Privacy Policy
Last updated
Prawnwire is run by Boxmarshall Ltd, a company registered in Nigeria (RC 1557325) with its office in Lagos (“Boxmarshall”, “we”, “us”). This policy explains what personal data we handle when you use prawnwire.com, the console at console.prawnwire.com, the inbox at inbox.prawnwire.com and its phone and desktop apps, our mail servers, the Prawnwire API, and the MCP server you run on your own computer. It is written to meet the Nigeria Data Protection Act 2023. Our Terms of Service cover the rest of how Prawnwire works.
Our two roles
- For accounts, billing and running the service, we decide what data is needed and why. For this data we are the data controller.
- For the mail in your organisation’s mailboxes, your organisation decides what is sent, received and kept. We store and process that mail on its behalf, and only to provide the service. If you write to or receive mail from a Prawnwire customer and want to know what they hold about you, ask that organisation first. We will help them answer.
What we collect
When you create and run an account
- Your name, email address and password. The password is stored only as a hash, never in a form we can read.
- Your organisation: its name, members and their roles, invitations, domains, mailboxes, shared addresses, plan and usage.
- API keys, stored only as a hash. You see a key once, when it is created.
- A log of changes made in the console: who changed what, and when.
When you use your mailboxes
- Mail. The messages and attachments in your mailboxes, and the folders you keep them in, stored on our mail servers. Incoming and outgoing mail is scanned automatically for spam and malware.
- Signing in to the inbox. Your mailbox password is held in a server-side session, sealed with a key that only your browser’s cookie holds. We cannot open it without that cookie, and signing out deletes it.
- Mailboxes from other providers. If you link an account from another provider over IMAP, its sign-in details are stored sealed, under a key that needs your Prawnwire mailbox’s password to open.
- Preferences. Settings such as signatures, the senders whose images you allow and your read receipt default, stored sealed.
- Read receipts, if you turn them on. A message you send with a read receipt carries a small image. When the recipient’s mail app loads it, we record the time and a broad label for the app, such as “apple-mail”. We never record the recipient’s IP address or full user agent.
- Delivery records. When our servers deliver mail, we keep a record of each delivery attempt to protect your domain’s sending reputation and to confirm scheduled sends. Recipient addresses in these records are hashed, and addresses quoted back by receiving servers are removed.
- Notifications, if you allow them. Your browser gives us a push subscription for its vendor’s push service (Apple, Google or Mozilla), which delivers new-mail notifications to your device.
- Images in messages. Remote images are blocked until you allow them. When you do, our server fetches them for you without cookies or a referrer, so the sender sees our server rather than your device.
When you connect AI tools
The MCP server runs on your own computer and connects to your mailbox with the credentials you give it, the way a mail app does. It keeps no logs. What an AI tool does with the mail it reads is governed by that tool’s provider.
When you pay
Boxmarshall invoices your organisation. We keep the billing contact’s name and email address, your organisation’s details, invoices and payment records. If you pay online, the payment is handled by Bachs Technologies Limited (bachs.io), our payment provider. Bachs collects your card or bank details on its own page and tells us only whether the payment succeeded and for how much; we never see or store card numbers. Bachs handles those details under its own privacy policy.
When you contact us
The messages you send us and our replies.
When you visit this website
prawnwire.com sets no cookies, runs no analytics and has no forms. Its pages are served through Cloudflare, which processes your IP address to deliver and protect the site. Fonts come from our own server, and the plans in the pricing section are fetched by our server, not by your browser.
Logs
Our services write operational logs so we can find and fix problems. Mail operations are logged against a keyed hash of the mailbox, not its address. These logs are kept for 30 days.
How we use it
| Purpose | Legal basis |
|---|---|
| Hosting your mail, running the inbox and console, delivering what you send | Contract |
| Keeping the service secure, blocking spam and abuse, protecting sending reputation | Legitimate interests |
| Invoicing and keeping financial records | Contract and legal obligation |
| Telling you about your account, security issues and changes to the service | Contract |
| Answering your questions | Legitimate interests |
We do not sell personal data, show advertising, or use your mail to train AI models. People at Boxmarshall do not read your mail, except when you ask us to for support or when the law requires it.
Where it is stored
- The console, inbox and API run on servers operated by Hetzner Online in Falkenstein, Germany.
- Mailboxes are stored on Hetzner servers in Helsinki, Finland, and backed up.
- Our websites are served through Cloudflare’s global network.
Storing data in Germany and Finland moves it out of Nigeria. For these transfers we rely on the safeguards the Nigeria Data Protection Act allows: the data protection law of the European Union, which applies in both countries, and our agreements with these providers.
Who we share it with
We share personal data only with the providers that help us run Prawnwire, under agreements that limit them to that work:
| Provider | What they do | Where |
|---|---|---|
| Hetzner Online | Servers for the apps, the database and mail | Germany and Finland |
| Cloudflare | Delivering and protecting our websites, and DNS | Global network |
| Bachs Technologies Limited | Taking online payments for invoices | Nigeria |
| Apple, Google, Mozilla | Delivering notifications, only if you allow them | Their own push services |
Our deployment platform, Reoclo, also run by Boxmarshall, keeps the service logs described above. Mail you send goes, by its nature, to the recipients’ mail servers. We disclose data to authorities only when Nigerian law or a court order requires it and, where the law allows, we tell your organisation.
How long we keep it
| Data | Kept for |
|---|---|
| Mailboxes and mail | While your organisation keeps them. After cancellation, 30 days for you to export, then deleted; backup copies age out within 90 days |
| Console accounts and the change log | While the organisation’s account exists, then deleted with its data |
| Inbox sessions | Until you sign out or the session expires |
| Read receipts | 90 days |
| Delivery records | 90 days |
| Service logs | 30 days |
| Invoices and payment records | As long as Nigerian tax and company law requires |
| Support messages | While the organisation’s account exists |
How we protect it
- Connections to our websites, apps and mail servers are encrypted in transit.
- Mailbox passwords and the sign-in details of linked mailboxes are sealed with AES-256-GCM and cannot be read from a copy of the database.
- Console passwords and API keys are stored only as hashes.
- Access to production systems is limited to the Boxmarshall staff who run Prawnwire.
If a breach puts your personal data at risk, we will report it to the Nigeria Data Protection Commission within 72 hours of becoming aware of it, and tell the people affected without undue delay.
Your rights
Under the Nigeria Data Protection Act you can ask us to:
- give you a copy of the personal data we hold about you
- correct data that is wrong
- delete data we no longer need or have no right to keep
- restrict how we use it, or object to our using it on the basis of legitimate interests
- give you your data in a portable format, or send it to another provider
- stop using data we hold on the basis of your consent
Email support@prawnwire.com from the address on your account, and we will reply within 30 days. For mail in your organisation’s mailboxes, your organisation’s administrators can usually act first.
If you are not satisfied with our answer, you can complain to the Nigeria Data Protection Commission. If you are in the European Union or the United Kingdom, you can also complain to your local data protection authority.
Children
Prawnwire is for organisations. You must be 18 or older to create an account, and we do not knowingly collect data about children.
Changes to this policy
When we change this policy in a way that matters, we will tell account administrators by email or in the console at least 14 days before the change takes effect. The date at the top of this page shows the current version.
Contact
Boxmarshall Ltd, Lagos, Nigeria. Email support@prawnwire.com about this policy or your data.