Privacy Policy
Last updated
Prawnwire is run by Boxmarshall Ltd, a company registered in Nigeria (RC 1557325) with its office in Lagos (“Boxmarshall”, “we”, “us”). This policy explains what personal data we handle when you use prawnwire.com, the console at console.prawnwire.com, the inbox at inbox.prawnwire.com and its phone and desktop apps, our mail servers, the Prawnwire API, and Prawnwire’s hosted MCP server at mcp.prawnwire.com. It is written to meet the Nigeria Data Protection Act 2023. Our Terms of Service cover the rest of how Prawnwire works.
Our two roles
- For accounts, billing and running the service, we decide what data is needed and why. For this data we are the data controller.
- For the mail in your organisation’s mailboxes, your organisation decides what is sent, received and kept. We store and process that mail on its behalf, and only to provide the service. If you write to or receive mail from a Prawnwire customer and want to know what they hold about you, ask that organisation first. We will help them answer.
What we collect
When you create and run an account
- Your name, email address and password. The password is stored only as a hash, never in a form we can read.
- Your organisation: its name, members and their roles, invitations, domains, mailboxes, shared addresses, plan and usage.
- API keys, stored only as a hash. You see a key once, when it is created.
- A log of changes made in the console: who changed what, and when.
When you use your mailboxes
- Mail. The messages and attachments in your mailboxes, and the folders you keep them in, stored on our mail servers. Incoming and outgoing mail is scanned automatically for spam and malware.
- Signing in to the inbox. Your mailbox password is held in a server-side session, sealed with a key that only your browser’s cookie holds. We cannot open it without that cookie, and signing out deletes it.
- Mailboxes from other providers. If you link an account from another provider over IMAP, its sign-in details are stored sealed, under a key that needs your Prawnwire mailbox’s password to open.
- Preferences. Settings such as signatures, the senders whose images you allow and your read receipt default, stored sealed.
- Read receipts, if you turn them on. A message you send with a read receipt carries a small image. When the recipient’s mail app loads it, we record the time and a broad label for the app, such as “apple-mail”. We never record the recipient’s IP address or full user agent.
- Delivery records. When our servers deliver mail, we keep a record of each delivery attempt to protect your domain’s sending reputation and to confirm scheduled sends. Recipient addresses in these records are hashed, and addresses quoted back by receiving servers are removed.
- Notifications, if you allow them. Your browser gives us a push subscription for its vendor’s push service (Apple, Google or Mozilla), which delivers new-mail notifications to your device.
- Images in messages. Remote images are blocked until you allow them. When you do, our server fetches them for you without cookies or a referrer, so the sender sees our server rather than your device.
- Sender logos and icons. When a sender’s domain publishes a logo, our server fetches it, sending nothing about you. When a sender has no picture or logo, the inbox shows an icon for the kind of organisation behind their domain, such as a bank or a shop. Our own rules decide most of these. For a domain they do not recognise, we may send the domain name alone to TypeSafe AI, which suggests the kind of organisation. It never receives an address, a name, a subject or any part of a message.
When you use the calendar
- Events. The events in your calendars, including those added from invitations you receive, stored in our database.
- Subscribed calendars. If you subscribe to a calendar by its address, the address is stored sealed and our server fetches the calendar for you, so its host sees our server rather than your device.
- Calendars from other providers. If you connect Google Calendar or another calendar account, such as iCloud, Fastmail or Nextcloud, we store its sign-in details sealed: for Google, the access Google gives Prawnwire when you allow it; for others, the app password you enter. Our server uses them only to show the calendars you choose, and to save back to that account the events you create, change, delete or answer in Prawnwire, or through an AI app you have allowed to change your calendar (see When you connect AI tools). We never change the account’s settings or share its calendars. Disconnecting deletes the sign-in details and every event loaded from that account from Prawnwire, and for Google also withdraws the access Google gave us.
Prawnwire’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Calendar data only to show and update your calendars in Prawnwire, and to answer an AI app you have connected and allowed to use your calendar. We never use it for advertising or to train AI models.
When you connect AI tools
Prawnwire has no AI of its own that reads your mail or your calendar. The AI tools that work with your mailbox and calendar are the ones you choose and connect, through Prawnwire’s hosted MCP server at mcp.prawnwire.com.
You connect an AI app by signing in to Prawnwire and choosing what it may do. For mail: read only, or also send, reply, move and delete. For your calendar, when the app asks for it: off, read only (it sees your calendars and events, including guests and when you are busy), or read and act (it can also create, change and delete events, and send invitations as you). We keep a record of the app (its name and the address it returns to), what you allowed and when, hashes of its access tokens, and your mailbox password sealed under a key that only the app’s token can open, so a copy of our database cannot open your mailbox. The connection ends when you disconnect the app under Connected apps in your account’s security settings, change your password or two-step settings, or sign out everywhere, and when the app goes 30 days without using it.
Calendar access covers every calendar in your mailbox: your own, the ones you subscribe to, and the ones you have connected from Google or another provider. An app with calendar access reads those events through Prawnwire, and with read and act it can change them, and Prawnwire saves the change back to Google or the other provider as it does for a change you make yourself. The app gets only what it asks for within the access you chose, and what it does with it is covered by its provider’s terms and privacy policy. Apps connected before calendar access existed stay mail only until you connect them again. Connected apps shows each app’s mail and calendar access.
What an AI tool does with the mail it reads is governed by that tool’s provider.
When you pay
Boxmarshall invoices your organisation. We keep the billing contact’s name and email address, your organisation’s details, invoices and payment records. If you pay online, the payment is handled by Bachs Technologies Limited (bachs.io), our payment provider. Bachs collects your card or bank details on its own page and tells us only whether the payment succeeded and for how much; we never see or store card numbers. Bachs handles those details under its own privacy policy.
When you contact us
The messages you send us and our replies.
When you visit this website
prawnwire.com sets no cookies, runs no analytics and has no forms. Its pages are served through Cloudflare, which processes your IP address to deliver and protect the site. Fonts come from our own server, and the plans in the pricing section are fetched by our server, not by your browser.
Logs
Our services write operational logs so we can find and fix problems. Mail operations are logged against a keyed hash of the mailbox, not its address. These logs are kept for 30 days.
How we use it
| Purpose | Legal basis |
|---|---|
| Hosting your mail and calendars, running the inbox, console and MCP server, delivering what you send | Contract |
| Keeping the service secure, blocking spam and abuse, protecting sending reputation | Legitimate interests |
| Invoicing and keeping financial records | Contract and legal obligation |
| Telling you about your account, security issues and changes to the service | Contract |
| Answering your questions | Legitimate interests |
We use your data only to provide Prawnwire to you and to keep it secure. We do not sell it, show advertising, build profiles, or use your mail, your calendars or anything else you keep in Prawnwire to train AI models, ours or anyone else’s. People at Boxmarshall do not read your mail or your calendars, except when you ask us to for support or when the law requires it.
Where it is stored
- The console, inbox and API run on servers operated by Hetzner Online in Falkenstein, Germany.
- Mailboxes are stored on Hetzner servers in Helsinki, Finland, and backed up.
- Our websites are served through Cloudflare’s global network.
Storing data in Germany and Finland moves it out of Nigeria. For these transfers we rely on the safeguards the Nigeria Data Protection Act allows: the data protection law of the European Union, which applies in both countries, and our agreements with these providers. TypeSafe AI, in the United States, receives sender domain names only, and commits not to train its models on them or pass them to anyone but its own service providers.
Who we share it with
We share personal data only with the providers that help us run Prawnwire, under agreements that limit them to that work:
| Provider | What they do | Where |
|---|---|---|
| Hetzner Online | Servers for the apps, the database and mail | Germany and Finland |
| Cloudflare | Delivering and protecting our websites, and DNS | Global network |
| Bachs Technologies Limited | Taking online payments for invoices | Nigeria |
| TypeSafe AI, Inc. | Suggesting the kind of organisation behind a sender’s domain, from the domain name alone | United States |
| Apple, Google, Mozilla | Delivering notifications, only if you allow them | Their own push services |
Our deployment platform, Reoclo, also run by Boxmarshall, keeps the service logs described above. When you connect a calendar from another provider, the events you create or change in Prawnwire go to that provider, at your request. Mail you send goes, by its nature, to the recipients’ mail servers. We disclose data to authorities only when Nigerian law or a court order requires it and, where the law allows, we tell your organisation.
How long we keep it
| Data | Kept for |
|---|---|
| Mailboxes, mail and calendars | While your organisation keeps them. After cancellation, 30 days for you to export, then deleted; backup copies age out within 90 days |
| Console accounts and the change log | While the organisation’s account exists, then deleted with its data |
| Inbox sessions | Until you sign out or the session expires |
| Connected calendar accounts and their events | Until you disconnect the account |
| Read receipts | 90 days |
| Delivery records | 90 days |
| Service logs | 30 days |
| Invoices and payment records | As long as Nigerian tax and company law requires |
| Support messages | While the organisation’s account exists |
How we protect it
- Connections to our websites, apps and mail servers are encrypted in transit.
- Mailbox passwords, the sign-in details of linked mailboxes and connected calendar accounts, and the addresses of calendars you subscribe to are sealed with AES-256-GCM and cannot be read from a copy of the database.
- Console passwords, API keys and hosted MCP tokens are stored only as hashes.
- Access to production systems is limited to the Boxmarshall staff who run Prawnwire.
If a breach puts your personal data at risk, we will report it to the Nigeria Data Protection Commission within 72 hours of becoming aware of it, and tell the people affected without undue delay.
Your rights
Under the Nigeria Data Protection Act you can ask us to:
- give you a copy of the personal data we hold about you
- correct data that is wrong
- delete data we no longer need or have no right to keep
- restrict how we use it, or object to our using it on the basis of legitimate interests
- give you your data in a portable format, or send it to another provider
- stop using data we hold on the basis of your consent
Email support@prawnwire.com from the address on your account, and we will reply within 30 days. For mail in your organisation’s mailboxes, your organisation’s administrators can usually act first.
If you are not satisfied with our answer, you can complain to the Nigeria Data Protection Commission. If you are in the European Union or the United Kingdom, you can also complain to your local data protection authority.
Children
Prawnwire is for organisations. You must be 18 or older to create an account, and we do not knowingly collect data about children.
Changes to this policy
When we change this policy in a way that matters, we will tell account administrators by email or in the console at least 14 days before the change takes effect. The date at the top of this page shows the current version.
Contact
Boxmarshall Ltd, Lagos, Nigeria. Email support@prawnwire.com about this policy or your data.