Privacy Policy

a. Information you provide

• Account information: name, email address, company name, and similar details provided when an account is created for you.
• Content you enter: notes, documents, and other material you or your colleagues upload or enter into your company brain.
• Support requests: information provided through support or customer-service communications.

b. Information collected automatically

• Usage data: logs, metadata, and performance data related to your use of the services.
• Device information: IP address, browser type, operating system, and similar technical data.
• Cookies: we use strictly necessary session and security cookies to operate the service and keep you signed in. We do not use advertising cookies.

c. Information from services and data sources you connect

See Section 2.

BLVCKBOX lets you connect third-party services in two ways. In both cases we act only on the connections and instructions you authorize, and you can disconnect at any time.

a. Action connections

Some connections let BLVCKBOX perform actions in a third-party service on your behalf (for example, sending an email through Gmail, or posting a message to Slack). For these, we request only the minimum permission needed, act solely on your explicit instruction, and do not read or store that service’s data beyond what is required to perform the action. Authorizations are held by our third-party tool-authorization provider; we store no third-party passwords or OAuth refresh tokens; and you can revoke a connection at any time — from within the product or from the connected account’s own settings — which stops the connection immediately.

b. Data-source connections

Other connections let you bring content from a third-party service into your organization’s brain (for example, importing conversations, documents, or files) so it can be searched and used by your AI agents. For these, we retrieve the content you choose to connect, store it within your organization’s private, tenant-isolated brain, and use it to provide search and AI-generated answers to you and the colleagues you authorize. Access is governed by your organization’s permission settings, so private content stays visible only to the people you allow. We do not sell this content and do not use it to train generalized AI/ML models. Your organization owns and controls this data, including its deletion and export.

c. Google services (Limited Use)

For the Google services you connect (such as Gmail), we request only the minimum Google scopes required for the features you enable — today, Gmail is used on a send-only basis (composing and sending email you authorize; we do not read, list, download, or ingest your mailbox). BLVCKBOX’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to develop, improve, or train generalized AI/ML models.

We retain personal information only for as long as necessary to fulfill the purposes in this policy or as required by law, after which it is deleted or securely destroyed. Usage data may be retained for a shorter period for security and to improve the service. You may request deletion of your personal data at any time by contacting us at info@blvckbox.ai.

Your information may be processed in the United States and other locations where our service providers operate, where data-protection laws may differ from those in your jurisdiction. We take steps reasonably necessary to ensure your data is treated securely and in accordance with this policy.

We may disclose personal information:

• to comply with a legal obligation or a valid request by a public authority;
• in connection with a merger, acquisition, or asset sale;
• to our service providers, under the safeguards described in Section 9;
• with your consent, or as otherwise disclosed when you provide the information;
• to protect the rights, property, or safety of BLVCKBOX, our customers, or others.

We implement industry-standard safeguards — including encryption in transit, access controls, and per-tenant isolation of brain content — together with organizational practices designed to prevent unauthorized access to or disclosure of your data.

If you are in the European Union or European Economic Area, you have the right to access, correct, delete, restrict, or object to the processing of your personal data; to data portability; and to withdraw consent where we rely on it. To exercise these rights, email info@blvckbox.ai. You may also lodge a complaint with your local Data Protection Authority.

If you are a California resident, you may request the categories and specific pieces of personal information we hold about you, request deletion, and know whether we “sell” or “share” it. BLVCKBOX does not sell your personal information. To exercise these rights, email info@blvckbox.ai. We will not discriminate against you for exercising your rights.

We rely on third-party service providers to operate our services — in categories such as cloud hosting and infrastructure, database and authentication, AI/ML inference, third-party tool authorization and execution, email delivery, analytics and observability, and source-code hosting. These providers process data only to perform services on our behalf and are bound by confidentiality obligations. A current list of our sub-processors is available on request at info@blvckbox.ai.

We may update this Privacy Policy from time to time. We will post changes on this page and update the effective date above. Your continued use of the services after a change takes effect constitutes acceptance of the revised policy.

If you have questions about this Privacy Policy or our data practices, contact us at info@blvckbox.ai.