Privacy Policy

Last Updated: Oct. 16, 2026

1. Introduction

Welcome to bluefox.email! We value your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, disclose, and protect your information when you use our website and platform.

Who we are

bluefox.email is operated by Innovaris Group Korlátolt Felelősségű Társaság (Innovaris Group Kft., English name: Innovaris Group LLC), the controller of the personal data described in this policy.

• Registered office: 1095 Budapest, Mester utca 40-44. B. lház. II. emelet 10. ajtó, Hungary
• Company registration number: 01-09-432032
• Tax number: 32586174-2-43, EU VAT number: HU32586174
• Contact: hello@bluefox.email

2. Data Collection

We collect the following information when you sign up or use our services:

• Personal Information: When you sign up using your email address or through an identity provider like Google, we collect your name and email address.

• AWS SES Credentials (Optional): BlueFox Email includes its own managed sending infrastructure, so connecting AWS SES is not required. If you choose to connect your own AWS SES account (BYO SES), we collect your AWS Access Key ID and Secret Access Key, or an AWS STS Role ARN if you use temporary credentials. These credentials are stored encrypted and are accessible only to authorized systems and personnel.

• Email Lists: If you create email lists on our platform, we collect and store the email addresses and names of your subscribers. This data is tied to campaigns and triggered emails. Subscribers can unsubscribe or pause their subscriptions at any time.

• Email Interaction Data: We track and store data related to emails sent through our platform, including clicks, opens, bounces, and complaints. This data helps us provide insights into email performance and ensure the proper functioning of our service.

• Webhook Configuration: If you set up webhooks, we generate and store a secret API key used to authenticate webhook requests. This key is sent as a Bearer token in the Authorization header of each webhook request to your endpoint.

• Automatic Data: We collect information automatically when you interact with our platform, including IP addresses, device information, and usage data.

• Billing Information: When you purchase send packs or subscribe to a plan, we process the billing details needed to charge you and issue invoices. Payments are handled by Paddle (Paddle.com Market Limited), which acts as the merchant of record for our sales and processes your payment details as an independent controller under its own privacy notice.

Data we process for our customers: When our customers use bluefox.email to store contacts and send emails to their own recipients, they decide how that data is used, and we process it on their behalf as a processor. That processing is governed by our Data Processing Agreement, not by this privacy policy. If you received an email sent through bluefox.email by one of our customers and have questions about your data, please contact that sender.

We use a limited part of that data for our own purposes as a controller: bounce and complaint events, sending volumes, and engagement statistics, to prevent spam, fraud, and abuse, to protect the security and deliverability of the platform, to enforce our Terms of Use, and to meet the requirements of our email delivery providers. We also produce aggregated statistics that do not identify individual recipients. We do not use our customers' recipient data to contact those recipients for our own purposes or for advertising.

3. How We Use Your Data and Our Legal Bases

Purpose	Legal basis (GDPR)
Creating and running your account, providing the platform, and support	Performance of our contract with you (Article 6(1)(b))
Billing, invoicing, and keeping accounting records	Legal obligation (Article 6(1)(c)) and performance of our contract (Article 6(1)(b))
Service emails: Alert Center, Performance Reports, Personalized Product Support & Tips, including subscription notifications, and Legal updates	Performance of our contract (Article 6(1)(b)) and our legitimate interest in keeping you informed about your account (Article 6(1)(f))
Product news and tips: What's New with bluefox.email and Advanced Strategies	Our legitimate interest in informing existing customers about our own similar services (Article 6(1)(f)). You can unsubscribe at any time
Securing the platform, preventing spam, fraud, and abuse, and protecting deliverability, including the use of recipient data described in Section 2	Our legitimate interest in a secure and reliable service for all customers (Article 6(1)(f))
Keeping AWS SES credentials and webhook secret keys secure	Performance of our contract (Article 6(1)(b))
Website analytics with Google Analytics, and advertising with Google Ads and the Reddit Pixel (see Section 5)	Your consent (Article 6(1)(a)), which you can withdraw at any time
Website usage analytics with Microsoft Clarity, and recording which campaign brought you to us (see Section 5)	Our legitimate interest in understanding and improving our website and marketing (Article 6(1)(f))

4. Communication Preferences

You may be added to the following email lists:

