ColdSilver is an automation studio in Delft, the Netherlands (KvK 80881874). coldsilver.nl is one website and one login for three tools: Moonlight, Sophie and Sterling. This page covers, in turn: this website, your ColdSilver account and its billing, Sophie (the email assistant a business owner connects to their own mailbox), and where Moonlight and Sterling describe what they hold. The Sophie part matters most, because it concerns a mailbox.
This website
We do not track you. There are no analytics cookies, no advertising pixels, and nothing is shared with advertisers. The pages you read without signing in set no cookies at all; the only cookies on coldsilver.nl are the sign-in cookies described under your account.
- Server logs. Vercel, which runs the site, keeps standard request logs (IP address, request path, time, browser) for debugging and abuse prevention. They stay with Vercel, which keeps them for a short time (hours to days on its standard plans).
- Contact form. Your name, email address, company, the topic you pick and your message. They are emailed to our own inbox, info@coldsilver.nl, through Resend, with your address as the reply-to, and our server writes one log line with your name, email and company so a message that goes astray can be traced. They are never sold or shared.
- Client intake (/onboarding). If you fill in the intake for a deployment we run for you, the form is served by our client portal (app.coldsilver.nl) and stored in our own database in the EU, where it creates your client record and your portal login and triggers our onboarding emails to you and to us. Only ColdSilver's directors can read it.
- Bot check. The contact form and the account forms (sign-up, sign-in, emailed links and password reset) carry Cloudflare Turnstile. The widget runs in your browser, so Cloudflare sees that request; to check the result our server sends Cloudflare the widget's token and your IP address, and nothing else.
Your ColdSilver account
A ColdSilver account is one login for Moonlight, Sophie and Sterling. Creating one makes an organisation (your store) that you own and can invite colleagues into, as admins or members. Signing in uses your email address and a password, or a link we email you, plus an authenticator code if you switch one on. There is no Google or other social login.
What we store
| What | Exactly |
|---|---|
| You | Your email address, your name if you gave one, when you confirmed the address, when you last signed in. |
| Password | A scrypt hash with its parameters, never the password itself. During sign-up the hash waits with the confirmation link and is applied only in the browser that started the sign-up. |
| Sessions | A random secret stored as a SHA-256 hash, with created, last-seen and expiry times, your browser's user agent and a keyed hash of your IP address. A session lasts 30 days and is extended while you use it; you can end any session yourself, and a new sign-in ends the one it replaces. |
| Authenticator (optional) | The secret, sealed with AES-256-GCM and bound to your account, and ten recovery codes stored as hashes. Ten wrong codes in a day pause code entry for 24 hours, and we email you. |
| Organisation | Its name, its members with their roles, and pending invitations: the address, the role and a hashed link that expires after 7 days. |
| Products | For each product you linked, the id of your record there and a short label such as your shop domain, and what your organisation may use (an entitlement per product). |
| Billing | See below. Never a card number. |
| Audit log | What was done to the account (sign-ins, invitations, role changes, billing steps), by whom, when, and a keyed hash of the IP address. It never holds a password, a token, a secret or a raw IP address. |
| Sign-in limits | Counters per address and per IP, for a few minutes to a day, keyed by a hash: the table never holds an email address or an IP address. |
Nowhere in the account service is a raw IP address stored; it is always a keyed hash.
Emails we send
Account emails come from accounts@coldsilver.nl through Resend, and replies reach info@coldsilver.nl: a link to confirm your address, a sign-in link, a password reset, an invitation to an organisation, a link to claim an existing product account, and a notice when authenticator codes are paused. Links work once and expire after 20 minutes (an invitation after 7 days; a claim link after 1 hour, or 14 days when we invited existing customers to claim their account).
Cookies
Signing in sets cs_session (30 days, extended while you use it), cs_org (the organisation you last worked in, 1 year), cs_signup (1 hour, while a sign-up is pending) and cs_mfa (5 minutes, between your password and your authenticator code). All are HttpOnly, Secure, host-only cookies set by our server (they carry the __Host- prefix), so no other site, and no other coldsilver.nl subdomain, can read or plant them. Each product sets its own session cookie on its own domain.
