard Contractual Clauses in place)
• Cloudflare: May process data globally (GDPR-compliant with DPA)

All international transfers comply with GDPR requirements through appropriate safeguards.

11. Children's Privacy

Our service is not directed to individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

12. Changes to This Privacy Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. The updated version will be indicated by the "Last Updated" date at the top of this page.

Significant changes will be communicated via email to registered users.

13. Contact Us

If you have any questions about this privacy policy or how we handle your data, please contact us: