This page describes exactly what the inbox cleaner does with your mail. It is written to be checkable against the software, not to be reassuring. Last updated 29 August 2026.
The controller of your personal data is:
| Syzygy Capital B.V., trading as BlumeChat.com |
| De Nieuwe Erven 3, 5431 NV Cuijk, The Netherlands |
| Registered with the Dutch Chamber of Commerce (KVK) under 85041076 |
| privacy@blumechat.com |
We are established in the Netherlands, so our supervisory authority is the Autoriteit Persoonsgegevens.
When you start a scan we connect to your mailbox over an encrypted IMAP
connection whose certificate we verify, and we read the headers of your
unread messages: sender, subject, date and the technical headers that say
whether a message is bulk mail or failed authentication. Your mailbox is opened
read-only and messages are fetched with BODY.PEEK, so
scanning never marks anything as read.
Most messages are settled from headers alone. For the ones that are not, we read part of the message text: about 200 characters first, and up to 3,000 characters for the small remainder that is still unclear. We never read attachments and we never read your whole mailbox, only unread mail in your inbox.
One pack sorts at most 20,000 messages. We stop at 20,000 even if your pack could pay for more. Mail is taken newest first, so if your inbox holds more than that, the oldest mail is never opened at all, and we tell you where we stopped.
We also read the sender addresses of your most recent sent mail, so we can tell the people you actually correspond with from bulk senders. We keep the addresses only for the length of the scan.
| What we do | Why | Lawful basis |
|---|---|---|
| Read and classify your unread mail, and carry out the actions you approve | It is the service you bought | Article 6(1)(b), performance of a contract |
| Process whatever happens to be in your mailbox, including sensitive messages | A mailbox cannot be sorted without reading it | Article 9(2)(a), your explicit consent, given before you connect |
| Hold your email address and send you a sign-in code | So the run you paid for is yours and you can come back to it | Article 6(1)(b) |
| Email you once when a scan is finished | Part of the service. We send no marketing. | Article 6(1)(b) |
| Take payment and keep the records | To charge you, and because Dutch tax law requires the records | Article 6(1)(b) and Article 6(1)(c), legal obligation |
| Rate limiting, abuse prevention, security logging | To keep the service available and safe | Article 6(1)(f), our legitimate interest in a working service |
| Count how many scans ran and how many messages were sorted | To know whether the product works. Counts only, with no identifier attached to them. | Article 6(1)(f) |
A mailbox contains whatever people have sent you. That can include medical appointments and bills, financial trouble, religious or political mail, union correspondence, and messages that reveal things about your health or your relationships. The GDPR calls this special category data and it needs your explicit permission before anyone may process it.
We ask for that permission on the connect screen, before you give us access. Nothing is read until you give it. We process this material only to sort your mail, we never single it out, and it is discarded on the same clock as everything else. You can withdraw your consent at any time by pressing "Forget everything now", by not starting another scan, or by writing to us. Withdrawing does not undo processing that already happened lawfully.
| Data | Kept for |
|---|---|
| Message text | Discarded the moment the message is classified. Never written to disk. |
| Your app password | Held in memory for the scan and for up to 30 minutes after your last action, then overwritten. Never written to disk, never logged, and never stored in any database. It is sent nowhere except your own mail provider, and there is no credential table, so there is nothing to leak. |
| Subjects and sender addresses | Held while you review your results, then deleted automatically one hour after the scan finishes, or immediately once you apply your decisions. You can delete them sooner with "Forget everything now". |
| Counts, and a link to each message | Kept while your account exists, so you can find a message again and see what a run did. A link contains no message content. |
| Corrections you make | Kept while your account exists. A correction is a sender address and the bucket you chose, never any message content. |
| Your account email address | While your account exists. It is never scanned and never sent to a model provider. |
| Sign-in codes | Stored only as a hash, deleted the moment they are used, expired, or guessed wrong five times. Never longer than 60 minutes. |
| Sessions | 90 days from last use. You can end them all at once from your account. |
| Payment records | Card details are handled by Stripe and we never see them. We keep a payment reference and the amount for 7 years, because Dutch tax law requires it. |
| Server logs | 30 days. They contain no message content, no subjects, no sender addresses and no credentials. |
These are all of our processors. There are no others, and this list changes only by updating this page.
