Legal / 04
Sub-processors
Last updated · August 16, 2026
Subject XYZ LLC, a California limited liability company uses the service providers below to operate Boxic. Each one processes only the data needed for its purpose, under its own contractual terms with us. We update this page when a provider is added or removed.
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Supabase | Database, authentication, and file storage for accounts and projects | Account details, project data and files, activity records | United States |
| Cloudflare | Application hosting, edge delivery, and network protection | Request metadata (IP address, user agent) in transit | Global edge network |
| Lovable | Application platform, transactional email delivery, and AI gateway | Email addresses, message content, prompts sent to AI features | United States / EU |
| AI model providers (via the Lovable AI gateway) | Powering Boxie: answering prompts about your project content | Prompt text, file names, extracted BOM/geometry summaries you ask about | United States |
| Google (Sign in with Google) | Optional federated sign-in | Email address, display name, profile image | United States |
| GitHub, Google Drive, Dropbox, Slack | Optional connectors — only when you explicitly connect an account | Files and metadata you choose to import or sync | United States |
Optional connectors
Connectors such as GitHub, Google Drive, Dropbox, and Slack only receive or send data after you explicitly connect that account, and only for the projects you choose. Disconnecting a connector in Settings stops further processing.
Questions or objections
Write to hello@boxic.io. For how we handle personal data overall, see the Privacy Policy.