Privacy and data protection
PRIVACY AND DATA PROTECTION POLICY (GDPR)
1. Data controller
Hostinext OÜ, VAT EE102419227, Lootsa tn 5, Lasnamäe linnaosa, 11415 Tallinn, Estonia. Data protection contact: contacto@hostinext.com.
2. Data we process
a) Portal account: login e-mail address, password (stored only as a hash) and display name.
b) Connected mail accounts: address, server and access credentials (app password or OAuth token), stored encrypted at rest.
c) Mail content: copies of the messages in the folders the user chooses to mirror, kept on the server to serve them to the device.
d) Devices: name, model, session key (encrypted), last connection time and connection IP address.
e) Activity log: user actions in the portal (sign-up, activation, removals) with time and IP, for security purposes.
The Cartero app stores no mail on the device; it only keeps its session key and settings.
3. Purpose and legal basis
To provide the service requested by the user (performance of a contract, art. 6.1.b GDPR): collecting their mail and delivering it to their BlackBerry device. Service security and the activity log rely on legitimate interest (art. 6.1.f). No automated decisions or profiling take place.
4. Recipients
No data is transferred to third parties. The user's mail providers (Google, Microsoft or others) receive the requests needed to collect and send their mail, under their own policies. The server is hosted in the European Union (France).
5. Retention
For as long as the account is active. Removing a mail account stops collecting its messages; deleting a device destroys its key. The user may request full deletion of their account and mail copies by writing to contacto@hostinext.com; requests are handled within 30 days. Backups are kept for 30 days.
6. Rights
Access, rectification, erasure, restriction, portability and objection, by writing to contacto@hostinext.com. If you believe the processing breaches the law you may complain to the supervisory authority (in Estonia, Andmekaitse Inspektsioon).
7. Security
Credentials encrypted at rest; device–server communication encrypted and authenticated with a per-device key; portal access over HTTPS; administrative access by SSH key only. The BlackBerry view uses plain HTTP because of the device's limitations and therefore never transmits passwords, only a one-time PIN.
8. Changes
This policy may be updated; the current version is the one published in the portal and in the app.
Last updated: September 2026.