Privacy

Last changed on 6 October 2026. The controller of your data is Haydamax OÜ, registry code 17351554, Narva mnt 5, 10117 Tallinn, Estonia. Questions and requests: support@sponge.digital.

What we store

Your account: email address, an optional login name, and the password — kept as a hash by our own sign-in service, never in readable form. Billing: the company or person we invoice, the address on the invoice, and the invoices themselves. Your service: the sites, domains and mailboxes on the account, and what you did with them in the cabinet. Server logs: requests to your sites and to the cabinet with the IP address, kept so we can find a fault or an attack.

For a domain we also need the registrant details the registry asks for — name, address, email, phone. Those go to the registrar and the registry; for most zones the registry publishes only a part of them, and we switch on WHOIS privacy where the zone allows it.

Why, and on what legal basis

We use your account and billing data to run the service you bought and to invoice it — that is the contract. We keep invoices and accounting records because Estonian law requires it. We keep server logs and abuse reports on legitimate interest: without them a broken-into site cannot be found. We send service email — invoices, expiry notices, outages — as part of the contract; we do not send marketing email.

Who else sees it

• Hetzner Online GmbH — the servers themselves: sites and the cabinet in Falkenstein, Germany; mail in Helsinki, Finland. Everything stays inside the EU.
• Stripe Payments Europe — card payments. Card numbers go to Stripe directly and never reach our servers; we see the amount, the result and the last four digits.
• Openprovider (Hosting Concepts B.V.), the Netherlands — our registrar. Registrant details for a domain go to them, and from them to the registry of that zone, as ICANN and registry rules require.
• Chakloon Passport — our own single sign-on, run by us on the same infrastructure. It holds the email and the password hash; one account opens Sponge and our other services.

Nobody else. We run no third-party analytics, no advertising pixels and no social widgets on this site.

Cookies

Two, both needed for the site to work: the session cookie that keeps you signed in, and the CSRF cookie that stops a foreign page from acting as you. No tracking cookies, so no cookie banner to click away.

How long we keep it

Account and service data: while the account exists, and 30 days after it is closed so that a closure by mistake can be undone. Invoices and accounting records: seven years, as the law requires. Server logs: 30 days. Backups of a closed account: until the retention of the plan runs out, at most 30 days.

Your rights

You can ask for a copy of what we hold, for a correction, for deletion, for a machine-readable export, or to object to a use based on legitimate interest. Write to support@sponge.digital and we answer within 30 days. If you think we handled your data wrongly, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or to the authority in your own country.

Children

The service is sold to companies and to adults. We do not knowingly keep data of children under 16.