Privacy Policy

Last updated: 16 July 2026

This Privacy Policy explains how Oldbutsavvy Ltd ("we", "us"), a company registered in England and Wales (company number: [COMPANY NUMBER], registered office: [REGISTERED ADDRESS], London), handles personal data when you use Savvy Communicator at oldbutsavvy.com. We are the data controller for this data under UK GDPR.

1. What data we collect and why

What	When	Why
Recipient email address, your name, message text, photo/video attachments (up to 20MB)	When you send a message via "I Have an Email" or "I Do Not Have an Email"	To deliver your message by email
A random session code (not linked to your name or account)	When you use "I Do Not Have an Email"	To match incoming replies to the right inbox, without needing you to create an account
Your IP address (stored as a one-way hash, not in readable form)	Whenever you send a message	To apply a fair-use sending limit and prevent abuse
Video/audio during a call	When you use "Start a Video Call"	Connected directly between participants (peer-to-peer) — we do not receive, view, or store this content

2. How long we keep data

Sent messages: passed to our mail server for delivery and not separately retained by us once sent.
Inbox replies (no-email path): replies are matched to your session by a hidden thread code and are automatically deleted from the mail server once read/superseded; nothing is kept beyond what's needed to show you your latest replies.
Rate-limit records (hashed IP): kept for one hour, then automatically expire.
Video calls: not recorded or stored by us at all.

3. Who we share data with

We do not sell or share your data with advertisers. Data is shared only with:

Our hosting provider (Hostinger), which stores the site and processes emails on our behalf.
The recipient you choose to send a message to.

4. Where data is stored

Data is processed and stored on servers provided by our hosting provider. If any data is transferred outside the UK/EEA, we take reasonable steps to ensure it is protected to UK GDPR standards.

5. Your rights

Under UK GDPR, you have the right to ask us to access, correct, or delete personal data we hold about you, and to object to or restrict certain processing. Because most data described above is short-lived and not tied to an account, we may have little or nothing left to provide by the time you ask — but you're welcome to contact us to check.

6. Children

The Service is not directed at children and is not intended to knowingly collect data from children.

7. Security

We take reasonable technical measures to protect data in transit and at rest, including origin checks, rate limiting, and restricting access to mail credentials. No online service can guarantee complete security, and we will notify affected users and the ICO where required by law if a breach occurs.

8. Changes to this policy

We may update this policy from time to time. The "Last updated" date above reflects the most recent change.

9. Contact us / complaints

For any question about this policy or your data, contact us at georgianamorozan@proton.me. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.