Privacy Policy

This is an English translation for convenience. The German version is legally binding. German version: Datenschutzerklärung

1. Controller

Daniel Diegel
Eichengrund 10
71397 Leutenbach, Germany
Email: human@humanmailbox.com

No data protection officer has been appointed, as there is no legal obligation to do so.

2. Overview

Human Mailbox provides AI agents with a postal address in Germany. The contracting party is in each case the natural or legal person who operates the agent (“operator”). We process personal data only to the extent necessary to operate this website, the API and the receipt of mail.

3. Hosting and storage (Cloudflare)

The website, API and database run on the infrastructure of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (Cloudflare Workers, D1 database, KV storage for photos and scans). When the site is accessed, Cloudflare processes technically necessary connection data (including IP address, time, requested address, user agent) in order to deliver the site and to protect it against attacks. Cloudflare is certified under the EU-U.S. Data Privacy Framework; standard contractual clauses are in place in addition. The legal basis is Art. 6(1)(f) GDPR (secure, stable operation) or Art. 6(1)(b) GDPR insofar as the processing serves the performance of the contract.

IP addresses are not stored by us in plain text. For abuse protection (e.g. limiting registrations) and for usage statistics we only store a hash value formed with a secret key, from which the IP address cannot be recalculated. In addition, we store the country determined by Cloudflare.

4. Registration of a mailbox and use of the API

During registration we process: the agent’s name, optionally model/framework and purpose, the operator’s name and email address, optionally operator type and country, optionally a webhook address. We store the API key only as a hash value. For every API or MCP request we log the time, the endpoint or tool called, the result (status code), the hashed IP address, the country, the user agent, the type and name of the program derived from it (e.g. a particular AI client or library) and the network operator (AS number and organisation, as transmitted by Cloudflare). This serves to operate and protect the service, to detect abuse and to understand how and by which programs it is used. Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(f) GDPR (security, improvement of the service).

Verification of the email address: We check the spelling, whether it is a disposable address and whether a mail server exists for the domain (DNS query via Cloudflare). We then send an email with a confirmation link (sent via Cloudflare Email Service). Legal basis: Art. 6(1)(b) and (f) GDPR.

5. Items, photos and scans

For each incoming item we record the mailbox code, sender, carrier, tracking number, weight, condition and a photo of the outside. On instruction, we open items and photograph or scan the contents. This data may contain personal data of third parties (e.g. senders, contents of letters). We process it solely in order to make it available to the respective operator or their agent, and we treat contents confidentially. The operator is responsible for the content of the items addressed to them. The person who handles the mail is bound to confidentiality.

For letters we send for you (send_letter) we store the text or PDF you transmit and the recipient address; for returns and shipping the label and tracking data; for purchases (buy_voucher, buy_item) the product, shop, price and, for vouchers, the code (encrypted, § 7a of the terms). This data is processed to perform the order (Art. 6(1)(b) GDPR) and kept like photos and scans; documents to send are deleted 90 days after the order is done.

Code vault: If an item contains voucher, gift card or comparable codes, we read them in and store them encrypted in the customer’s mailbox. Until they are retrieved, notifications contain only a label, the value and the last three characters. Legal basis: Art. 6(1)(b) GDPR; with regard to senders, Art. 6(1)(f) GDPR (delivery to the recipient).

For forwarding, we pass the recipient address and shipment data on to the commissioned carrier (e.g. Deutsche Post/DHL, DPD, GLS, Hermes, UPS).

6. Orders, messages, interest and contact

We store orders, messages between agent and human, and details from the contact form and the interest form (name, email, country, request) for processing and for follow-up questions. Legal basis: Art. 6(1)(b) or (f) GDPR.

7. Notifications via Telegram

The operator of this service receives short notifications about new registrations, orders, payments and messages via a Telegram bot of its own. These contain only what is necessary (e.g. mailbox code, the agent’s name, type of order, amount). Provider: Telegram Messenger Inc. / Telegram FZ-LLC (Dubai, UAE); this involves a transfer to a third country for which there is no adequacy decision. Legal basis: Art. 6(1)(f) GDPR (prompt processing).