1. What's New with bluefox.email: Monthly newsletters with updates, promotions, and product news.
2. Alert Center: Immediate notifications about critical issues like bounces, spam reports, and AWS SES errors.
3. Performance Reports: Weekly or monthly updates on your email campaign performance.
4. Advanced Strategies: Tailored tips and strategies for experienced users.
5. Personalized Product Support & Tips: Activation guides, reminders, and support, including subscription notifications.
6. Legal updates: Notices about changes to our Terms of Use, this privacy policy, our Data Processing Agreement, and our subprocessors, sent at least 30 days before they take effect. If you unsubscribe, you will not receive these notices by email, but every change is still published on our website. Security notices about your account, such as data breach notifications, are always sent to you directly.

You can manage your preferences or unsubscribe from these lists at any time via the links provided in our emails.

5. Cookies and Similar Technologies

Our website uses a small number of cookies and similar technologies. When you first visit, we ask for your choice about optional analytics and advertising cookies. You can change your choice at any time with the Cookie settings link in the website footer.

Category	What we use	Purpose	Controlled by your cookie choice
Necessary	Your cookie choice, stored in your browser	Remembering your choice	Always on
Analytics	Google Analytics	Understanding how visitors use the website	Yes
Advertising	Google Ads, Reddit Pixel	Measuring our ads and showing relevant ads	Yes
Analytics	Microsoft Clarity	Understanding how visitors use the website, including session recordings and heatmaps	No, currently used on every visit
Marketing attribution	A first-party cookie (utmTags) that stores the campaign parameters and ad click identifier of the link that brought you to us, for 100 days	Knowing which campaigns bring visitors to us	No, currently set on every visit that arrives through a campaign link

When you reject analytics or advertising cookies, Google's tags run in a restricted mode that does not use cookies for those purposes, and the Reddit Pixel is not loaded.

6. Who Receives Your Data

We use the following service providers, who process personal data on our behalf under written agreements:

• netcup GmbH (Germany): hosting of our servers and backups, in Nuremberg, Germany.
• Amazon Web Services EMEA SARL (Luxembourg): sending of our emails.
• Independent contractors of our team, located in Egypt and India, who develop and support the platform.
• Google (sign-in with Google, Google Analytics, and Google Ads), Microsoft (Clarity), and Reddit (Reddit Pixel), for the purposes described above.

Paddle (Paddle.com Market Limited, United Kingdom) handles payments as merchant of record, as an independent controller (see Section 2).

We may also disclose personal data when required by law, or to protect our rights and the security of our platform.

7. International Transfers

Our servers are located in Germany. Some of our service providers and contractors process personal data outside the European Economic Area, including in the United States (Google, Microsoft, Reddit, and Amazon Web Services where applicable), the United Kingdom (Paddle, covered by an EU adequacy decision), Egypt, and India. For these transfers we rely on the EU-US Data Privacy Framework where the recipient is certified, or on the standard contractual clauses adopted by the European Commission. You can request more information about these safeguards at hello@bluefox.email.

8. Data Security

We take appropriate technical and organizational measures to protect your data, including encryption of data in transit and at rest, encrypted storage of AWS SES credentials and webhook secret keys, restricted and logged administrative access, and encrypted backups. No system is completely secure, but we work to prevent unauthorized access and to respond quickly if an incident occurs.

9. Data Retention

We keep your account data for as long as your account exists. When you delete your account, we delete your personal data from our active systems immediately. Copies may remain in our encrypted backups until those backups expire, no later than 13 months after deletion. We keep invoices and accounting records for as long as Hungarian accounting law requires (currently 8 years).

10. Your Rights

Under the GDPR, you have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• have your personal data deleted;
• restrict the processing of your personal data;
• receive your personal data in a portable format;
• object to processing based on our legitimate interests, including direct marketing; and
• withdraw your consent at any time, where processing is based on consent, without affecting processing before the withdrawal.

To exercise these rights, please contact us at hello@bluefox.email.

You also have the right to lodge a complaint with a supervisory authority. In Hungary, this is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), naih.hu. You may also contact the supervisory authority in the EU country where you live or work.

11. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page at least 30 days before they take effect, unless a shorter period is required by law, and we will notify you by email through our Legal updates mailing list.

12. Contact Us

If you have any questions about this privacy policy, please contact us at hello@bluefox.email.