Cirrux Privacy Policy

Effective date: 16 August 2026.

This policy explains what Cirrux does with your data: what we collect, why, who else ever sees it, how long we keep it, and what you can demand of us. We have tried to write it so that you can actually check whether we are doing what we say.

The short version

We are a Dutch company. Everything runs on servers in Frankfurt, Germany, and your content stays in the EU.
Your mailbox is encrypted at rest, and our systems read it only to filter spam, scan attachments for malware, run your own filter rules and build your search index. No person at Cirrux reads your mail unless you ask support to look at something specific.
We never sell your data, never use it for advertising, never profile you, and never train AI models on it.
Cirrux Backup is end to end encrypted. The private key is generated on your machine and never reaches us.
We set one cookie, and it keeps you signed in. No analytics, no tracking pixels, no third-party scripts, on the website or in the apps. That is why you never see a cookie banner from us.
You can take your data out at any time, and you can have it deleted.

Who we are
What this policy covers
Your role and ours
What we collect
Why we process it, and on what basis
How your mailbox is actually handled
Cirrux Backup is different
Google user data
What email itself means for your privacy
Cookies and local storage
Who else sees data
Where your data lives
How long we keep it
Security
Your rights
Automated decisions
Children
Changes to this policy
Contact

1. Who we are

Cirrux is a product of Werk Slim B.V., Larenseweg 136, 1222 HM Hilversum, the Netherlands, registered with the Dutch Chamber of Commerce under number 77760026. Unless section 3 says otherwise, we are the controller of the personal data described here.

Privacy questions, requests and complaints go to help@cirrux.live. Put "privacy" in the subject and it reaches the right people faster.

We are not required to appoint a data protection officer and have not appointed one. Privacy requests are handled by the people who run the company.

2. What this policy covers

Cirrux Workspace: mail, calendar, contacts and Drive, whether you use our apps, the public API, or a standard client over IMAP, SMTP, CalDAV or CardDAV.
Cirrux Sync and Cirrux Backup: keeping an existing mailbox in step with Cirrux, and keeping an encrypted copy of a Google account.
Our websites, including cirrux.live and the documentation and help pages.

It does not cover what recipients do with mail you send them, or the services you connect Cirrux to. Google and Microsoft handle your data there under their own policies, not ours.

3. Your role and ours

If you pay for your own account, we are the controller of your data and this policy is the whole story.
If your account comes from an organisation, that organisation is the controller of the content in it and of the member data, and we are its processor. We act on their instructions. Questions about why they have your mailbox, or who in the organisation can see it, are theirs to answer, and we will point you to them.
For account, security, billing and log data we are always the controller, including for members of an organisation.
Our Data Processing Agreement covers that arrangement, and it applies to every business customer automatically, with nothing to request or sign. Where it and this policy disagree about data we process on a customer's behalf, the DPA wins.

4. What we collect

Account data: username, first and last name, recovery email address, a recovery phone number if you add one, time zone, your password (stored as a bcrypt hash, never in readable form), your two factor secret (encrypted), any passkeys you register, your profile image, and your display and notification preferences.
Your content: messages and attachments, calendar events, contacts, Drive files and their versions, labels, filter rules, signatures and auto-replies. This includes mail other people send you, and whatever they chose to put in it.
Session and technical data: for each signed-in session, the IP address, user agent, browser, operating system and device type, and when it was last used. You can see and revoke your sessions in settings. We also record connection and protocol events for IMAP, SMTP, CalDAV and the web API, and delivery events for mail we accept, send, defer or reject.
Billing data: your name, billing address, VAT number if you enter one, subscription state and invoices. Card details go straight to Stripe and never reach our servers.
Support correspondence: what you write to us, and the account context needed to answer it.
Connected accounts: if you use Sync or Backup, whatever those read from the source account, plus the OAuth tokens or IMAP credentials needed to keep reading it. Both are stored encrypted, and we never receive your password for those accounts unless you type an IMAP password into the import form yourself.

5. Why we process it, and on what basis

Running the service, meaning delivering, storing, syncing, indexing and searching your content, and running the rules you set: to perform our contract with you.
Spam, phishing and malware filtering: to perform the contract, and our legitimate interest in a platform that is safe to use.
Account security, rate limiting, and fraud and abuse prevention: our legitimate interest in protecting you, other customers, and our own systems.
Deliverability, meaning monitoring our sending reputation so your mail arrives: our legitimate interest, shared with every customer on the platform.
Billing, invoicing and tax records: to perform the contract, and to meet our legal obligations.
Support: to perform the contract.
Product update emails: your consent, which you can withdraw at any time in settings.
Responding to valid legal requests: our legal obligation.

