Who is responsible
ScargoAI EOOD
3 Bogatitsa St, fl. 2, ap. 8, 1421 Sofia, Bulgaria
Privacy, support and security: rangel@scargo.ai
Cyberpigeon is an email infrastructure service for software agents. For account administration and service security, the operator acts as controller. For message content processed on a customer's instructions, the customer normally acts as controller and Cyberpigeon acts as processor. Where the customer is itself a processor, Cyberpigeon is its subprocessor. The customer determines its own lawful basis, notices and permissions for agent email workflows.
Data and purposes
| Data | Purpose and proposed legal basis |
|---|---|
| Account email, workspace name, declared intended use, password hash, recovery-code hash and terms acceptance version/time | Provide and administer the account and contract (GDPR Article 6(1)(b)); comply with applicable recordkeeping duties where required (6(1)(c)). |
| Session tokens, API-key hashes, scopes, key usage timestamps and rate-limit identifiers derived from client IP addresses and email addresses | Authenticate requests and prevent unauthorized access or abuse, on the basis of providing the service and our legitimate interest in securing it (6(1)(b) and 6(1)(f)). |
| Agent names/addresses, custom domains, DNS verification records, email bodies, headers, recipients, attachment metadata and delivery events | Provide the email functionality instructed by the customer under the applicable processing agreement. Email may contain information about senders, recipients and people mentioned in content. |
| Request method/path, request identifiers, error type, service logs and hashed rate-limit buckets | Operate and troubleshoot the service and limit abuse (legitimate interests, 6(1)(f)). We do not intentionally log passwords, bearer keys, cookies or message bodies. |
| Outbound waitlist email, consent version and signup time | Send development and early-access updates about the separate outbound product, based on your optional consent (6(1)(a)). Joining does not create an account or permit outbound sending. |
| Stripe customer and subscription references, plan, billing region, billing period, usage totals, purchase acceptance, billing name, address and, for businesses, legal name and tax identifiers, and numbered invoice/credit-note records and PDFs | Process subscriptions, apply capacity and maintain transaction records (6(1)(b) and 6(1)(c)). Payment card details are entered on Stripe, not stored in this application. |
| Optional email wake-up destinations, encrypted callback credentials, inbox identifiers, delivery cursors and status | Deliver incoming-email notifications to the destinations you configure. |
| Product analytics, when enabled: events describing how a workspace uses the console, API, MCP connections, email wake-ups and billing (event name and time, workspace ID, account email, workspace name, plan, intended use, request route, status and error codes, counts and durations). Signed-in actions are linked to the workspace whatever the cookie choice. Once you answer the analytics question, page views are counted (page address without its query, referrer, page title, browser, screen size and time zone). If you reject, they are counted without cookies or device storage, using a hash of your IP address and browser that PostHog rotates daily, without location. If you accept, they use a PostHog cookie and come with clicks, page performance, browser errors, approximate location derived from the IP address, and session replays with all page text and form inputs masked. | Understand how the service is used and improve onboarding, reliability and the product (legitimate interests, 6(1)(f)), including counting visits without cookies after you reject. Analytics cookies and session replays are used only with your consent (6(1)(a)), which you can withdraw at any time in Privacy choices. Email bodies, subjects, recipient addresses, API keys, recovery codes and passwords are not sent to analytics. |
| Optional intended email workflow | Understand customer needs and support onboarding (legitimate interests, 6(1)(f)). You can edit or remove this information in Settings. |
| Privacy requests and responses | Handle and document rights requests and meet applicable legal duties (6(1)(c)). |
Account and credential information is needed to use an account. You choose agent names, email content and recipients. Your email address is currently unverified; email-based password reset is unavailable. Recovery uses the one-time code shown at account creation or password change.
Where data goes
The application and PostgreSQL database run on Microsoft Azure in North Europe (Ireland). Resend is the sending and receiving provider. Email content and recipient information pass through that provider and the recipients' mail systems. Inbound attachments remain at the email provider and are accessed using temporary download links.
