Privacy Policy

1. Data Controller

Digi-Tal ApS (CVR 41308427), Nørrebrogade 45, 2200 Copenhagen N, Denmark, is the data controller for the information we process about you as a user of Digiboks — name, email address, company details and your use of the service. For the post we forward on your company's behalf, your company is the data controller and Digi-Tal ApS is the data processor. That processing is governed by our data processing agreement. You can contact us at support@digi-tal.dk.

2. What information do we collect?

We collect your name and email address when you create an account (via Google login or email). We also store the CVR numbers and company names you add, along with the email addresses you designate as recipients of forwarded post. We do not store the content of your post: messages and attachments are forwarded directly to your email without being stored by us. We do store information about each forwarding — sender, subject line, number of attachments and timestamp — so you can see your activity in Digiboks.

3. Purpose of processing

We process your information to provide the Digiboks service: forwarding post from Digital Post and e-Boks Erhverv to the email addresses you have specified. We also use your email address to send confirmation emails, service notifications and — if you have given consent — news about Digiboks.

4. Legal basis

Processing is based on contract performance (GDPR Art. 6(1)(b)) — we process your data to deliver the service you have signed up for. Marketing communication is based on your consent (GDPR Art. 6(1)(a)).

5. Data sharing

We share your information with the sub-processors necessary to operate the service: Neon (database, hosted in Frankfurt), Vercel (service hosting), Resend (email delivery, including the forwarded post and its attachments), Clerk (login and user accounts), Fly.io (receiving post from Digital Post, hosted in Amsterdam), Microsoft Azure (automatic setup and, when Smart routing is enabled, AI categorisation, hosted in the EU — Sweden), Loops (newsletters and service messages), Convex (checking whether your company is a Digi-Tal Regnskab client, hosted in Ireland), cvrapi.dk (company data lookup) and Sanity (our blog). We also use Sentry for error monitoring and Stripe for payment if you choose a paid plan. We never sell your data to third parties. Some of these providers are established outside the EU/EEA — this applies to Resend, Clerk and Loops. Transfers take place on the basis of the European Commission's standard contractual clauses or an adequacy decision.

6. Retention and deletion

Your account information is retained for as long as your account is active. If you delete your account or remove a company, the associated information is deleted. Information about forwarded messages — sender, subject line and timestamp, but never content — is deleted automatically after 12 months.

7. Your rights

You have the right to access, rectification, erasure, restriction, and data portability regarding your personal data. You can also withdraw your consent to marketing at any time. Contact us at support@digi-tal.dk to exercise your rights. You also have the right to lodge a complaint with the Danish Data Protection Agency (datatilsynet.dk).

8. Security

All communication between you, our servers and your email recipients is encrypted with TLS. Forwarded mail is sent with enforced TLS: if the recipient's mail server cannot accept encrypted mail, the message is not sent — we would rather hold it than send the contents unencrypted. Communication with Digital Post uses mutual TLS and a company certificate. Our database is hosted in Frankfurt and our Digital Post gateway in Amsterdam. A few sub-processors are located outside the EU/EEA, see section 5. We follow industry best practice for access control and data handling.

9. Automatic sorting (Smart routing)

Smart routing is an opt-in feature and is off by default. If you enable it for a company, the content of that company’s incoming messages — including text in attached documents — is analysed automatically for the sole purpose of categorising the message (e.g. “Invoice” or “Tax & VAT”) and forwarding it to the recipients you have chosen for that category. The analysis happens in two steps: first a rule-based check of sender and subject, and only if that is inconclusive is the text sent to an AI model. We do not store the content of your messages — only the resulting category and a confidence score are stored as metadata. You can turn Smart routing off again at any time, after which all analysis stops immediately.

The AI model is operated by our data processor Microsoft on the Azure platform in the EU (Sweden), and the processing is covered by Microsoft’s data processing agreement. Microsoft states that the content is not made available to other customers or to the model provider, and that it is not used to train AI models. However, as part of Microsoft’s monitoring for misuse of the service, content may be retained for up to 30 days in a separate, encrypted log environment in the EU. It is not reviewed by humans unless Microsoft’s automated systems flag it as potential misuse; in that case authorised Microsoft employees located in the EEA may access it. If you do not want this processing, simply do not enable Smart routing — all other mail forwarding works unchanged without the feature.