Privacy Policy

This privacy policy describes how Camille Arpaillange, sole trader (EI), 258 Avenue de l'Hautil, 78955 Carrières-sous-Poissy, France, registered under number 53021905400026 (hereinafter "Clean Mailbox", "we"), processes personal data in connection with the website clean-mailbox.com and the Clean Mailbox service (the "Service"), in accordance with Regulation (EU) 2016/679 (the "GDPR") and amended French Law No. 78-17 of 6 January 1978.

1. Two processing scopes

This policy distinguishes between:

• data processed for the showcase website (browsing the site, contact form);
• data processed for the Service itself (filtering a Domain's emails, account management, billing).

For the Service, the allocation of roles (Controller / Processor) between the Customer and Clean Mailbox is set out in Article 10 of the Terms of Service.

2. Data collected and purposes

2.1. Showcase website

• Contact form: name, email, company, message. Purpose: responding to your request. Legal basis: legitimate interest / pre-contractual steps.
• Technical cookies: session persistence. Purpose: site functionality. Legal basis: necessary for the requested service (no consent required). See also the legal notice.

2.2. Account and Service management

• Account data: first name, last name, business email, company, login credentials. Purpose: account creation and management, performance of the contract. Legal basis: performance of the contract.
• Billing data: billing details, payment history (card and direct debit data is processed by our providers Stripe and GoCardless, which are PCI-DSS compliant; we do not store this data, or only store it partially depending on the mechanisms used by these providers). Purpose: billing. Legal basis: performance of the contract, legal accounting obligations.
• Filtered emails from the Domain: headers, sender/recipient, metadata, and for blocked emails, message body and attachments retained temporarily (see Article 5 of the Terms). Purpose: detection and blocking of spam, phishing and malware. Legal basis: performance of the contract entered into with the Customer (Clean Mailbox acting as Processor for business Customers).
• Technical logs: IP addresses, timestamps, technical events. Purpose: security, diagnostics, abuse prevention. Legal basis: legitimate interest.

3. Recipients of the data

Data is accessible to:

• Clean Mailbox (Camille Arpaillange, EI), on a need-to-know basis;
• the Domain Administrator designated by the Customer, for Blocked Emails attached to its Domain (Article 5.3 of the Terms);
• our technical sub-processors, in particular:
  • OVH SAS (France): hosting of the showcase website, the Customer Interface, and part of the email filtering infrastructure;
  • Scaleway SAS (France): hosting of part of the email filtering infrastructure;
  • Vultr (The Constant Company, LLC): hosting of part of the email filtering infrastructure, in European Union regions only;
  • Stripe and GoCardless (PCI-DSS compliant), for payment processing;

This list of technical sub-processors may change, in particular in the event of a change of infrastructure or provider. Business Customers are notified of any change in accordance with Article 8.2 of the DPA; for other users, this policy is updated accordingly.

No personal data is sold to third parties. It is only disclosed in the cases described above, or where required by law (e.g. a judicial request).

4. Location and data transfers

Processing is carried out in Europe: all servers used by our hosting providers (OVH, Scaleway, Vultr) for the website and email filtering are located within the European Union. No data is currently transferred outside the European Union / European Economic Area.

Where data is processed by a provider established outside the European Union, even if processing is carried out exclusively on servers located within the European Union, Clean Mailbox ensures that the appropriate safeguards provided for by the GDPR are implemented (in particular standard contractual clauses, where applicable).

5. Retention periods

• Blocked emails (quarantine): retained for a maximum of thirty (30) days, then deleted (Article 5.2 of the Terms).
• Account data: retained for the duration of the contractual relationship, then archived or deleted in accordance with applicable legal obligations (in particular accounting and tax obligations).
• Billing data: retained in accordance with the legal retention periods for accounting records (generally 10 years).
• Contact form: retained for as long as necessary to handle the request, then deleted within 12 months if no contractual relationship follows.
• Technical logs: retained for a maximum of 12 months.

6. Security

We implement reasonable technical and organizational measures to protect data against unauthorized access, loss, or alteration (encryption of communications, access controls on administration interfaces, hosting with a recognized European provider). As the Service is provided on a best-effort basis (Article 11 of the Terms), no guarantee of absolute security can be given.

7. Your rights

In accordance with the GDPR, you have the following rights over your personal data:

• right of access;
• right to rectification;
• right to erasure;
• right to restriction of processing;
• right to object;
• right to data portability.

To exercise these rights, contact us by email: [email protected]. Proof of identity may be requested if there is reasonable doubt as to your identity.

You also have the right to lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr), 3 Place de Fontenoy, 75007 Paris, France, if you believe your rights are not being respected.

8. End Users of the Customer

If you are an End User (an employee or member of a Customer organization) and your emails are filtered by the Service, the entity responsible for processing your data in this respect is, in principle, the Customer (your organization), with Clean Mailbox acting as Processor. For any questions about the processing of your data in this context, please contact your organization first.

9. Contact

For any question relating to this policy or to the processing of your data: [email protected]
Address: 258 Avenue de l'Hautil, 78955 Carrières-sous-Poissy, France

10. Changes to this policy

This policy may be updated to reflect changes to the Service or to applicable regulations. The date of the last update appears below.

11. Reference language

This privacy policy is drafted in French. An English version is made available for information purposes for non-French-speaking users. In the event of any discrepancy or difficulty of interpretation between the French version and the English version, the French version shall prevail.

Last updated: 22 July 2026.