BrandBoxy Privacy and Cookie Policy
Effective date: 2026-07-24 · Provider: [legal entity — TBD] · The current published version applies; see Section 13.
1. Scope
This Policy applies to personal data processed by BrandBoxy in connection with account registration, subscription management, website use, customer support, security, analytics, and operation of the service.
Where BrandBoxy processes personal data submitted by a Customer on the Customer's instructions, the Customer controls that processing and the BrandBoxy Data Processing Addendum applies.
2. Personal Data We Collect
2.1 Account and Contact Data
Name, business name, business role, email address, telephone number, account identifiers, login details, and information supplied during registration or account verification.
2.2 Subscription and Transaction Data
Subscription status, billing history, payment status, transaction identifiers, tax-related information, and limited payment information received from payment providers. BrandBoxy does not need to store full payment-card numbers when payments are processed by an external provider.
2.3 Technical and Usage Data
IP address, device and browser information, approximate location, login events, pages viewed, actions taken, integration status, error records, audit logs, and security signals.
2.4 Communications
Messages, support requests, feedback, survey responses, and other communications with BrandBoxy.
2.5 Customer Materials and Connected Data
Content, files, instructions, account data, and personal data submitted by a Customer or obtained from a connected account at the Customer's direction.
2.6 Cookies and Similar Technologies
Cookie identifiers, session information, preferences, analytics events, and similar technical information collected when a person visits or uses BrandBoxy.
3. How We Obtain Personal Data
- Directly from the individual or Customer during registration, payment, support, or use of BrandBoxy.
- Automatically from devices, browsers, cookies, logs, and security systems.
- From payment providers, authentication providers, connected platforms, and other service providers.
- From a Customer that lawfully submits personal data relating to its employees, contractors, customers, leads, visitors, or other persons.
4. How We Use Personal Data
- To create and administer accounts and subscriptions.
- To provide, operate, secure, maintain, and improve BrandBoxy.
- To process payments and manage billing.
- To follow Customer instructions and operate connected services.
- To provide support and communicate about the account or service.
- To detect fraud, abuse, security incidents, sanctions risk, and violations of applicable terms.
- To comply with law, enforce agreements, establish or defend legal claims, and protect rights and safety.
- To analyze service performance and understand business use.
- To send service-related communications and, where permitted, business marketing communications.
5. Legal Grounds
BrandBoxy processes personal data where necessary to perform a contract, take requested pre-contract steps, comply with legal obligations, protect legitimate business and security interests, establish or defend legal claims, or act on valid consent where consent is required.
When BrandBoxy acts as a processor for a Customer, the Customer determines the lawful basis for the processing and is responsible for notices, permissions, and consents relating to the submitted personal data.
6. Sharing of Personal Data
BrandBoxy may share personal data with service providers that support hosting, storage, security, payment processing, authentication, communications, analytics, support, and service operations. Such providers may process data only for authorized purposes and under appropriate confidentiality and data-protection obligations.
BrandBoxy may disclose personal data where required by law, court order, lawful authority, or where reasonably necessary to prevent harm, investigate abuse, enforce agreements, or protect BrandBoxy, Customers, users, or others.
Personal data may be transferred as part of a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, subject to appropriate confidentiality and legal safeguards.
7. International Data Transfers
BrandBoxy and its service providers may process personal data in countries other than the country in which it was collected. Where applicable law requires safeguards for an international transfer, BrandBoxy uses an approved contractual or legal transfer mechanism and supplementary safeguards appropriate to the risk.
8. Retention and Deletion
BrandBoxy retains personal data for as long as reasonably necessary to provide the service, administer the account, comply with law, resolve disputes, maintain security, enforce agreements, and establish or defend legal claims.
After a subscription ends, the Customer may export available data for 30 days. After that period, BrandBoxy may delete or anonymize Customer data from active systems, unless longer retention is required by law. Data in backups is deleted through the normal backup lifecycle and remains protected until deletion.
9. Cookies and Similar Technologies
BrandBoxy may use strictly necessary cookies to provide login, security, session management, billing, and core service operation. BrandBoxy may also use preference and analytics cookies to remember settings and understand use of the service.
Where consent is required, optional cookies are used only after consent. Browser settings and available cookie controls may be used to reject or remove cookies, although disabling necessary cookies may prevent parts of BrandBoxy from working.
10. Data Rights
Depending on applicable law, an individual may have the right to request access, correction, deletion, restriction, objection, portability, or withdrawal of consent, and may have the right to complain to a competent data-protection authority.
Requests relating to data controlled by a Customer should normally be directed to that Customer. BrandBoxy will assist the Customer as required by the Data Processing Addendum.
BrandBoxy may verify identity and authority before acting on a request. Requests may be limited or refused where permitted by law, including where data must be retained for security, legal compliance, or legal claims.
11. Security
BrandBoxy uses administrative, technical, and organizational measures designed to protect personal data against unauthorized access, loss, alteration, misuse, and disclosure. No system is completely secure, and BrandBoxy cannot guarantee absolute security.
12. Business Service and Minors
BrandBoxy is a business service and is not directed to children. A person may not create an account unless legally able to enter into a binding business agreement. Customers must not submit children's personal data unless the processing is lawful and expressly supported by BrandBoxy.
13. Changes to This Policy
BrandBoxy may update this Policy. Material changes will be communicated through the service or by email. Continued use after the updated Policy takes effect is subject to the updated Policy.
14. Contact
Questions, privacy requests, and cookie-related requests must be sent to [email protected].