Privacy Policy
Last updated September 17, 2026
This Privacy Policy explains how SU, LLC (“SU”, “we”, “us”) handles personal information in connection with Boxento, including our website boxento.com, workspaces at *.boxento.com, and related services (together, the “Service”).
Our role
- Visitors, account holders and customers. For information about people who visit boxento.com, create a workspace or manage a subscription, SU, LLC is the controller.
- Employee information in workspaces. Companies that use Boxento (“customers”) add information about their employees to their workspaces. For that information, the customer is the controller, and we process it on the customer’s behalf under our agreement with them. If you’re an employee with a question about your information, please contact your employer first; we’ll help them respond.
Information we collect
Information you give us
- Account details: your name, work email, and a password (which we store only as a secure hash), or your Google account details if you choose to sign in with Google.
- Workspace details: company name, workspace address, country and time zone.
- Billing details: billing name, address and tax ID. Payment card details are collected and stored by Stripe; we never receive or store your full card number.
- Messages you send us, for example when you contact support.
Information customers add to workspaces
Depending on how a customer uses Boxento, this can include employees’ names and contact details, job titles, teams and reporting lines, employment and contract details, start dates, time-off requests and balances, documents such as contracts and letters, and attendance records. If a customer turns on location checks, a clock-in can include the device’s location at that moment.
Information collected automatically
- Technical data such as IP address, browser and device type, and request logs, which our hosting provider processes to deliver and protect the Service.
- Cookies, described below.
How we use information
We use personal information to:
- provide, maintain and secure the Service, including signing you in and sending service emails such as invitations, notifications and billing messages;
- process payments, manage trials and subscriptions, and meet our tax and accounting obligations;
- provide support and respond to requests;
- detect, investigate and prevent fraud, abuse, security incidents and errors;
- comply with the law and enforce our terms.
We don’t sell personal information, we don’t use it for targeted advertising, and we don’t use the information in customers’ workspaces for our own marketing.
Legal bases
Where laws such as the EU or UK General Data Protection Regulation apply, we rely on these legal bases: performance of a contract, to provide the Service you signed up for; legitimate interests, to secure and improve the Service and prevent fraud, balanced against your rights; legal obligations, for example keeping tax records; and consent, where we ask for it. For information in customers’ workspaces, the customer determines the legal basis.
Cookies
boxento.com and Boxento workspaces use only the cookies needed to run the Service:
- a session cookie that keeps you signed in, and a short-lived cookie that protects the “Sign in with Google” flow;
bx_locale, which remembers the country and language you chose on boxento.com.
We don’t use advertising cookies or third-party analytics cookies.
Service providers
We share personal information only with service providers that help us run the Service, under contracts that require them to protect it:
| Provider | What they do for us |
|---|---|
| Cloudflare, Inc. | Hosting, database and file storage, content delivery and security, email delivery, and document (PDF) generation |
| Stripe, Inc. | Payment processing, subscriptions and invoicing |
| Google LLC | Sign-in with Google, if you choose to use it |
| Functional Software, Inc. (Sentry) | Error monitoring, where enabled |
We may also disclose information if the law or legal process requires it, to protect the rights, property or safety of our customers, users or others, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to it.
International transfers
SU, LLC is based in the United States, and our service providers may process information in the United States and other countries. When we transfer personal information from the European Economic Area, the United Kingdom or Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.
How long we keep information
We keep account and workspace information for as long as the workspace exists, including after a subscription ends, so the customer can subscribe again. Customers can ask us to delete their workspace at any time; deleted information may remain in backups for a limited period before it is overwritten. We keep billing records for as long as tax and accounting laws require.
Security
We protect information with measures such as encryption in transit, access controls that keep each workspace’s data separate, and passwords stored as secure hashes. No method of transmission or storage is completely secure, but we work hard to protect your information, and we’ll notify affected customers of a personal data breach as the law requires.
Your rights
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict some processing, and to withdraw consent. To exercise these rights, email contact@suuudo.com. If your information is in an employer’s workspace, we’ll pass your request to that employer. You can also complain to your local data protection authority.
We don’t sell or share personal information for cross-context behavioral advertising, as those terms are defined under California law, and we won’t treat you differently for exercising your privacy rights.
Children
The Service is for businesses and isn’t directed to children under 16. We don’t knowingly collect their personal information.
Changes to this policy
We may update this policy. We’ll post the new version on this page with a new “last updated” date, and we’ll notify workspace owners of material changes.