Privacy Policy

Last updated: July 24, 2026

Boxemai ("we", "us") provides AI receptionist services — phone answering, website chat, appointment booking, and related tools — to small businesses ("clients") at boxemai.com. This policy explains what information we collect, how we use it, and the choices you have.

Information we collect

• Account information. When a business signs up: name, email address, business name, business address, and phone number.
• Business configuration. The services, prices, hours, policies, and instructions a client teaches their assistant. This is the client's own business information.
• Customer interactions handled for our clients. When we answer a call or website chat on a client's behalf, we process the caller's or visitor's phone number, the conversation transcript, and any details they share to request a booking or callback. We process this information as a service provider to the client — the business you contacted is responsible for how it is used.
• Billing. Payments are processed by Stripe. We never see or store full card numbers; Stripe shares only the billing status and metadata we need to run your subscription.
• Usage and cost telemetry. Technical logs (with request metadata such as IP addresses for rate limiting) and per-account usage metering, used to operate, secure, and bill the service.

Google user data

Clients may connect their own Google Calendar so appointments their assistant books appear on their real calendar. If you connect Google Calendar:

• Scope: we request access to calendar events only (the calendar.events scope) — never your email, contacts, files, or wider Google account.
• Use: your calendar access is used solely to create and manage the appointment events your own assistant books. We do not read unrelated events, and no Google user data is used for advertising, profiling, or model training.
• Storage: OAuth tokens are stored encrypted at rest (AES-256-GCM); the encryption key is held outside the database. Access to your calendar happens only server-side, over TLS.
• Sharing: we do not sell, rent, or transfer Google user data to third parties, except as necessary to provide the feature you asked for or as required by law.
• Revocation: you can disconnect Google Calendar at any time from your dashboard — we stop syncing immediately and destroy the stored tokens. You can also revoke access from your Google Account permissions.

How we use information

• To provide the service: answering calls and chats, booking appointments, sending confirmation texts, and showing clients their conversations and leads.
• To operate AI features: conversation content is processed by our AI providers (currently Anthropic) to generate responses. Our provider agreements do not permit using this data to train their models.
• To run the platform: security, abuse prevention, rate limiting, billing, and support.

We do not sell personal information, and we do not use it for third-party advertising.

SMS / text messaging

When you contact a business that uses Boxemai by phone or website chat and provide your phone number, that business may send you text messages about your request — appointment confirmations, booking notifications, and callbacks. Messages are sent only to people who contacted the business first.

Mobile numbers are never shared with third parties or affiliates for marketing or promotional purposes. Phone numbers are shared only with the telephony providers required to deliver the message (Twilio) and with the business you contacted.

Message frequency varies depending on your appointment or request activity — typically one to a few messages per booking or inquiry. Message and data rates may apply.

Reply STOP to any message to unsubscribe; reply HELP for help, or email [email protected].

Who we share it with

Only the service providers needed to run Boxemai: telephony and voice (Twilio, Vapi), AI processing (Anthropic), payments (Stripe), email (Resend), and hosting infrastructure. Each receives only what its function requires. We may also disclose information if the law requires it.

Retention

Account and configuration data are kept while the account is active. Conversation records are kept so clients can review their own customer interactions, and are deleted when the client's account is deleted. You may request deletion sooner (below).

Security

All traffic is encrypted in transit (TLS). Stored credentials such as OAuth tokens are encrypted at rest. Access to production data is restricted, and every data query in the platform is scoped to the owning business account.

Your choices and rights

• Clients can view, edit, and delete their business configuration in the dashboard, and disconnect any integration at any time.
• You may request a copy or deletion of your personal information by emailing [email protected].
• If you interacted with a business that uses Boxemai and have questions about your data, contact that business, or email us and we will help route your request.

Children

Boxemai is a business service and is not directed to children under 13. We do not knowingly collect children's personal information.

Changes

If this policy changes materially, we will update this page and note the new date above.

Contact

Boxemai · [email protected]