natboxPrivacy Policy
This policy explains what personal data Mohammad AlSaraf ("natbox", "we") collects when you use natbox.io and my.natbox.io, why, and what your rights are. We keep as little as we can.
What we collect
| Data | Why |
|---|---|
| Name, email address, billing address (if you enter one) | To run your account, send invoices and service emails, and meet tax and accounting rules. |
| Payment records: amount, coin, network, transaction ID | To match payments to invoices and handle refunds. Wallet and exchange details stay with the payment provider. |
| IP addresses and login times | Account security, fraud prevention and abuse investigations. |
| Support tickets and emails you send us | To answer you. |
| Server metadata: plan, IP addresses, ports, the domains you link (with their DNS check records), CPU, memory and traffic use | To run, monitor and bill the service (for example the monthly traffic allowance) and to handle abuse reports. |
| Abuse reports sent to us: the reporter's email address and IP, and the report | To investigate the report and reply to the reporter. |
We do not look at the contents of your server except when investigating abuse, fixing a fault, or when the law requires it.
Cookies
natbox.io sets no cookies and uses no analytics or trackers. my.natbox.io uses only the cookies it needs to keep you signed in and protect forms (session and CSRF cookies). The site fonts are served by us, not by a third party.
Who we share data with
We use these providers. Each one only gets what it needs for its job:
- Contabo GmbH (Germany), infrastructure provider: runs the server that hosts natbox.io, the client area and all customer servers. All data listed above is stored there, in Germany.
- NOWPayments, payment processor: receives the invoice amount and number when you pay with crypto, and handles the payment on its own payment page. It acts under its own privacy policy for the data you give it there.
- Resend (United States), email delivery: sends the emails we send you (account, invoice, server and support emails), so it receives your email address and the content of those emails.
- ImprovMX, email forwarding: forwards email sent to our @natbox.io addresses (such as support@ and abuse@) to our mailbox, so it handles the emails you send us.
- Google (Google Drive), backup storage: holds an off-site copy of our backups. The backups are encrypted on our server before upload, so Google cannot read them.
- Authorities, only when legally required, for example by a court order.
We never sell your data or use it for advertising.
How long we keep it
| Data | Kept for |
|---|---|
| Account details | While your account is open. Deleted when you ask us to delete the account (see below). |
| Invoices and payment records | As long as tax law requires, up to 10 years, even after the account is deleted. |
| Support tickets | While your account is open; deleted with the account. |
| Copies of the emails we sent you | 90 days. |
| Web server and router logs (IP addresses, requests) | 14 days. |
| Account history (sign-ins and changes made in the client area, with IP address) | While your account is open; deleted with the account. |
| Server usage history (CPU, memory, traffic) | 31 days. |
| Abuse reports, and the record of which server used which domain | As long as needed to handle the report and repeat abuse; deleted on request when no longer needed. |
| Server contents | Deleted, together with the server's snapshots, when the server is terminated. Where an off-site backup copy exists, it expires within 35 days. |
Your rights and deleting your account
You can ask for a copy of your data, ask us to correct it, or ask us to delete your account.
- Open a ticket while signed in, or email support@natbox.io from the address on your account, so we know the request is really from you.
- We reply within 24 hours and complete the request within 30 days. Deleting the account cancels its servers immediately and deletes their data.
- We keep only what the law requires us to keep (invoices and payment records, see above).
If you are in the EU or UK you also have the right to complain to your data protection authority.
Security
The client area uses HTTPS only. Passwords are stored hashed, and payment API keys are encrypted at rest. Access to our systems is limited to the people who run the service.
Changes
If we change this policy in a meaningful way, we will post the new version here and tell you by email or in the client area.