Legal
Privacy Policy
Last updated: 30 October 2026
This policy explains what personal data we collect when you use box4you.online, why, and what rights you have. We collect only what we need to provide the service. We don't sell your data and don't use it for advertising.
1. Who is responsible
The controller of your personal data is [company legal name], [registered address], company number (ЕИК) [ЕИК]. For anything about your data, email [contact email].
2. What we collect and why
- Your account
Email address, password (stored only as a secure one-way hash), optional display name and preferred language. Used to sign you in and keep your gifts. Legal basis: performing our contract with you (Art. 6(1)(b) GDPR).
- Guest sessions
If you design without an account, a random guest identifier lets us save your draft. Unpaid guest drafts are deleted after 30 days without activity. Legal basis: contract.
- What you put in a gift
Recipient and sender names, messages, photos, recordings, videos, documents and gift codes, and the gift's secret question. Photos are resized and their location data is removed before they are stored. The answer to a secret question is stored only as a one-way hash, so nobody can read it back. Used to create and deliver the gift. Legal basis: contract.
- Purchases
Email address, what you bought, the amount, the date, order and payment references from Stripe, and the time you agreed to immediate delivery. You enter card details on Stripe's page; we never receive them. Legal bases: contract, and our legal obligations under accounting and tax law (Art. 6(1)(c)).
- Emails we send
Purchase confirmations, management links for guest buyers, sign-in emails (confirmation, password reset) and reminders before a gift expires. These are service messages only: we don't send newsletters or marketing.
- When someone opens a gift
We record that the gift was opened (without the IP address or device details), so the sender can see it was opened. If the gift has a secret question, wrong answers are counted against a scrambled code derived from the network address, to stop guessing; the address itself is not stored. A correct answer keeps the gift unlocked on that device for 2 hours. Legal basis: our legitimate interest in protecting gifts (Art. 6(1)(f)).
- Security
Network addresses are used briefly, in memory only, to limit abuse (for example too many sign-in attempts). Our hosting provider keeps standard technical logs. Legal basis: legitimate interest in keeping the service secure.
If your gift contains personal data about other people (for example photos of friends or the recipient's name), please make sure they are happy for it to be shared.
3. Who processes your data
We use these providers to run box4you.online. They process data only on our instructions and under data processing agreements:
Supabase, Inc.: database, sign-in and file storage, in its data centre in Frankfurt, Germany.
[hosting provider]: hosting of the website and application.
[email provider]: sending emails.
Payments are handled by Stripe Payments Europe, Limited (Ireland), which processes payment data as a separate controller under its own privacy policy.
We disclose data to authorities only when the law requires it.
4. Transfers outside the EU
Some of our providers are based in the United States or may access data from there. Such transfers are protected by an adequacy decision of the European Commission (the EU-U.S. Data Privacy Framework) or by the European Commission's Standard Contractual Clauses.
5. How long we keep data
Account data: until you ask us to delete your account.
Drafts: until you delete them. Unpaid guest drafts: 30 days after the last activity.
Paid gifts: the gift can be opened for 30 days from the moment it is sent, plus a 7-day grace period (and a one-time 30-day extension if you choose it). After that its personal content is deleted; only the design is kept.
Purchase records: for as long as accounting and tax law requires.
Backups: our database provider keeps encrypted backups for up to 7 days, so data deleted from box4you.online disappears from them within that time. Uploaded files are not part of these backups: once deleted, they are gone.
Cookies: as listed below.
7. Your rights
You have the right to access your data, have it corrected or deleted, restrict or object to its processing, and receive it in a portable format. Where we rely on your consent, you can withdraw it at any time.
To use these rights, email [contact email]. We answer within one month.
You can also complain to the Commission for Personal Data Protection (Комисия за защита на личните данни, cpdp.bg) or to the data protection authority in your own EU country.
8. Security
All connections are encrypted (HTTPS). Files are kept in private storage and are only reachable through short-lived signed links, for people allowed to see them. Secret answers and management links are stored only as one-way hashes, and access to data is limited to what each part of the service needs.
9. Children
box4you.online is not intended for children to use on their own, and you must be 18 or older to buy. If you believe a child has given us personal data, contact us at [contact email] and we will delete it.
10. Changes to this policy
We may update this policy. The current version is always on this page with its date. If a change affects you significantly, we will tell you by email.