Privacy Policy

1. About this policy

This Privacy Policy applies to Boxoo’s websites, application, AI agents, reports, and related services (together, the “Service”). Boxoo is based in Dubai, United Arab Emirates. In this policy, “Boxoo”, “we”, “us”, and “our” refer to Vivora, LLC, a Delaware limited liability company that operates the Service.

This policy explains what information we process, why we process it, when it may be shared, and the choices available to you. If your employer or another organization provides your Boxoo workspace, that organization may control the workspace and the business data within it.

2. Information we collect

Account and workspace information

We process your name, email address, profile image, sign-in identifiers, workspace membership, role, invitations, settings, and the business profile you or your organization provides.

Connected service information

Depending on the connections you authorize, Boxoo may access and process:

• Google Ads: account and customer identifiers, campaign structure and settings, ads, keywords, search terms, budgets, spend, clicks, conversions, performance metrics, recommendations, and change history.
• Google Analytics: property identifiers and aggregated website audience, acquisition, event, and conversion reporting.
• Google Sheets: data from spreadsheets selected or configured for your workspace, such as lead, revenue, or availability data.
• CRM and business systems: contacts, conversations, lead stages, sales outcomes, and other records from services you choose to connect.

We also store connection metadata and authorization credentials, including OAuth access and refresh tokens, so the Service can retrieve authorized data and run scheduled work. We request access only when you connect a service and use the access to provide the features you select.

Content and AI activity

We process your prompts, agent instructions, reports, generated analysis, approval decisions, feedback, saved actions, run history, and files or data you submit to the Service.

Usage, device, and support information

We may collect browser and device details, IP address, timestamps, requested pages, diagnostic logs, security events, and information you send when requesting support or deletion. Inside your workspace we record which pages you open and which controls you select, so we can see where the product helps and where it gets in the way. We never record what you type into a field.

How your account found Boxoo

When you first arrive we record the page you landed on, the referring website, any campaign parameters or advertising click identifier in the link, and your browser, device type, operating system, and language preference. We keep this in a first-party cookie and attach it to your account when it is created, so we can tell which campaigns bring us customers. When your account is created we also determine its approximate location — country, and where available region and city. If our hosting network does not report this, we resolve it once by sending the IP address of that single request to a geolocation provider, which returns the location only. We store the resulting location, never the IP address, and we do not repeat this on later visits.

Publicly available business information about you

When you create an account, we may look up publicly available professional information about you and your business so we can understand who uses Boxoo, tailor onboarding and support, and follow up about the Service. This can include your full name, job title, company, company website, business location, public professional and social media profiles, publicly listed company registrations, and business contact details, such as a business phone number, that you or your business have published yourselves.

We gather this from public sources, such as search engines, your business website, public profile pages, and official company registries, using your sign-in email address and name. We do not use people-search or data-broker services, and we do not collect your date of birth, home address, or information about your family. We never use data from your connected Google accounts for this. This information is visible only to authorized Boxoo staff, we do not sell it, and you can ask us to delete it or stop collecting it at any time (see section 8).

Optional website measurement

We use Google Tag Manager to deliver Google advertising and analytics measurement on public Boxoo pages. These services may receive your IP address, browser information, cookie identifiers, advertising click identifiers, campaign parameters, page visits, demo visits, confirmation of a new account registration, and successful Google sign-ins. We use this information to understand how visitors find Boxoo and measure our campaigns. We do not send your email address, prompts, reports, workspace names, or data retrieved from connected Google accounts to advertising tags. Personalized advertising is disabled in this setup. We also use Microsoft Clarity to record how pages are used (clicks, scrolling and page movement, with text you type masked) so we can improve the site.

In the European Economic Area, the United Kingdom and Switzerland, measurement cookies stay off until you select “Allow measurement”; until then Google may receive only cookieless signals that carry no identifier, and Microsoft Clarity does not record. Elsewhere, measurement (including Clarity) is on when you use Boxoo, unless you select “Essential only”. You can change your choice at any time using “Cookie preferences” on our public pages. We remember your choice in your browser for up to 180 days. Essential authentication and security cookies remain necessary for the Service. See how Google uses information from sites that use its services.

3. How we use information

We use information to:

• provide, personalize, maintain, and secure your workspace;
• retrieve authorized data and produce dashboards, reports, investigations, agents, and recommended actions;
• run schedules and preserve conversations, evidence, approvals, and report history;
• authenticate users, enforce workspace roles, and prevent cross-workspace access;
• respond to support, privacy, security, and account requests;
• understand who our customers are from publicly available business information, and contact you about Boxoo;
• measure reliability, troubleshoot errors, prevent abuse, and improve the Service; and
• comply with law, enforce our terms, and protect users, Boxoo, and others.

Where required by applicable law, we rely on your consent, performance of our agreement with you, compliance with legal obligations, and our legitimate interests in operating and securing the Service.

4. Google user data and Limited Use

We use Google user data only to provide or improve the user-facing Boxoo features you request. We do not sell Google user data, use it for advertising or retargeting, use it to determine creditworthiness, or transfer it to data brokers or information resellers.

Humans do not read Google user data unless you have given affirmative permission for support or troubleshooting, access is necessary for security or legal compliance, or the data has been aggregated for permitted internal operations. Service providers process Google user data only as necessary to deliver or secure Boxoo and under appropriate confidentiality and data-protection obligations.

5. When information is shared

We may share information with:

• Your workspace: owners, managers, and members according to their roles and the features you use.
• Service providers: hosting, database, authentication, analytics, AI-processing, monitoring, and support providers that help us operate the Service.
• Connected services: when you direct Boxoo to retrieve data or apply an approved action through a connected provider.
• Authorities and affected parties: when reasonably necessary to comply with law, protect rights and safety, or investigate fraud, abuse, or security incidents.
• Business transaction participants: in a financing, merger, acquisition, reorganization, or sale, subject to applicable law and protections for Google user data.

We do not sell your personal information or connected-service data.

6. Storage, security, and international processing

Boxoo uses technical and organizational safeguards designed to protect information, including encrypted connections, protected credentials, access controls, workspace isolation, and service monitoring. No system is completely secure, so we cannot guarantee absolute security.

Boxoo and its service providers may process information in the United Arab Emirates and other countries where they operate. Where required, we use appropriate safeguards for international transfers.

7. Retention and deletion

We retain information for as long as needed to provide the Service, maintain security and business records, resolve disputes, and meet legal obligations. Retention depends on the type of information and why it is processed. Disconnected credentials are removed or made unusable, subject to short-lived operational copies and backups.

You may disconnect an integration, revoke Google access, or request deletion of your account or workspace data. See our Data Deletion page for instructions and what to expect.

8. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a copy of certain personal information, and to withdraw consent. Workspace administrators may also be able to update or remove information associated with an organization-managed workspace.

To make a request, email support@boxoo.io from your Boxoo sign-in email. We may ask for information necessary to verify your identity and authority over the workspace. You may also complain to the data-protection authority available in your jurisdiction.

You can object at any time to our use of publicly available business information about you. Email support@boxoo.io and we will delete what we hold and stop collecting it.

9. Children

Boxoo is a business service and is not directed to children. You must be at least 18 years old to create or administer a Boxoo workspace.

10. Changes and contact

We may update this policy as Boxoo changes. We will update the date above and provide additional notice when required. If a change materially affects how we use connected Google data, we will provide notice and seek consent when required before using that data for a new purpose.