8. Webhooks

If an agent provides a webhook address, we send events (e.g. item received, status change) to that address. The operator is responsible for the recipient of this data.

9. Payments

PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. When you pay via PayPal, PayPal processes your payment data under its own responsibility; we receive the confirmation, the amount and the payer’s PayPal email address.
x402 (USDC on Base): Payments are verified via an x402 facilitator, the Coinbase Developer Platform of Coinbase, Inc., San Francisco, USA (only once x402 is offered on this site; until then this payment method is not available), and settled on the public Base blockchain. The facilitator receives the payment data (wallet address, amount, signed payment authorization), not your account data. The payer’s wallet address, the amount and the transaction hash are permanently publicly visible there.
Bitcoin: Payments are made via the public Bitcoin network; addresses, amounts and transactions are permanently public. To check incoming payments we query the public interface of mempool.space (only Bitcoin addresses are transmitted in the process).
Exchange rates: Our prices are in euros. We retrieve the rate for Bitcoin and for converting euros into USDC (x402) from mempool.space without any personal data.

We store bookings (amount, method, transaction number) for the performance of the contract and on the basis of retention obligations under commercial and tax law (Art. 6(1)(b) and (c) GDPR).

10. Audience measurement (self-hosted, without cookies)

We use a self-hosted instance of the open-source software Umami (hosted on Cloudflare). Counting takes place mainly on our server; no cookies are set and no profiles are created. For clicks on marked buttons and links, the page loads a small script of our own (/t.js, from our domain, without cookies and without storage in the browser); it reports the click together with the page, the IP address (only for forming the daily changing anonymous identifier) and the browser identification string to the same self-hosted statistics. With every page view, our server transmits to these statistics of our own: the page viewed, the referring source, the preferred language and the browser identification string (from which browser and device type are derived). The IP address is used only to form a daily changing, anonymous identifier and is not stored. For programs and crawlers (e.g. search engines and AI crawlers), only their name and the page viewed are counted instead. In addition, our server reports aggregated API events (e.g. “registration”, “order created”) without personal data. Legal basis: Art. 6(1)(f) GDPR (improvement of our offering).

In addition, we store every page view in our own database: time, page, referring website (host only), the hashed IP address (see section 3), country and network operator as reported by Cloudflare, the browser identification string and, if the page reports it via /t.js, how many seconds the page was visible. This lets us see how often and how long the pages are used and whether visitors are people, AI agents or crawlers. We do not combine this with data from other websites. Storage period: 400 days (see section 12). Legal basis: Art. 6(1)(f) GDPR (improvement of our offering and abuse protection).

11. Cookies

We do not set any cookies for visitors. Technically necessary cookies exist only for protected areas (login of the operator of this service and access to pre-release versions). Legal basis: § 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR.

12. Storage period

Account data: until the mailbox is deleted, thereafter insofar as statutory retention obligations exist.
Originals (letters, parcels): 4 weeks after arrival, unless forwarded or returned before then; after that they are disposed of, and documents are destroyed in a data-protection-compliant manner.
Photos and scans of items: 90 days after the item has been completed or after the 4 weeks have expired, earlier at the operator’s request.
Codes in the code vault: until retrieval, at most 24 months; retrieved codes until the mailbox is deleted.
Activity logs (page views, API/MCP requests, with hashed IP addresses): 400 days.
Contact and interest enquiries: until they have been dealt with, at most 2 years.
Booking and invoice data: 6 or 10 years respectively (§ 257 HGB, § 147 AO).

13. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on Art. 6(1)(f) GDPR (Art. 21). To exercise these rights, please contact the address given above. You can also lodge a complaint with a data protection supervisory authority, e.g. the one responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart.

14. Changes

We will amend this policy if the service or the legal situation changes. Last updated: 29 October 2026.