Signing you in to a product
When you open Moonlight, Sophie or Sterling from your account, coldsilver.nl hands that product a short-lived signed token (ES256, valid 15 minutes, usable by that one product only). It carries your user id, your email address and whether it is confirmed, your name, your organisation (its id, name and your role in it), which products the organisation may use, and the id of your record in that product. The product exchanges it for a refresh token (30 days) so it can check every 15 minutes that you are still signed in and still entitled. Each product then keeps a link between your ColdSilver organisation and its own record: Moonlight marks your workspace as paid through ColdSilver, Sophie stores the organisation next to its store and keeps the refresh token sealed. A linked product may also ask coldsilver.nl for your organisation's name, its members' email addresses and roles, and its entitlement, and is told when the entitlement changes. For your home page, coldsilver.nl asks each product for a short summary (such as how many emails were answered) and shows it without storing it.
How long we keep it
- Your account and your organisation: for as long as the account exists.
- Sessions: 30 days from last use; ended and expired sessions are deleted 90 days after they were last seen.
- Emailed links: valid for 20 minutes; the rows are deleted after 7 days.
- Product sign-in codes: valid for 60 seconds, deleted after a day. Refresh tokens: 30 days, deleted 60 days after they were issued.
- Sign-in limit counters: deleted after 2 days.
- The audit log: kept while the account exists and for as long as we need it to investigate abuse. It holds no secrets and no raw IP address.
Deleting your account
There is no delete button yet. Email info@coldsilver.nl from the address on the account and we delete the account and its organisation, and each linked product deletes what it holds under its own notice. Cancel your subscriptions first, or ask us to do it with the deletion. Stripe keeps the records of the sale it is required to keep as the seller.
Where it lives
The account database is Supabase, in the EU (Frankfurt, region eu-central-1). Only the application's own database role can reach it, over verified TLS; nothing in a browser talks to it. The application runs on Vercel (United States).
Billing
Subscriptions bought through coldsilver.nl are sold through Stripe Managed Payments. Stripe is the merchant of record: it sells the subscription to you, works out and collects the VAT for your country and pays it to the tax authority, issues the invoice and the receipt, and handles refunds, disputes and payment questions. You see the purchase as Sold through Link (Link is Stripe's payment service); Stripe's emails come from Link, and your card statement shows LINK.COM* followed by our name. ColdSilver provides the service. Sophie's and Moonlight's own billing pages sell the same way.
The checkout page and the card form are Stripe's: your card number never reaches coldsilver.nl. Stripe asks for your name, email address and billing address (the address decides the VAT) and keeps the payment records it must keep as the seller; its own notice is at stripe.com/privacy. We store your Stripe customer id, the billing email, and for each subscription its id, plan, billing interval, status, price, trial end, period end and whether it is set to end, plus the ids of the Stripe events we processed. You can change your card, billing address or plan, and cancel, through the Billing Portal from your account page or at link.com. A deletion request to Stripe for a purchase sold through Link cancels those subscriptions and removes Stripe's records of them, and Stripe tells us.
Sophie and your Google account
Sophie only ever works on a mailbox whose owner connected it themselves, through Google's own consent screen, and she can be disconnected at any moment. Below is exactly what that consent allows.
What she reads and writes
| Permission | What Sophie does with it |
|---|---|
Gmail: read (gmail.readonly) and send (gmail.send) | Reads the conversations already in the mailbox to learn the business's own wording, prices and rules, and reads new incoming customer email. Sends the reply as a real reply in the same thread. She cannot delete, trash or alter anything in the mailbox: we deliberately do not ask for the permission that would allow it. |
| Google Calendar events (optional) | Only when the owner chooses to keep their planning inside Sophie. She creates, changes and cancels the appointments she made, and reads busy times so she never books over something that is already there. |
| Email address and basic profile | To show which mailbox was connected, and nothing else. |
She never sends anything to a customer until the owner switches her out of shadow mode. She has no access to bookkeeping, invoicing, bank accounts or a point of sale; those systems are not connected to her. Two systems can be connected: the mailbox above and, for a webshop, the store's Shopify account.
