PixAgentur MailTransfer
Privacy

Privacy Policy

This is an English translation provided for your convenience. The German version is the legally binding version.

1. Data Controller

The controller responsible for data processing on this website is:

Sven Gauditz
PixAgentur — Web design & digital solutions
Ringstraße 3
24321 Behrensdorf
Germany
E-mail: info@pixagentur.com

2. What This Service Does

PixAgentur MailTransfer transfers an e-mail mailbox from one IMAP server to another at your instruction. To do this, we need temporary access to both mailboxes. This notice describes what data this involves, how long it is kept, and what rights you have.

3. Purpose and Legal Basis for Processing

We process your credentials and the transfer details (server addresses, usernames, chosen scope) in order to carry out the mailbox move you have requested. The legal basis is Art. 6(1)(b) GDPR — the processing is necessary for the performance of a contractual relationship you have initiated, or a pre-contractual measure, even though it involves no customer account and no payment.

We process security logs and the limit on requests per visitor (rate limiting) on the basis of Art. 6(1)(f) GDPR — our legitimate interest in a functioning service free of abuse, and in protecting third-party mail servers from being overloaded by our infrastructure.

4. What Data We Process

  • IMAP credentials: username and password for the source and target mailbox. Passwords are stored encrypted (libsodium secretbox) and deleted at the latest 72 hours after the transfer is completed — immediately on request via the status page.
  • Server addresses and usernames for both mailboxes, to carry out the transfer and for any subsequent re-synchronisation.
  • Count and folder data for the completion report — number of messages and folder names, explicitly no message content or subject lines.
  • Optional notification e-mail address, if you would like a message when the transfer completes or fails.
  • Hashed IP address (SHA-256 with an additional salt value), used exclusively to enforce request limits. The IP address itself is not stored in plain text and cannot be reconstructed from the stored hash.

5. E-mail Content During the Transfer

The actual mailbox content — message text, subject lines, attachments, address books — passes through our server during the transfer in order to be copied from the source server to the target server. This content is explicitly not stored permanently and not analysed; it remains only for the duration of the respective processing step in memory or in temporary files, which are deleted immediately after the copy operation.

6. Recipients and Data Processing Agreements

Your data is not passed on to third parties — with the exception of the two mail servers you have specified yourself as source and target; we necessarily transmit the relevant credentials to these in order to establish the connection.

This service is hosted on servers owned or leased by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, with the server location in Germany. We have a data processing agreement with IONOS under Art. 28 GDPR; IONOS processes data exclusively on our instructions and in compliance with the GDPR.

7. Retention Period

We automatically delete credentials and security logs at the latest 72 hours after a transfer is completed, or immediately on request via the status page. The count and folder data for the completion report remain in place until you delete the transfer yourself, or until the report should no longer be retrievable.

8. Your Rights as a Data Subject

Under the applicable statutory provisions, you have the right to information about the data we hold about you, as well as to its correction, deletion or restriction of processing. You may object to processing insofar as it is based on Art. 6(1)(f) GDPR. To exercise these rights, an e-mail to info@pixagentur.com is sufficient.

You also have the right to lodge a complaint with the competent supervisory authority:

Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD) — Independent Centre for Privacy Protection Schleswig-Holstein
Holstenstraße 98
24103 Kiel
Web: https://www.datenschutzzentrum.de

9. Cookies and Local Storage

This website uses only one technically necessary session cookie (mt_sess), which is required for the transfer process and expires at the end of the session. No cookie is required to return using your transfer ID and security code. We store your preferred theme setting (light/dark) only locally in your browser (localStorage), not on our servers.

No tracking or analytics tools are used, no external fonts or other resources are loaded from third-party servers (CDNs), and no cookies are set for marketing or statistical purposes.

10. Contact for Privacy Enquiries

If you have questions about data protection or wish to exercise your rights, please contact info@pixagentur.com.