Privacy Policy

Last updated: October 7, 2026

Boxemai ("we", "us") provides AI receptionist services — phone answering, website chat, appointment booking, and related tools — to small businesses ("clients") at boxemai.com. This policy explains what information we collect, how we use it, and the choices you have.

Information we collect

• Account information. When a business signs up: name, email address, business name, business address, and phone number.
• Business configuration. The services, prices, hours, policies, and instructions a client teaches their assistant. This is the client's own business information.
• Customer interactions handled for our clients. When we answer a call or website chat on a client's behalf, we process the caller's or visitor's phone number, the conversation transcript, and any details they share to request a booking or callback. We process this information as a service provider to the client — the business you contacted is responsible for how it is used.
• Customer records our clients provide. A client may upload or enter records about their own existing customers (such as names, phone numbers, email addresses, birthdays, and service notes) so their assistant recognizes returning customers. We store these records on the client's behalf and use them only to provide the service to that client — never to send marketing, and never shared across businesses. Uploading a customer list never signs anyone up for text messages: texting always requires the customer's own opt-in, described in our SMS policy. If you want records about you corrected or deleted, contact the business you do business with, or us at the address below.
• Billing. Payments are processed by Stripe. We never see or store full card numbers; Stripe shares only the billing status and metadata we need to run your subscription.
• Usage and cost telemetry. Technical logs (with request metadata such as IP addresses for rate limiting) and per-account usage metering, used to operate, secure, and bill the service.

Google user data

Clients may connect two Google features, each with its own separate consent and its own narrow scope. We never ask for your email, files, or wider Google account.

Google Calendar — so appointments your assistant books appear on your real calendar. If you connect it:

• Scope: calendar events only (the calendar.events scope).
• Use: your calendar access is used solely to create and manage the appointment events your own assistant books. We do not read unrelated events.

Google Contacts (read-only) — so you can bring your existing customer list into Boxemai. If you connect it:

• Scope: read-only contacts (the contacts.readonly scope). We never write to, change, or delete anything in your Google Contacts.
• Use: when you press "Pull from Google Contacts", we read names, phone numbers, and email addresses, show you the list, and save only the contacts you tick as customer records for your business (see "Customer records our clients provide" above). Contacts you do not tick are not stored. We do not read contacts in the background, and a pull never sends anyone a text message.

For both:

• No other use: Google user data is never used for advertising, profiling, or training AI models.
• Storage: OAuth tokens are stored encrypted at rest (AES-256-GCM); the encryption key is held outside the database. Access to Google happens only server-side, over TLS.
• Sharing: we do not sell, rent, or transfer Google user data to third parties, except as necessary to provide the feature you asked for or as required by law.
• Revocation: you can disconnect either feature at any time from your dashboard — we stop using it immediately and destroy the stored tokens. Customer records you already imported stay in your Boxemai account until you delete them. You can also revoke access from your Google Account permissions.

How we use information

• To provide the service: answering calls and chats, booking appointments, sending confirmation texts, and showing clients their conversations and leads.
• To operate AI features: conversation content is processed by our AI providers (currently Anthropic) to generate responses. Our provider agreements do not permit using this data to train their models.
• To run the platform: security, abuse prevention, rate limiting, billing, and support.

We do not sell personal information, and we do not use it for third-party advertising.

SMS / text messaging

When you contact a business that uses Boxemai by phone or website chat and provide your phone number, that business may send you text messages about your request — appointment confirmations, booking notifications, and callbacks. Messages are sent only to people who contacted the business first.

Mobile numbers are never shared with third parties or affiliates for marketing or promotional purposes. Phone numbers are shared only with the telephony providers required to deliver the message (Twilio) and with the business you contacted.

Message frequency varies depending on your appointment or request activity — typically one to a few messages per booking or inquiry. Message and data rates may apply.

Reply STOP to any message to unsubscribe; reply HELP for help, or email [email protected].

Who we share it with

Only the service providers needed to run Boxemai: telephony and voice (Twilio, Vapi), AI processing (Anthropic), payments (Stripe), email (Resend), and hosting infrastructure. Each receives only what its function requires. We may also disclose information if the law requires it.

Retention

Account and configuration data are kept while the account is active. Conversation records are kept so clients can review their own customer interactions, and are deleted when the client's account is deleted. You may request deletion sooner (below).

Security

All traffic is encrypted in transit (TLS). Stored credentials such as OAuth tokens are encrypted at rest. Access to production data is restricted, and every data query in the platform is scoped to the owning business account.

Your choices and rights

• Clients can view, edit, and delete their business configuration in the dashboard, and disconnect any integration at any time.
• You may request a copy or deletion of your personal information by emailing [email protected].
• If you interacted with a business that uses Boxemai and have questions about your data, contact that business, or email us and we will help route your request.

Children

Boxemai is a business service and is not directed to children under 13. We do not knowingly collect children's personal information.

Changes

If this policy changes materially, we will update this page and note the new date above.

Contact

Boxemai · [email protected]