6. How your mailbox is actually handled

Everything travels over TLS: HTTPS for the apps and API, TLS for IMAP, SMTP, CalDAV and CardDAV, and opportunistic TLS when we hand your mail to another provider. At rest, message bodies, attachments and Drive files sit in encrypted object storage in Frankfurt. Every object gets its own 256-bit key and is encrypted with AES-256-GCM, and that key is wrapped with a master key belonging to your workspace.

Cirrux Workspace is not end to end encrypted, and that is a deliberate choice rather than a gap. Our servers can read your mail, because these have to:

the spam filter, which checks SPF, DKIM, DMARC and ARC, scores the message and decides where it lands
the virus scanner, which is our own ClamAV running on our own servers. Your attachments are not sent to a third-party scanning service
your filter rules, which run on the server whether or not you have a client open
the search index, which is built in our own PostgreSQL database. There is no external search provider involved

What does not happen, and will not:

no advertising, and no profiling of you or the people who write to you
no selling, renting or sharing of your content, ever
no training of AI models on your content, ours or anyone else's
no person at Cirrux reading your mail, except when you ask support to look into a specific problem, and then only as far as answering it requires

The full encryption model, including why we chose it, is written out on the encryption page.

7. Cirrux Backup is different

Cirrux Backup does a different job, so it uses a different model. The Cirrux Downloader app generates a 2048-bit RSA key pair on your machine. The public key comes to us, the private key stays on your device. What we store is ciphertext we cannot read, and an attacker with full access to our servers would find the same.

The trade-off is real and worth stating: if you lose that private key, nobody can recover your backup, us included.

8. Google user data

If you connect a Google account for Sync or Backup, we request read-only access and nothing more: gmail.readonly, calendar.readonly, contacts.readonly, userinfo.email and userinfo.profile. Administrators setting up a Google Workspace migration also grant admin.directory.user.readonly and admin.directory.customer.readonly, so we can see which accounts exist to migrate.

Cirrux's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. In practice that means we use Google data only to provide the sync or backup feature you asked for, we do not use it for advertising, we do not sell it, we do not let humans read it except with your explicit permission or where the law requires it, and we do not use it to train AI models.

OAuth tokens are stored encrypted, and we never see your Google password. You can revoke our access at any time from your Google Account permissions page, which stops the sync immediately. Data we already hold is then handled under section 13.

9. What email itself means for your privacy

Some of this is true of email everywhere, and a privacy policy that leaves it out is being flattering rather than accurate.

Mail you send leaves our systems and arrives at the recipient's provider, where their rules apply, not ours. A message you send to a Gmail address is readable by Google the moment it lands. No provider can change that, and any that implies otherwise is overselling.
Delivering mail means exchanging metadata with other servers: sender and recipient addresses, timestamps, and the SPF, DKIM and DMARC checks that prove the mail is really from your domain.
When our mail client shows remote images in a message, it fetches them through our own proxy. A sender's tracking pixel therefore sees our server, not your IP address and browser.
The emails we send you, whether product updates, notifications or billing, contain no tracking pixels. We do not measure whether you opened them.

10. Cookies and local storage

We set one cookie, cirrux_crt_v2. It holds your refresh token so you stay signed in, it is httpOnly and Secure, and it lasts 30 days. The apps also keep a little in browser local storage: the same sign in state, your preferences, and the offline cache that makes them fast.

There are no analytics, no advertising or social media pixels, and no third-party scripts, on the marketing site or in the apps. Nothing we set requires your consent, which is why we do not ask for it with a banner.

We use a deliberately short list of processors. Each one gets only what its job needs:

Exoscale (Akenes SA, Switzerland), for hosting and object storage, in its DE-FRA1 data centre in Frankfurt. All customer content and account data. This is where the service runs.
Stripe (Stripe Payments Europe, Ltd., Ireland), for payments and invoicing. Billing data only: name, billing address, VAT number, payment method and invoices. Never content.
Sentry (Functional Software, Inc., on its EU instance), for error monitoring. Technical error reports and an account identifier. Reports from the apps send no personal information beyond that identifier, and they are proxied through our own servers rather than sent directly from the browser.
Moneybird (Moneybird B.V., the Netherlands), for bookkeeping. The name, email address and country on an invoice, and its amount and date. No content.
seven.io (seven communications GmbH & Co. KG, Germany), for SMS delivery. A phone number and a verification code, and only for accounts that add a recovery phone number.
Apple (Apple Inc., United States), for sending push notifications to the native Drive client. A device token and a signal that something changed. No file names and no contents.