Shopify, if the owner connects it
A webshop owner may connect their Shopify store. Sophie then reads orders to check who is writing and what they bought: order number and dates, status, total, the customer's name and email address, the shipping address and phone number, the items, fulfilment and tracking, earlier refunds, and which payment gateway was used. She can update the shipping address of an order that has not shipped, within the same country. Refunds, store credit and cancellations stay with the owner: by default Sophie only prepares them, and the owner sends the money from the Refunds page in Sophie. The owner can switch money actions on separately, and only in live mode; from then on Sophie carries them out within the limits the owner set, and every action, carried out or not, is recorded. The Shopify access she asks for is read_orders, read_all_orders, read_customers, read_products, write_orders, write_discounts and read_fulfillments, plus write_returns and write_draft_orders when the owner lets her handle returns and exchanges. Besides the mailbox, she learns from the store's website and its public policy pages, which she re-reads daily, and from the mailbox she builds the store's customer list (name, email, phone, company, address and a note, as far as the mail says so), so the owner finds every customer in one place.
Limited Use
Coldsilver's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In plain words: we do not sell your Google data, we do not use it for advertising, we do not use it to train generalised artificial-intelligence models, and no human at Coldsilver reads it except when you ask us to help with a specific problem, or where the law requires it.
Who else processes it
To answer an email, the text of that conversation has to reach a language model. These are Sophie's sub-processors:
- OpenAI (United States) reads the message and the business's rules in order to draft the reply. OpenAI does not use data sent through its API to train its models. Under OpenAI's own policy it keeps API data for up to 30 days.
- Supabase (EU, Frankfurt) stores the mailbox content Sophie learned from, her drafts and replies, the customer list and the orders she looked up.
- Vercel (United States) runs the application.
- Resend (United States) sends our own notification emails to the business owner, never to their customers.
- Shopify (Canada), when the owner connects the store, as the source of the orders.
- Stripe, for Sophie's own subscription, as described under Billing.
- Google, as the source of the mailbox itself.
Access tokens are encrypted before they are stored (AES-256-GCM), everything travels over TLS, and the database is reachable only by the application's own service credentials.
How long we keep it, and how to get rid of it
Sophie keeps what she learned for as long as the business uses her. There are three ways to end that, and all three are immediate:
- Disconnect Google in Sophie under Settings. She stops reading at once and the stored token is destroyed.
- Revoke access at Google from myaccount.google.com/permissions. This works even if you never open Sophie again.
- Ask us to delete the whole store. Everything Sophie holds for that business goes: the learned conversations, the customer list, the orders she looked up, the drafts, the replies, and the Google and Shopify connections. Email info@coldsilver.nl and it is done.
A Shopify connection ends the same way: remove it in Sophie under Settings, or uninstall the app in your Shopify admin, and she stops reading orders at once.
Moonlight
Moonlight is operated by ColdSilver and has its own privacy notice and terms, at moonlight.coldsilver.nl/privacy and moonlight.coldsilver.nl/terms. They say what it holds: your account, the products and inventory of the Shopify store you connect, order figures without buyer names or addresses, the research it runs on public store catalogues, which services process it and for how long. Read them before you connect a store.
Sterling
Sterling is not open yet. No store can use it and it takes no payments, so it holds nothing for anyone. When it opens it gets its own notice, which you read and accept before your checkout goes live. If you ask us to tell you when it opens, that is a message to our inbox, and we keep your address for that one reply.
Client work we operate
When we run an automation or an AI deployment for a client, we process that client's customer data as a Data Processor under the GDPR, and each deployment has its own Data Processing Addendum. Our systems process only what the work needs, and never pass customer data to anyone beyond the sub-processors documented for that deployment.
Your rights
We process your account and billing data to perform our agreement with you; the security data (hashed IP addresses, sign-in limits, the audit log) in our legitimate interest in keeping accounts safe; and a connected mailbox or store on the instruction of the business that connected it, as its processor.
Under the GDPR you can ask what personal data we hold about you, have it corrected or deleted, receive a copy of it in a common format, object to or restrict how we use it, and withdraw a consent you gave. Email info@coldsilver.nl and a person handles it, within a month. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.
Changes
The date at the top says when this page last changed. This version replaces the one of 3 September 2026; what changed is that the site now carries a ColdSilver account and billing, and that Sophie can read a connected Shopify store.
Contact
ColdSilver — KvK 80881874 · Waterblok 61, 2612 KX Delft, Netherlands · info@coldsilver.nl