Privacy Notice

1. Who we are

UnBoX is operated by Remove the box. For the personal data described here, Remove the box is the data controller — we decide what is collected and why. Conversations with Boxy can be personal, so we keep collection deliberately narrow.

2. What we collect and why

• Account data — email address, display name, login credentials (stored hashed) and, if you sign in with Google, the basic profile Google returns. Used to create and secure your account. Legal basis: performance of our contract with you.
• Conversation content — the messages you type, the audio you speak to Boxy and its transcription, and Boxy's replies. Used to deliver the coaching session and show your history back to you. Legal basis: performance of our contract.
• Pattern map data — the patterns and notes derived from your sessions. Used to give you continuity between conversations. Legal basis: performance of our contract.
• Usage and technical data — device type, browser, IP address, error logs and basic usage events. Used for security, fraud prevention, debugging and improving the product. Legal basis: our legitimate interests in running a safe, working service.
• Support messages — what you send us when you ask for help. Used to answer you. Legal basis: legitimate interests.
• Marketing emails — only if you opt in. Legal basis: consent, which you can withdraw at any time.

We do not sell your data, and we do not use your private conversations to teach Boxy anything unless an insight is explicitly reviewed and approved by us first.

3. Who we share it with

• Service providers / subprocessors — hosting and database infrastructure, AI model providers used to generate Boxy's responses, and speech-to-text and text-to-speech providers used for voice sessions.
• Paddle, our Merchant of Record, for the sale of subscriptions, subscription management, payments, tax compliance and invoicing.
• Professional advisers — legal and accounting, where necessary.
• Authorities — where we are required to by law.

4. International transfers

Our providers may process data outside Australia, including in the United States and the EEA. Where data leaves your region we rely on appropriate safeguards such as standard contractual clauses or adequacy decisions.

5. How long we keep it

Account, conversation and pattern data is kept while your account is active. If you delete your account we delete or anonymise it within 30 days, except where we must keep records longer for legal, tax or fraud-prevention reasons. Technical logs are kept for a short retention window and then discarded.

6. Your rights

You can ask us to access, correct, delete, restrict or export your personal data, and you can object to processing based on legitimate interests or withdraw consent at any time. If you are in the UK or EEA you also have the right to complain to your supervisory authority; in Australia you can complain to the Office of the Australian Information Commissioner. We respond within one month.

7. Security

We use appropriate technical and organisational measures, including encryption in transit, row-level access controls so you can only read your own records, and restricted administrative access.

8. Cookies and local storage

We use essential cookies and browser storage to keep you signed in and remember where you were heading after login. We do not use advertising cookies. You can clear these through your browser settings, though signing in will stop working until you allow them again.

9. Contact

For any privacy request, contact Remove the box through the support channel shown in your account.