Privacy Policy

Pre-launch draft · Last updated 31 October 2026

This policy explains how personal data may be handled when you visit Golden Mail Box, contact our team, or use the virtual mailbox service. We aim to handle data lawfully, fairly, and transparently and to use it only for stated purposes.

1. Who is responsible for your data?

Golden Mail Box is a service operated by Golden Creative Studio & Cowork in Loulé, Algarve, Portugal. The data controller is [insert the full registered legal name, legal form, registered address, company registration number and tax/VAT number].

Contact: support@goldenmailbox.pt · +351 923 247 026. Data protection contact or DPO, if appointed: [insert contact or state that no DPO has been appointed].

2. Personal data we may use

• Contact and account details: name, email, phone number, account identifiers and correspondence address.
• Mailbox and postal records: recipient details, sender details visible on an item, arrival dates, envelope images, handling instructions, storage and forwarding records.
• Mail contents: only where you request an opening and scan service, or where access is necessary to carry out your instruction or meet a legal obligation. Mail can contain sensitive information; please consider this before requesting a scan.
• Billing and transaction records: plan, invoices, fees and payment status. Card and bank details are collected and processed by our payment provider, Stripe, inside its hosted checkout and billing portal — we do not see or store your full card number.
• Uploaded documents: files you add to your account (for example identity documents or forms) for the purposes you upload them.
• Notification records: your push-notification preferences and, where you opt in, a browser push subscription managed by our notification provider, OneSignal, linked to your internal account ID.
• Support and technical records: messages you send us and limited access/security logs needed to operate and protect the website and service.

3. Purposes and legal bases

We use personal data to respond to enquiries, create and manage a mailbox, receive and record mail, provide requested scans/forwarding/shredding, take payment, provide customer support, protect the service, and comply with legal obligations. Depending on the activity, the legal basis may be taking steps at your request or performing a contract, complying with a legal obligation, our legitimate interests in operating and securing the service, or your consent where consent is required. We will identify the applicable basis for each actual processing activity before launch.

4. Who may receive data?

Access is limited to personnel who need it to provide the service. Data may also be shared with service providers that support hosting, mailbox software, email/support, payment processing, accounting, scanning, or physical delivery, and with public authorities where the law requires it.

The providers currently used by this service include: Innbocks, the mailbox operations platform that records customers, mail items, and the fulfilment of your instructions; Stripe, which processes plan subscriptions and per-service payments in its hosted checkout; and OneSignal, which delivers opt-in web push notifications. [Before publication, confirm each provider's data-processing terms and whether any provider or recipient processes data outside the European Economic Area and the safeguards used.] We do not sell personal data.

5. How long we keep data

We keep personal data only for as long as needed for the purposes above and applicable legal retention duties. Account and mail records may have different retention periods.

[Set the actual retention periods for envelope images, scanned contents, unclaimed physical mail, forwarding records, inactive accounts, support messages, security logs and invoices. State what happens to physical mail and digital scans when an account ends.]

6. Security and mail confidentiality

We use appropriate technical and organisational measures to protect personal data. Mail is handled by the team and service providers needed to carry out the service, and access should be limited to authorised people. [Confirm and describe the real access controls, scanning workflow, shredding provider/process, storage safeguards and incident contact before publication.]

7. Your rights

Depending on the circumstances, you may have rights to access, correct, erase, restrict or object to processing, request data portability, and withdraw consent where processing relies on consent. You may exercise applicable rights by emailing support@goldenmailbox.pt. We may need to verify your identity before acting.

You can complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD). For more information about GDPR transparency duties, see Regulation (EU) 2016/679.

8. Cookies and similar technologies

This site and the customer app use an essential, security-only session cookie to keep you signed in; it is not used for tracking. The app contains no analytics or advertising scripts. If you opt in to web push, the OneSignal browser SDK uses a service worker and browser push APIs tied to this site's origin. The customer portal (a separate sign-in) and payment provider may use their own cookies under their own terms. [Before launch, confirm the final cookie list and any consent controls needed.]

9. Changes to this policy

We may update this policy when the service or our processing changes. The latest version and its update date will be published on this page.

10. Contact

Questions or privacy requests: support@goldenmailbox.pt or +351 923 247 026. Please do not email the contents of sensitive mail unless necessary.