Privacy Policy

This Privacy Policy explains how SU, LLC (“SU”, “we”, “us”) handles personal information in connection with Boxento, including our website boxento.com, workspaces at *.boxento.com, and related services (together, the “Service”).

Our role

• Visitors, account holders and customers. For information about people who visit boxento.com, create a workspace or manage a subscription, SU, LLC is the controller.
• Employee information in workspaces. Companies that use Boxento (“customers”) add information about their employees to their workspaces. For that information, the customer is the controller, and we process it on the customer’s behalf under our agreement with them. If you’re an employee with a question about your information, please contact your employer first; we’ll help them respond.

Information we collect

Information you give us

• Account details: your name, work email, and a password (which we store only as a secure hash), or your Google account details if you choose to sign in with Google.
• Workspace details: company name, workspace address, country and time zone.
• Billing details: billing name, address and tax ID. Payment card details are collected and stored by Stripe; we never receive or store your full card number.
• Messages you send us, for example when you contact support.

Information customers add to workspaces

Depending on how a customer uses Boxento, this can include employees’ names and contact details, job titles, teams and reporting lines, employment and contract details, start dates, time-off requests and balances, documents such as contracts and letters, and attendance records. If a customer turns on location checks, a clock-in can include the device’s location at that moment.

When an employer enables field tracking for an employee, the mobile app also records location samples during an active shift, after the employee sees the disclosure and grants device permission. Recording pauses during breaks and stops after clock-out. Authorized workspace administrators can view the last recorded location and the route. Samples are buffered on the device when offline and uploaded when connected; updates may have gaps when permission, connectivity or the operating system prevents recording. Route samples are retained for the workspace’s configured period (90 days by default). They are not used for advertising.

Information collected automatically

• Technical data such as IP address, browser and device type, and request logs, which our hosting provider processes to deliver and protect the Service.
• Usage data, such as the pages you visit, the site or search that brought you there, your approximate location (country and city, worked out from your IP address) and your device type. We collect it on boxento.com and, without cookies, in workspaces.
• How you found us. When you create a workspace, we keep with it the site, search or campaign that brought you to boxento.com and the page you arrived on, if you allowed analytics cookies. In that case we also tell Google Analytics when the workspace starts its trial and when it first pays (the amount and currency), linked to that visit, so we can see which pages and countries lead to customers.
• Cookies, described below.

How we use information

We use personal information to:

• provide, maintain and secure the Service, including signing you in and sending service emails such as invitations, notifications and billing messages;
• process payments, manage trials and subscriptions, and meet our tax and accounting obligations;
• provide support and respond to requests;
• understand how people find and use our website and the Service, so we can improve them and decide where to offer Boxento;
• detect, investigate and prevent fraud, abuse, security incidents and errors;
• comply with the law and enforce our terms.

We don’t sell personal information, we don’t use it for targeted advertising, and we don’t use the information in customers’ workspaces for our own marketing.

Legal bases

Where laws such as the EU or UK General Data Protection Regulation apply, we rely on these legal bases: performance of a contract, to provide the Service you signed up for; legitimate interests, to secure and improve the Service and prevent fraud, balanced against your rights; legal obligations, for example keeping tax records; and consent, where we ask for it, such as for analytics cookies on our website. For information in customers’ workspaces, the customer determines the legal basis.

Cookies

Boxento workspaces use only the cookies needed to run the Service: a session cookie that keeps you signed in, and a short-lived cookie that protects the “Sign in with Google” flow. Workspaces don’t use analytics cookies.

Our website, boxento.com, uses:

• bx_locale, which remembers the country and language you chose;
• Google Analytics cookies (_ga and _ga_ followed by an ID), which count visits and show us how people find and use the website. They last up to two years. In the European Economic Area, the United Kingdom and Switzerland, we set them only if you accept them. Elsewhere they’re on unless you turn them off.

While analytics is allowed, bx_touch keeps the page you arrived on and the site that sent you for the rest of your visit (in your browser’s session storage), so a sign-up can say how you found us. Your choice is saved in your browser as bx_consent, and you can change it anytime in Cookie settings. On boxento.com and in workspaces, we also use Cloudflare Web Analytics, which counts page views without cookies and without identifying you.

We don’t use advertising cookies.

Service providers

We share personal information only with service providers that help us run the Service, under contracts that require them to protect it:

We may also disclose information if the law or legal process requires it, to protect the rights, property or safety of our customers, users or others, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to it.

International transfers

SU, LLC is based in the United States, and our service providers may process information in the United States and other countries. When we transfer personal information from the European Economic Area, the United Kingdom or Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

How long we keep information

We keep account and workspace information for as long as the workspace exists, including after a subscription ends, so the customer can subscribe again. Customers can ask us to delete their workspace at any time; deleted information may remain in backups for a limited period before it is overwritten. We keep billing records for as long as tax and accounting laws require.

Security

We protect information with measures such as encryption in transit, access controls that keep each workspace’s data separate, and passwords stored as secure hashes. No method of transmission or storage is completely secure, but we work hard to protect your information, and we’ll notify affected customers of a personal data breach as the law requires.

Your rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict some processing, and to withdraw consent. To exercise these rights, email su@boxento.com. If your information is in an employer’s workspace, we’ll pass your request to that employer. You can also complain to your local data protection authority.

We don’t sell or share personal information for cross-context behavioral advertising, as those terms are defined under California law, and we won’t treat you differently for exercising your privacy rights.

Children

The Service is for businesses and isn’t directed to children under 16. We don’t knowingly collect their personal information.

Changes to this policy

We may update this policy. We’ll post the new version on this page with a new “last updated” date, and we’ll notify workspace owners of material changes.