Privacy Policy

1. Who is responsible

Whiteboxx AI ("Whiteboxx", "we", "us") is responsible for the personal information we use to operate accounts, administer our business, secure the service, and communicate with you.

When an organization uses Whiteboxx to process information in its workspace, that organization generally determines the purposes of that processing, and we process the information on its behalf. Its agreement with us and its own privacy notices also apply. If your account is managed by an employer or another organization, its administrators may manage your access and workspace content. Direct requests about that content to the organization; we can help route your request.

2. Information we collect

• Account and organization information: your name, email address, identity-provider identifiers and profile details, organization and workspace membership, roles, and access permissions. Google or Microsoft provides sign-in information when you choose that provider; we do not receive your provider password.
• Workspace content: prompts, conversations, uploaded documents and datasets, research briefs, source selections, agent configurations, survey inputs and responses, generated reports, and other material you or your organization submits or creates. This content may contain personal information.
• Connection information: authorized platform account identifiers, granted permissions, access and refresh tokens, connection metadata, and data retrieved through the integrations you enable.
• Service and security records: request and run identifiers, timestamps, usage and error records, audit events, device or browser information, and network information such as IP addresses. AI execution traces may include inputs, outputs, and related metadata.
• Communications: information you provide when contacting us, requesting help, or discussing your account or service agreement.
• Research sources: information from public websites, public datasets, licensed providers, and sources selected for your research. Depending on the source, this may include public professional information, author names, reviews, or other publicly available personal information, as well as aggregate statistics.

3. How we use information

We use information to authenticate users, manage workspaces and permissions, connect authorized sources, retrieve and analyze evidence, generate requested outputs, execute workflows, retain research history and provenance, provide support, troubleshoot failures, evaluate service quality, prevent misuse, and meet legal obligations.

Where applicable data protection law requires a legal basis, we rely on performance of a contract for providing services to you; legitimate interests in operating, securing, and maintaining our business and service, subject to your rights; compliance with legal obligations; and consent where required, including for optional uses that require it. When processing workspace content on an organization's behalf, we follow its instructions under the applicable agreement.

Information needed for sign-in and service operation is necessary to provide those features. You can choose not to connect optional sources or submit optional content, but features that depend on that information will be unavailable.

4. AI and research processing

Whiteboxx sends relevant prompts, source excerpts, workspace context, and other task inputs to AI service providers, including OpenAI and Google Gemini, to generate responses, create embeddings, classify information, and support research and agent workflows. Inputs and outputs may also be processed by monitoring services such as Langfuse for execution tracing and troubleshooting. The providers used depend on the feature and service configuration.

Generated outputs and research history can be stored with your workspace. AI outputs may contain inferences or inaccuracies. Synthetic agents represent modeled personas and should not be treated as verified profiles of real individuals. Review outputs before relying on them, especially for decisions affecting people.

Do not submit personal information that you are not authorized to process. If your organization needs specific model-training restrictions, provider retention periods, or data residency terms, contact us to establish those requirements in your service agreement before submitting that data.

5. Connected services, including Google

Signing in and connecting a data source are distinct activities. If you authorize a Google data connection, Whiteboxx can access the profile and email information, Google Analytics properties and reports, and Search Console sites and performance data covered by the permissions you grant. Other integrations may provide advertising, audience, campaign, analytics, or business information from the accounts you authorize.

We use this information to show available sources, retrieve selected evidence, and provide the analysis, reports, and agent features you request. Connection credentials and retrieved data may be stored to maintain access and support those features. Relevant data may be processed by the hosting, AI, and monitoring providers described in this policy as part of delivering those features.

Our use and transfer of information received from Google APIs is subject to the Google API Services User Data Policy, including its Limited Use requirements where applicable. Google user data is not used for advertising targeting, sold to data brokers, or used to train generalized AI models. Human access to Google user data is limited to the cases allowed by that policy, such as your affirmative agreement, security investigations, or legal requirements.

You can revoke authorization through the provider's account settings, including Google Account connections, or ask us to remove a connection. Revoking access stops future authorized retrieval; it does not by itself delete previously imported data or generated outputs. Contact us or your workspace administrator to request deletion.

6. When we share information

• Your organization and authorized collaborators: workspace content and activity are available according to the service's access controls and your organization's permissions.
• Service providers: providers of hosting, storage, AI processing, monitoring, authentication, and support process information needed for their functions. These include Google Cloud for infrastructure, Google or Microsoft for chosen sign-in methods, and the AI and monitoring providers described above.
• Services you direct us to use: information may be sent to connected platforms, external tools, or destinations as part of the integrations and workflows you authorize. Those services also have their own privacy terms.
• Legal and security purposes: we may disclose information when required by law or reasonably necessary to protect rights, investigate abuse, or secure the service.
• Business transactions: information may be disclosed in connection with a merger, acquisition, financing, or transfer of business assets, subject to applicable law and any additional consent requirements for connected-service data.

7. Cookies and browser storage

The app uses cookies for authentication and request security, and browser storage for applicable sign-in flows. These support access to your account and protect service requests. You can remove cookies and stored site data through your browser settings; doing so may sign you out or prevent features from working.

This privacy-policy page does not load advertising trackers, analytics scripts, or third-party fonts. Hosting infrastructure may still record requests to the page.

8. Retention and deletion

Retention depends on the type of information, the purpose for which it is used, workspace instructions and agreements, and legal or security needs. Account information is retained as needed to operate the account; workspace content and outputs are retained to provide ongoing access and research history; connection credentials are retained as needed to maintain authorized connections; operational records are retained as needed for troubleshooting, security, and accountability.

You or your organization can request deletion by emailing info@whiteboxx.ai. We will assess and act on the request under applicable law and the relevant agreement. Deletion is not necessarily immediate across backups, logs, and third-party systems. Information may be retained where required by law, to resolve disputes, or for legitimate security purposes. Signing out or revoking a connection does not automatically delete your workspace.

9. Security and international processing

We use measures such as encrypted HTTPS connections, authenticated sessions, and organization and workspace access controls to protect information. No service can guarantee absolute security. Keep your account and connected-platform credentials secure and contact us if you suspect unauthorized access.

Our infrastructure and service providers may process information in countries other than your own, including the United States. Applicable protections and transfer mechanisms depend on the service agreement, provider, and relevant law. Where required, international transfers must be covered by a recognized legal mechanism, such as an adequacy decision or appropriate contractual safeguards. Contact us for information about the arrangements applicable to your workspace.

10. Your rights and choices

Depending on where you live and the law that applies, you may have rights to access or obtain a copy of your personal information, correct it, request deletion, restrict processing, object to processing based on legitimate interests, withdraw consent, or receive certain information in a portable format. Withdrawal of consent does not affect processing already lawfully carried out.

Send requests to info@whiteboxx.ai with enough information to identify your account and describe your request. We may need to verify your identity or authority, and we will respond within the period required by applicable law. For organization-controlled content, we may refer your request to the organization. Where applicable, you may use an authorized agent, appeal a denied request by replying to our decision, and exercise your rights without unlawful discrimination.

You may also complain to your local data protection authority. People in the EEA can contact their national supervisory authority, people in the UK can contact the Information Commissioner's Office, and people in Switzerland can contact the Federal Data Protection and Information Commissioner.

11. Children

Whiteboxx is intended for business users and is not directed to children under 18. If you believe a child has provided personal information to us, contact us so we can investigate and address it.

12. Changes and contact

We may update this policy as the service or applicable requirements change. We will update the date above and provide additional notice or request consent where required for material changes.

Privacy contact: Whiteboxx AI
info@whiteboxx.ai