copi.bar website privacy notice
Version 2026-11-07 · in force from 7 November 2026
This notice explains what happens to information about you when you visit copi.bar or write to us. It covers this website and the addresses hello@copi.bar, privacy@copi.bar and security@copi.bar. The customer portal my.copi.bar and support@copi.bar have their own privacy notice. The Copibar software runs on your own infrastructure and is not covered here.
Who we are
copi.bar is run by XServer OÜ, registry code 17511911 (Estonian commercial register), VAT number EE102988554, Kaupmehe 7-120, 10114 Tallinn, Estonia ("we"). We decide how the data described here is used, so we are its controller. For anything about your data, write to privacy@copi.bar.
What we collect and why
No cookies, no analytics. This website sets no cookies, stores nothing in your browser, uses no analytics and loads nothing from other companies.
When you open a page. Our web server writes a line to its access log for each request. The line holds a shortened form of your IP address: for an IPv4 address the last of the four numbers is replaced by 0, and for an IPv6 address only the first three blocks are kept. It also holds the date and time, the request method, the address requested without any parameters in the link, the protocol, the response code and size, and your browser's identification string. The log does not record which page you came from. If a request fails, the server's error log may record your full IP address.
Why: to deliver the site, keep it secure and find faults. Legal basis: our legitimate interest in running a working, secure website (GDPR Art. 6(1)(f)). How long: 14 days, then deleted (for backups, see below). We do not use these logs to profile anyone.
When you write to us. If you e-mail hello@copi.bar, privacy@copi.bar or security@copi.bar, we receive your address, your name, your message and anything you attach, and we keep our replies. For each message, our mail server also logs the sender and recipient addresses, the IP address of the server that delivered it and the message identifier.
Why: to answer you and keep a record of the conversation. Legal basis: our legitimate interest in answering enquiries and security reports (Art. 6(1)(f)). If you ask about buying, the basis is steps you asked for before a contract (Art. 6(1)(b)). If you exercise your data protection rights, the basis is our legal duty to answer you (Art. 6(1)(c) with Arts. 12–22). How long: our mail server deletes each message, and each of our replies, 24 months after it was received or sent, in whatever folder it is kept. The mail app on our devices keeps its copies in step with the server, so it removes a copy once the server copy is deleted. If the conversation leads to a contract, it is kept as long as the law requires for contract records. Mail server logs are kept for 14 days.
Backups. We back up the whole server every day and keep 7 daily and 4 weekly copies, so the oldest copy is about five weeks old at most. Everything on the server, including the logs and e-mails described here, therefore stays in backups for up to about five weeks after the period stated above, until the oldest copy expires. We keep the backups ourselves, in the EU, and nobody else has access to them. We use them only to restore the server after a fault. If you ask us to delete your data, we delete it on the server. We do not change the backups; your data disappears from them when they expire.
We do not sell your data and do not make automated decisions about you.
Who receives it
- Hosting. No hosting company receives your data. We run this website and our mail server ourselves, on our own equipment in a data centre in Germany. The data-centre operator provides only space and power.
- E-mail. We run our own mail server for copi.bar. Your messages stay on it, we read them in a mail app on our own devices, and no e-mail service receives them.
- Spam filtering. To filter spam, our mail server checks the IP address of each server that delivers mail to us against a public DNS blocklist run by SpamCop (Cisco, USA). Each check discloses that server's IP address to SpamCop. This is normally the address of your e-mail provider's server, not yours. It relates to you only if you run your own mail server. Legal basis: our legitimate interest in protecting our mail service from spam and abuse (Art. 6(1)(f)).
- Authorities, courts and our professional advisers, when the law requires it or to establish or defend legal claims.
Transfers outside the EEA. Our server is in Germany and our backups are in the EU. Data leaves the EEA only through the spam check. SpamCop's operator, Cisco Systems, Inc. (USA), is certified under the EU–US Data Privacy Framework, which the European Commission found adequate (Implementing Decision (EU) 2023/1795 of 10 July 2023).
Your rights
You can ask us for access to your data and a copy of it, and ask us to correct it, delete it or restrict its use. Where the law provides for it, you can also receive the data you gave us in a portable form. You can object at any time to processing based on our legitimate interest.
Write to privacy@copi.bar. We reply within one month and may ask you to confirm that it is you. Our access log keeps only a shortened IP address, so we usually cannot tell which entries relate to you. If you tell us your IP address and roughly when you visited, we will check our logs.
If you think we handle your data wrongly, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, info@aki.ee, www.aki.ee. You can also complain to the data protection authority where you live or work.
Changes
When we change this notice, we update the version and date at the top. Earlier versions are available on request. This notice is also available in Ukrainian and Russian; if they differ, the English version applies.