Beyond that: the recipients you address mail to receive what you send them, and Google or Microsoft receive what is needed to read the account you asked us to sync.

We hand data to authorities only where we are legally required to. We check that a request is valid, give the minimum it covers, and tell you unless the law forbids it. We do not sell data, and we do not share it for anyone else's marketing.

12. Where your data lives

Your content is stored and processed in the EU, in Frankfurt, Germany, and we have no intention of changing that. Our company is Dutch and our infrastructure is European by design rather than by configuration.

The processors we use are European too, and we picked them that way. Stripe bills through its Irish entity, Sentry runs on its EU instance, seven.io is German, Moneybird is Dutch, and Exoscale is Swiss, which the European Commission has recognised as offering adequate protection.

Some of those providers have a parent company in the United States, and Apple's push service is American. For any support access or transfer that follows from this, we rely on the European Commission's standard contractual clauses.

13. How long we keep it

Your content: kept as long as your account is active. After a subscription ends we keep the workspace for 30 days, so you can reactivate or export it, and then delete it permanently.
Deletion means unreadable: destroying a workspace destroys its master keys, so the stored objects can no longer be decrypted. It is not a flag in a database.
Cirrux Backup data: deleted within 48 hours of cancelling or deleting your account.
Operational logs: deleted automatically on a schedule that depends on severity. Debug entries last 3 days, informational entries 7, warnings 14, and errors 30.
Sessions: refresh tokens expire after 30 days, and are revoked immediately when you sign out or revoke a session yourself.
Invoices and billing records: 7 years, because Dutch tax law requires us to keep them.
Support correspondence: kept while it is useful as support history, and deleted on request.

14. Security

Encryption in transit everywhere, and envelope encryption at rest with keys held per workspace, as described in section 6.
Two-factor authentication and passkeys are available on every account, and an administrator can require passkeys for a workspace.
Authentication is rate limited, and repeated failures and unusual activity are detected and acted on.
Access to production systems is limited to the people who operate them, and administrative actions on customer accounts are logged.
If a breach affects your personal data, we will tell you without undue delay, and notify the Dutch data protection authority within 72 hours where the law requires it.
Found a vulnerability? Email help@cirrux.live with "security" in the subject. We will not come after anyone who reports in good faith.

15. Your rights

Under the GDPR you can ask us to:

give you a copy of the personal data we hold about you, and tell you what we do with it
correct data that is wrong or incomplete
delete your data
restrict what we do with it, or object to processing we base on a legitimate interest
hand it over in a portable form, or send it to another provider
withdraw consent you gave earlier, without affecting what we did before you withdrew it

Much of this you can do yourself, and faster than we can: settings let you correct your details and revoke sessions, and IMAP, CalDAV, CardDAV and plain file downloads let any standard client take a complete copy of your mail, calendars, contacts and files whenever you want.

For the rest, email help@cirrux.live. We answer within one month, free of charge, and we may ask you to confirm who you are first. If your account was provided by an organisation, we pass requests about content to them, because they are the controller.

If you think we have got it wrong, tell us first and we will try to fix it. You also have the right to complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the supervisory authority where you live.

16. Automated decisions

Spam and malware filtering is automated, and it decides where a message lands. That is the only automated decision we make about your data. It has no legal or similarly significant effect on you, you can override it with your own rules and allow-lists, and you can ask us to look at a decision you think is wrong.

We do no profiling for advertising or any other purpose.

17. Children

Cirrux is not intended for children under 16, or under the age of digital consent in your country if that is higher. If you believe a child has an account without a parent or guardian behind it, tell us and we will deal with it.

18. Changes to this policy

We update this policy when what we do changes. For material changes we email you before they take effect, and the effective date at the top always reflects the current version. If you want a copy of an earlier version, ask us for it.

19. Contact

Werk Slim B.V.
Larenseweg 136, 1222 HM Hilversum, the Netherlands
Dutch Chamber of Commerce number 77760026
help@cirrux.live

Our Terms of Service explain the rest of the agreement between us.

Help Privacy Terms DPA Sustainability