Privacy and cookies

The controller is TODO: registered company name, TODO: street, postcode, city, Bulgaria, registered under TODO: ЕИК / company number, VAT TODO: BG VAT number. Reach a person at hello@hermesbox.tech.

We have not appointed a Data Protection Officer — our processing is neither large-scale nor systematic monitoring, so GDPR art. 37 doesn't require one. The address above is where data requests land.

Order details

Name, delivery and billing address, email, phone and what you ordered. Needed to perform the sale — GDPR art. 6(1)(b). Card numbers never reach us; see Stripe below.

Invoice records

The transaction, kept because Bulgarian and EU accounting law says we must — art. 6(1)(c).

Newsletter email

Only if you type it into the setup-guide form. Consent — art. 6(1)(a) — withdrawable from any email in one click.

Server logs

IP address, user agent and requested URL, written by our host for security and abuse handling. Legitimate interests — art. 6(1)(f).

Optional analytics

Anonymous page-level statistics, and only after you accept them in the cookie banner. Consent — art. 6(1)(a).

There is no profiling and no automated decision-making. We do not sell, rent or share personal data for anyone else's marketing, and we run no advertising pixels.

Nothing.The unit ships with no telemetry, no phone-home and no analytics. Your API keys are stored on the device, on your network; we never receive them and cannot read them. Prompts and responses travel between your box and whichever model provider you chose — we are not in that path, which is also why we can't help you recover anything from it.

Stripe

Payments and checkout. They receive your payment and contact details directly and act as controller for the card data itself. See stripe.com/privacy.

Hosting

Serves this site and writes the server logs above, as our processor under a data-processing agreement.

Carrier

The courier that brings the box gets the name and address it needs to deliver to, and nothing else.

Where a processor moves data outside the EEA, it happens under the European Commission's Standard Contractual Clauses.

Invoices

As long as tax law requires — currently 10 years from the end of the financial year.

Order and support mail

2 years after delivery, so we can honour the conformity guarantee.

Newsletter email

Until you unsubscribe, then deleted.

Server logs

Rotated within 30 days.

Cookie choice

Stored in your own browser, not on our servers.

This site sets nothing on your device until it has to. There are no advertising cookies and no third-party trackers of any kind.

Strictly necessary

Your cookie choice, kept in this browser's local storage. Exempt from consent under ePrivacy art. 5(3), because without it we would have to ask you on every page.

Checkout

Stripe sets its own cookies on its checkout domain once you go there to pay, for fraud prevention. That page is Stripe's, and their notice governs it.

Optional analytics

Anonymous, aggregated page statistics. Off unless you press Accept, and off again the moment you withdraw.

Setup video

The video on the home page loads nothing from YouTube until you press play — the still you see beforehand is served from this site. Press play and the player is embedded from youtube-nocookie.com, at which point Google receives your IP address and may set storage under its own privacy policy. Don't press play and none of that happens.

Change your mind at any time — it takes the same one click as saying yes did. Review your cookie choice

Under GDPR arts. 15–22 you can ask us for a copy of your data, correct it, delete it, restrict or object to how we use it, or receive it in a portable format. Where we rely on consent you can withdraw it at any time, and doing so doesn't make what happened before unlawful.

Email hello@hermesbox.tech and a person answers within 30 days. If we get it wrong, you can complain to the Commission for Personal Data Protection (CPDP), Bulgaria, or to the supervisory authority where you live.

If we ever process data for a genuinely new purpose, we will re-ask rather than quietly widen this page — the consent banner is versioned for exactly that. The date at the top is the current version.