Privacy policy

1. Who this policy covers

In this policy, “VBOOX”, “we”, “us”, and “our” refer to the company operating the VBOOX website and services. This policy covers website visitors, prospective customers, account holders, authorised users, and people who contact us.

For account administration, billing, enquiries, and operation of our own website, VBOOX determines how personal information is used. When a business customer uploads or collects information about its own customers, contacts, or employees through VBOOX, that business generally determines the purposes of processing and VBOOX processes the information on its behalf, subject to the applicable agreement. The roles depend on the particular activity and applicable law.

A business using VBOOX to operate a website, store, form, or campaign is responsible for its own privacy notice. If your information was provided to that business, contact it first about your information. This policy does not replace its notice or the policies of third-party services.

2. Information we collect

Information you provide may include your name, business name, email address, telephone number, account profile, sign-in information, enquiry details, support correspondence, and communication preferences. Transaction information may include billing details, purchased products, subscription status, payment references, and payment evidence submitted through an authorised payment workflow.

Depending on the features used, customer-provided information may include contact records, messages, website content, uploaded files, business knowledge, campaign information, and AI prompts and outputs. Only upload personal information that you have authority to provide. Avoid including sensitive information unless the service expressly supports it and the necessary safeguards and permissions are in place.

Technical information may include IP address, browser and device information, requested pages, timestamps, diagnostic logs, and security events. Where optional analytics is enabled, events may include page views, button interactions, and acquisition or referral information, subject to the applicable consent settings.

If you connect an external service, we may receive the account identifiers, connection credentials, content, messages, and performance information permitted by the connection you authorise. The information received depends on the provider, selected permissions, and available feature.

3. How and why information is used

We use information to respond to enquiries, create and administer accounts, provide purchased services, manage access and subscriptions, process and reconcile transactions, deliver support, and send essential service communications.

Information is also used to protect accounts, prevent fraud and abuse, investigate incidents, diagnose problems, maintain service reliability, comply with legal obligations, and establish or defend legal claims. Customer content is processed to deliver the features requested by the customer, including enabled AI and integration features.

Where permitted, we use consented analytics to understand website use and improve the experience, and contact details to send marketing communications in accordance with your preferences. Essential account, security, and transaction messages are separate from optional marketing.

Where applicable law requires a legal basis, processing must be supported by the basis appropriate to the activity, such as consent, performance of an agreement, compliance with a legal obligation, or legitimate interests where recognised and subject to required safeguards. Visiting the website does not by itself constitute consent to optional marketing or analytics.

Some information is necessary to answer an enquiry, maintain an account, or fulfil an order. If you do not provide it, we may be unable to provide that particular service. Optional fields and optional permissions should be identified at the point of collection.

4. AI features and connected services

When you use an AI feature, the prompts, relevant business context, files, and other information needed for that request may be processed by VBOOX and the AI provider supporting that feature. Review what you submit and avoid unnecessary personal or confidential information.

Provider processing, retention, hosting locations, and any model-training use depend on the provider and the contractual and technical settings in place. These details must be confirmed for each enabled feature before this policy is finalised; this draft does not promise that all providers exclude data from training or retain it for a particular period.

Connecting a messaging, email, social media, or other service authorises the processing needed for the selected functionality. You can revoke access through the available connection settings or the external provider. Revocation stops future authorised access but does not necessarily erase information already lawfully received or records the provider retains.

5. Cookies, local storage, and analytics

Cookies and similar browser storage may support essential functions such as sign-in, security, and remembering preferences. The public website stores its analytics preference in local storage under vboox_analytics_consent.

Where optional analytics is enabled and consent is required, you can accept or reject it using the website banner and change your choice through Privacy preferences. The website analytics client also respects Global Privacy Control by disabling its optional event tracking. These controls apply to that client; they do not disable essential server logs or tracking operated independently by a business customer or external provider.

You can also clear or block cookies and local storage in your browser. Doing so may reset preferences or affect sign-in and other features. The final notice should identify the analytics services and storage durations actually used in each environment.

6. Who information is shared with

Information may be shared with service providers supporting hosting, storage, security, communications, payments, support, and enabled AI features, to the extent needed for those services and subject to applicable safeguards. Connected services receive information needed for the actions you authorise and may also process it under their own policies.

Within a business account, authorised administrators and users may access information according to their roles. Content you choose to publish on a public website or send to recipients becomes available to its intended audience.

Information may also be disclosed where required by law, to respond to a valid legal request, to protect rights and safety, or in connection with a merger, acquisition, or business transfer subject to applicable protections. Any use or sharing for advertising or other independent commercial purposes must be assessed and disclosed before it is introduced.

7. International processing

Hosting and service providers may process information in countries other than your own. Where a transfer is subject to legal restrictions, the appropriate transfer conditions and safeguards must be satisfied. The final policy and relevant customer agreements should identify material hosting locations and applicable transfer arrangements.

8. Retention and account closure

Information is retained for the time needed for the purpose for which it was collected, including providing services, resolving disputes, maintaining required transaction records, and complying with law. Retention depends on the information category, customer instructions, contractual requirements, and applicable obligations.

Closing an account or disconnecting a service does not immediately remove every record. Backups, security logs, financial records, and information subject to a legal hold may be retained for their applicable periods. The final policy must confirm deletion procedures and retention schedules rather than assume a fixed deletion deadline.

9. Protecting information

Protection of personal information requires appropriate technical and organisational measures, including access controls and secure handling suited to the processing involved. No online service can guarantee absolute security. Use strong sign-in credentials, limit account access, and report suspected misuse promptly through the official support channel.

Where a personal data incident requires notification under applicable law, notifications must be made to the relevant authorities and affected people as required. This draft does not claim a certification or guarantee a particular security standard.

10. Your choices and privacy requests

Depending on applicable law, you may have rights to access or correct information, request deletion or restriction, object to certain processing, obtain a portable copy, or withdraw consent. These rights are subject to legal conditions and exceptions. Withdrawal of consent does not affect processing that was lawful before withdrawal.

You can unsubscribe from optional marketing through the instructions in the message, manage available account preferences, and change optional website analytics choices through Privacy preferences when displayed. Essential service messages may continue while your account or transaction requires them.

Send privacy requests to the confirmed privacy contact identified in the final version of this policy. Include enough information to identify the relevant account or relationship, without sending passwords or unnecessary identity documents. Identity or authority may need to be verified before a request is fulfilled. Requests concerning data controlled by a business customer may need to be directed to that business.

You may also complain to the data protection authority competent for your jurisdiction. The final notice must include the operating company’s privacy contact and any required local complaint information.

11. Children

VBOOX is intended for business use and is not directed at children. If you believe a child has provided personal information without the required authority or consent, contact the confirmed privacy contact so the situation can be assessed and addressed. Business customers must meet any applicable requirements when processing information about children.

12. Changes and contact details

This policy may be updated as services, processing practices, or legal requirements change. The published version should show its effective or last-updated date, with additional notice of material changes where required by law.

Operating company: [registered legal name]. Postal address: [registered or privacy correspondence address]. Privacy contact: [monitored privacy email or request channel]. Effective date: [to be confirmed after review].