| Who | What for | What they get |
|---|---|---|
| Cloudflare, Inc. (United States and EU) | Hosting, the database, the container your scan runs in, sending the mail we send you, and the routing of mail sent to our contact addresses | Everything the service holds, as its infrastructure provider |
| Nebius B.V. (Schiphol, the Netherlands) | Running the model that classifies your mail. It is a European company and the model runs in Finland, so your mail is not sent outside the EU to be sorted. | Sender, subject and, where needed, the excerpt of message text described above. Nothing else. |
| Stripe Payments Europe, Ltd. (Ireland) | Taking payment | Your email address and payment details. No mailbox data ever reaches Stripe. |
| Resend (United States) | Carrying our replies when we write back to you | Your email address and the text of our reply. No mailbox data. |
The model provider does not train on your mail. Nebius runs the model for us as a data processor under a contract, on zero-retention terms, and does not use what passes through it to train anything. We deliberately use one provider and no fallback: a fallback would mean your mail could reach a company this page does not name, which is not something we are willing to do.
We do not sell data. We do not share it with advertisers. There is no advertising and no analytics tracker on this site. No employee reads your mail; there is no interface that would let us.
The service runs on infrastructure in the European Union, and message content is processed in the container that runs your scan. The content of your mail does not leave the EU: the model that sorts it runs in Finland, for a company established in the Netherlands. What leaves the EU is payment and email handling, neither of which receives any mailbox content.
The United States has no European Commission adequacy decision. Transfers to our United States processors are therefore made under the European Commission's Standard Contractual Clauses, and, where the provider is certified under it, the EU-US Data Privacy Framework. Both of those companies are certified under the Data Privacy Framework, and both have also signed the Standard Contractual Clauses with us, so there is a second safeguard behind the first. Those transfers are payment and email handling only; no mailbox content is in them. We have written a transfer impact assessment for each, and you can ask us for a copy of it, and of the safeguards, at the address below.
Only what you approve, and never permanently. Marking as read can be undone. Archiving moves a message out of your inbox but keeps it searchable. Mail that fails authentication goes to your provider's Trash, where it is recoverable for 30 days. We never permanently delete anything.
Unsubscribing is the one action that cannot be undone, because you would have to re-subscribe yourself. We tell you that before you confirm.
A model sorts your mail into buckets, and it is sometimes wrong. It does not decide anything about you: nothing in your mailbox changes until you approve it, one bucket or one sender at a time. Because a person is always the one who decides, this is not automated decision-making of the kind Article 22 of the GDPR restricts. You can correct any classification, and your correction overrides the model for that sender from then on.
You have the right to ask us for a copy of your data, to correct it, to have it erased, to restrict or object to how we use it, to receive it in a portable form, and to withdraw consent you have given. Most of this is self-service and immediate, because almost nothing is retained: "Forget everything now" erases your scan content on the spot, and deleting your account removes the rest.
For anything else, write to privacy@blumechat.com. We answer within 30 days, and usually much sooner. We do not charge for this and we will not ask you for more identification than we need to be sure it is you.
If you think we have handled your data badly, please tell us first so we can put it right. You also have the right to complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ Den Haag, autoriteitpersoonsgegevens.nl, or to the authority where you live.
Giving us your mailbox credential is not a legal or contractual requirement, but it is the only way the service can work. If you do not want to give it, do not buy a pack.
Everything travels over TLS. The connection to your mail provider verifies the certificate and the hostname, so your credential goes to your provider and to nobody imitating them. Your app password is never written to disk and is overwritten in memory when it is no longer needed. The standing dataset, once a scan is over, is counts and links, which is close to worthless to an attacker. No message content is stored anywhere at any point.
If a breach happens that puts you at risk, we will tell the Autoriteit Persoonsgegevens within 72 hours and tell you without undue delay.
This service is not intended for anyone under 16 and we do not knowingly process their data.
If we change what we do with your data, we change this page and update the date at the top before the change takes effect. If the change is significant we will tell you by email.
Syzygy Capital B.V., De Nieuwe Erven 3, 5431 NV Cuijk, The Netherlands
Privacy: privacy@blumechat.com
Anything else: support@blumechat.com