Nexpand Mail — Privacy Policy
Last updated: 18 July 2026
This policy explains how Zsigmond Gergely, egyéni vállalkozó (sole proprietor, Hungary), registered seat: 1026 Budapest, Guyon köz 5., Hungary, sole-proprietor registration number: 59673189, VAT number: 90477241-2-41 ("we", "us") processes personal data in connection with the Nexpand Mail service at mail.nexpand.hu. We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Hungarian data-protection law. Contact for privacy matters: gergely.zsigmond@prime4squad.com.
1. The two roles we act in
- Controller — your account. For the data of registered users of the Service (account, billing, usage), we are the data controller. Sections 2–4 apply.
- Processor — your outreach data. For the contacts, recipient lists, email content and mailbox data our customers bring into or generate through the Service ("Customer Data"), the customer is the controller and we are their processor under our Data Processing Agreement. Section 5 applies.
2. Data we process about users (as controller)
| Category | Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| Account | Email address, name, password (stored as a scrypt hash), email-verification status, company/role assignments | Providing the Service, authentication, essential service emails (verification, password reset) | (1)(b) contract |
| Mailbox connections | Connected mailbox addresses and OAuth tokens (encrypted with AES-256-GCM; passwords are never seen or stored) | Sending your email through your own mailboxes at your instruction | (1)(b) contract |
| Billing | Subscription status, billing periods, Stripe customer and subscription identifiers. Card data is processed by Stripe only — we never see full card numbers. | Charging subscriptions, invoicing, accounting | (1)(b) contract; (1)(c) legal obligation (accounting/tax) |
| Usage & logs | Event audit log of operations in your account, scheduling and delivery logs, server logs incl. IP address | Operating, securing and debugging the Service, abuse prevention | (1)(f) legitimate interest (service security and operation) |
| Support | Emails you send us | Answering you | (1)(f) legitimate interest |
Providing account and billing data is a contractual requirement — without it we cannot provide the Service. We do not use your data for advertising, we do not sell it, and we make no automated decisions with legal effect about you.
3. Retention (as controller)
- Account data: for the life of the account and up to 30 days after deletion (removal from rolling backups).
- Billing and invoicing records: 8 years (Hungarian Accounting Act).
- Server and event logs: up to 12 months, unless needed longer for a specific security incident.
4. Recipients and transfers
| Recipient | Role | Location |
|---|---|---|
| Rackhost Zrt. (Szeged, Hungary) | Server hosting | EU (Hungary) |
| Stripe Payments Europe, Ltd. (and Stripe, Inc.) | Payment processing (Stripe acts as an independent controller for card processing) | EU / USA — EU–US Data Privacy Framework and SCCs |
| Resend (Plus Five Five, Inc.) | Sending transactional emails (verification, password reset) | USA — SCCs |
| Microsoft Ireland Operations Ltd. / Google Ireland Ltd. | Your own mailbox providers: the Service accesses them with the authorisation you grant, to send and read mail in your mailboxes at your instruction | Per your own agreement with them |
| HubSpot, Inc. | Only if you connect a HubSpot portal: data you choose to sync is sent to your HubSpot account at your direction | EU / USA — DPF |
Where data leaves the EEA, we rely on adequacy decisions (including the EU–US Data Privacy Framework) or the EU Standard Contractual Clauses. The web pages load fonts from Google Fonts; Google sees your IP address when your browser requests those files.
5. Customer Data — when we act as processor
Our customers store data about their outreach recipients in the Service: typically name, email address, company, personalisation attributes, the content of emails sent and of replies received, and engagement events (delivery, bounce, reply, opt-out). For this data the customer is the controller; we process it only on the customer's instructions, as set out in the Data Processing Agreement.
If you received an email sent through our platform and want access, correction, deletion, or to object to further messages, reply to the sender or contact them directly — the sender is the controller of your data. If you contact us instead, we will forward your request to the customer concerned and assist them in fulfilling it.
6. Google API Services — Limited Use disclosure
Nexpand Mail's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular: Gmail data is used only to provide the sending, reply detection and warm-up features you actively configure; it is not used for advertising, not sold, and not read by humans except with your explicit consent, for security purposes, or to comply with law.
7. Security
Key measures: TLS encryption in transit; passwords stored as scrypt hashes; mailbox OAuth tokens encrypted at rest (AES-256-GCM); company-scoped access control on every read and write; EU-located servers with key-based access; layered rolling backups; a full audit log of security-relevant events. Details are in Annex 2 of the DPA.
8. Your rights
Under the GDPR you have the right to access, rectify and erase your personal data, restrict or object to processing (including processing based on legitimate interest), and receive your data in a portable format. Contact: gergely.zsigmond@prime4squad.com. We respond within one month.
You also have the right to lodge a complaint with the Hungarian supervisory authority: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), 1055 Budapest, Falk Miksa utca 9–11; +36 1 391 1400; ugyfelszolgalat@naih.hu; naih.hu — or with the authority of your habitual residence, and to seek judicial remedy.
9. Cookies
The Service uses only strictly necessary cookies (login session). See the Cookie Policy.
10. Changes
We may update this policy; material changes are announced by email or in-app notice. The current version is always available at this address.
Log in · Create account · Part of the nexpand suite · nexpand.hu