Privacy Policy

Boxic is operated by Subject XYZ LLC, a California limited liability company (“Boxic”, “we”, “us”). This policy explains what we collect, why, who we share it with, and the control you have. It applies to boxic.io and the Boxic application.

1. What we collect

• Account data — email address, display name, handle, optional profile image and bio, and the sign-in method you use.
• Project content — everything you put into a project: CAD and document files, revisions, descriptions, comments, annotations, team messages, and activity records.
• Collaboration data — workspace and project membership, invitations you send, and the email addresses you invite.
• AI interactions — the prompts you send to Boxie and the project context needed to answer them, plus usage counts against your daily limits.
• Usage data — first-party page views (path, referrer, coarse device information, a rotating session identifier). Outside regions requiring prior consent this runs by default; where consent is required it only runs after you accept. See the Cookie Notice.
• Support and reports — messages you send us, waitlist and beta-access requests, and content reports you file.

We do not knowingly collect data from children under 13, and Boxic is not for them.

2. Why we use it

• To provide the Service: store your projects, sync them across devices, and show them to the people you share with.
• To operate accounts, authentication, invitations, and notifications.
• To run AI features when you use them.
• To keep the Service secure, prevent abuse, and enforce limits and quotas.
• To understand aggregate product usage and improve Boxic.
• To comply with law and respond to valid legal process.

Where the GDPR or UK GDPR applies, our legal bases are performance of a contract (providing the Service), legitimate interests (security, abuse prevention, product improvement), consent (analytics where required, marketing email), and legal obligation.

3. AI features

Boxie is powered by third-party AI providers reached through our AI gateway. When you ask Boxie something, we send your prompt, recent conversation, and the project context needed to answer — for example file names, extracted bill-of-materials text, or geometry summaries. Providers process this to return an answer and, under our terms with them, do not use it to train their models. Do not paste material into Boxie that you are not permitted to disclose to a processor. AI answers can be wrong; verify anything you rely on.

4. What is public and what stays internal

Private projects are visible only to their members. When you publish a project, we show a curated public view: title, summary, tags, cover, the approved revision, owner handle, and public comments. Team chat, reviews, revision requests, invitations, member emails, and internal history are never included in the public view. Unlisted links are accessible to anyone holding the link and can be revoked at any time.

5. Who we share with

We do not sell personal information and we do not share it for cross-context behavioural advertising. We share data with service providers who process it on our behalf — hosting, database and storage, email delivery, and AI providers — listed on our Sub-processors page. We also share with people you collaborate with, with connectors you explicitly connect, and where required by law or to protect rights and safety. If the business is acquired, data may transfer as part of that transaction; this policy continues to apply until replaced.

6. International transfers

We operate from the United States and our providers process data there and on global edge networks. Where transfers from the EEA, UK, or Switzerland require a safeguard, we rely on the European Commission's Standard Contractual Clauses through our provider agreements.

7. Retention

• Account and project data — kept while your account is active.
• Deleted projects — removed from the product immediately and purged within 30 days.
• Deleted accounts — projects, files, chats, and profile removed within 30 days; backups age out on their normal cycle.
• Page views — automatically pruned after 90 days.
• Boxie conversations — kept until you delete them or delete your account.
• Records we must keep for legal, tax, or abuse-prevention reasons — kept as long as required.

8. Your rights and how to use them

Depending on where you live, you may have rights to access, correct, delete, port, or restrict processing of your personal data, to object to processing based on legitimate interests, and not to be discriminated against for exercising them.

• Access and export — Settings → Account → “Export my data” downloads a machine-readable archive of your account, projects, comments, and Boxie conversations.
• Correction — edit your profile and project details in-product at any time.
• Deletion — Settings → Account → “Delete my account” removes your account and the content you own.
• Email preferences — Settings → Notifications, or the unsubscribe link in any notification email.
• Everything else — email hello@boxic.io. We respond within the period the applicable law requires. You may use an authorised agent, and you may appeal a decision by replying to it.

9. California residents

Under the CCPA/CPRA, the categories above map to identifiers, internet activity, professional information, and user-generated content. We collect them for the business purposes in section 2, from you and from your device. We do not sell personal information and we do not share it for cross-context behavioural advertising. We do not use sensitive personal information for inferring characteristics. Exercise your rights with the tools in section 8.

10. Security

Encryption in transit, encrypted storage, private file buckets with short-lived signed links, and access controls scoped to project membership. Details on our Security page, including how to report a vulnerability. No service can promise perfect security.

11. Changes

We will update this page when our practices change and revise the date above. If a change is material we will notify account holders in-product or by email.

12. Contact

Subject XYZ LLC · a California limited liability company
hello@boxic.io