Stripe processes billing identity, address, tax details and payment information to collect payments, calculate applicable tax and manage subscriptions. See Stripe’s privacy notice. When product analytics is enabled, PostHog receives the analytics data described above through this website’s own domain and stores it in its EU Cloud, whose servers are in Frankfurt. Authorized operators may access data to support the service, investigate security incidents or meet legal duties. We do not sell account or message data. This application does not use email content to train models, run advertising analytics, or send customer mailbox content to an external abuse classifier. Automated checks use sending patterns, provider feedback and local content fingerprints to pause suspicious sending for operator review. Contact support to challenge a hold; an operator decides whether to release it or ban a confirmed violation. Fingerprint history is retained for seven days and review records for 90 days; active hold and ban status remain on the account. Banned account records remain subject to operator review and privacy requests. When enabled, our support email assistant sends support message text and sender information to OpenAI Codex to answer questions, and copies the operator through the office mailbox. Do not send passwords, API keys or payment-card details in support messages. Your own agent integration may process email with other services under your control. When you enable email wake-ups, we send event and inbox/message identifiers to your configured callback or Claude Routine; these notifications omit message subjects and bodies. The connected agent can separately read email using the permissions you grant. Remove the configuration to delete its saved credentials; expired configurations are removed after thirty days and account erasure removes all of them.
An EU application region is not a promise that every provider's processing stays in the EEA. Provider support and subprocessors may process data internationally. Applicable vendor agreements, transfer safeguards and transfer assessments must be confirmed before enabling production personal-data workloads. See providers and processing locations.
Retention and deletion
Outbound waitlist entries are automatically removed from the live database after 180 days. To withdraw consent or request earlier removal, email the privacy contact above; no account is required. We stop using removed entries for product updates. Waitlist email addresses are unverified and must be yours to submit; we do not send an automated confirmation email. The backup retention described below also applies to this data.
Messages and account records remain in the live database while the account is open; there is currently no automatic age-based message retention setting. You can export the data and close the account in Settings. Closing immediately revokes browser sessions and API keys, pauses agents and cancels unattempted queued sends. An already attempted email may still be delivered.
Live account data is erased by a background process after at least five minutes and after custom-domain provider cleanup has completed. Cleanup retries when a provider is unavailable. Provider-held message and attachment copies require separate operator follow-up; recipients' copies cannot be withdrawn by Cyberpigeon. Billing references, invoice details, numbered invoices and credit notes, purchase acceptance and usage totals are retained separately for accounting, disputes and applicable statutory obligations; their structured records are included in account exports, PDFs are downloadable in Billing, and they are not erased by automatic mailbox cleanup. Contact the operator for billing-record retention and deletion requests. Minimal closure/request audit records and hashed retired-address fingerprints remain to record the request and prevent address reassignment.
Azure database rolling backups are configured for seven days and operational logs for thirty days. Aggregate acquisition and recurring-revenue measurements, without customer identifiers or message content, are retained for thirteen months in the restricted developer dashboard. PostHog keeps analytics events and session replays for the retention periods configured in the Cyberpigeon PostHog project. Erasing a closed workspace includes deleting its PostHog profile, events and recordings, either through PostHog’s deletion API or by the operator. Separately retained deployment/migration backups and the previous infrastructure require operator review during erasure; they do not automatically follow the rolling-backup period. Expired sessions are removed by the background process. Rate-limit buckets are removed after two days. These statements describe the current beta configuration, not a guarantee of immediate deletion from every system.
Your rights
Depending on the circumstances, you may request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. Where processing is based on consent, you may withdraw that consent without affecting prior lawful processing. You can complain to the supervisory authority where you live or work, or where an alleged infringement occurred. Find an authority through the EDPB member list.
Account owners can download a machine-readable export or submit a rights request in Settings → Privacy. Senders, recipients and other people without accounts can contact the public privacy contact above, once confirmed. If the request concerns a customer's email workflow, contact that customer as controller; Cyberpigeon can assist them. We may need proportionate proof of identity. GDPR generally requires a response within one month; permitted extensions must be explained within that first month. Requests and any reason for limitation should be documented.
Cookies, changes and contact
We use an essential sign-in cookie and a cookie that remembers your analytics choice. PostHog analytics cookies are set only if you accept them, and there are no advertising cookies. See the cookie notice. Material changes to processing will be reflected here before they take effect and communicated to affected account owners where required. This beta is intended for adults using developer tools; do not submit children's data or special-category data without a separately agreed and assessed arrangement.