Legal

Privacy Policy

Effective date: September 8, 2026 · Last updated: October 2, 2026

Whiteboxx AI ("Whiteboxx", "we", "us", or "our") provides business software for evidence-backed research, AI-assisted analysis, agent workflows, and connected data sources. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use our website, application, APIs, integrations, and related services that link to this policy.

If you have a privacy question or request, contact us at info@whiteboxx.ai.

1. Scope

This policy applies to personal information we process for our own business purposes, such as operating the service, managing accounts, communicating with customers, improving and securing the product, and responding to requests.

Many Whiteboxx workspaces are provided to organizations. If your account is created or managed by an employer, client, or other organization, that organization may control workspace content, user access, and related instructions. In those cases, its agreement with us and its own privacy notices may also apply. We may refer requests about organization-controlled content to that organization.

2. Personal information we collect

The personal information we collect depends on how you use Whiteboxx. It may include:

Contact and account information: name, email address, organization, role, login method, identity-provider identifiers, profile details, and workspace membership.
Commercial and relationship information: inquiries, support requests, product interests, subscription or contract details, billing-related records, and communications with us.
Workspace content: prompts, briefs, messages, source selections, uploaded files, datasets, agent configurations, workflow inputs, responses, generated outputs, and other content submitted to or created in the service.
Connected-service information: account identifiers, permissions, connection metadata, access tokens, refresh tokens, and data retrieved from services that you or your organization choose to connect.
Usage and device information: IP address, browser and device details, timestamps, pages or features used, request identifiers, logs, error records, security events, and related diagnostic information.
Public, licensed, or third-party source information: information from public websites, public datasets, licensed sources, business partners, and other sources selected for a research or analysis workflow. These sources may include publicly available professional information, author names, reviews, business records, or aggregate statistics.

We do not ask you to provide sensitive personal information unless it is necessary for your authorized use of the service. Do not submit personal information that you are not authorized to use or disclose.

3. How we collect information

Directly from you: when you create an account, contact us, submit content, configure a workflow, upload a file, or otherwise use the service.
From your organization: when an administrator creates or manages your account, assigns permissions, or provides workspace content.
From connected services: when you or your organization authorize Whiteboxx to access another account, platform, data source, or tool.
Automatically: through cookies, logs, browser storage, and similar technologies that help the service operate securely and reliably.
From third-party and public sources: when those sources are selected for research, enrichment, analysis, support, security, or business operations.

4. How we use information

We use personal information to:

provide, operate, maintain, and secure Whiteboxx;
authenticate users and manage organizations, workspaces, roles, permissions, and sessions;
connect authorized services and retrieve, organize, analyze, and present requested data;
create AI-assisted outputs, reports, agents, workflows, evidence records, and related product features;
store workspace history, generated outputs, provenance, audit records, and other product records needed to make the service useful over time;
provide support, respond to inquiries, send administrative messages, and manage our customer relationships;
monitor performance, debug errors, improve product quality, and develop new or better features;
detect, prevent, and respond to fraud, abuse, security incidents, policy violations, or technical problems;
comply with legal obligations and enforce agreements; and
carry out another purpose described when the information is collected or with your consent.

Where applicable law requires a legal basis, we rely on performance of a contract, our legitimate interests in operating and improving a secure business service, compliance with legal obligations, and consent where required. When we process workspace content on behalf of an organization, we process it under that organization's instructions and applicable agreement.

5. AI features

Whiteboxx uses AI models and related service providers to support features such as summarization, classification, research planning, embeddings, agent behavior, report generation, and workflow assistance. Relevant prompts, workspace context, source excerpts, files, generated outputs, and technical metadata may be processed by those providers to deliver the requested feature.

For this policy, customer content includes workspace content submitted by or for a customer and outputs generated for that customer, including reports, analyses, agents, workflows, evidence records, recommendations, and other artifacts created through the service. As between Whiteboxx and the customer, the customer retains rights in its customer content and outputs, subject to pre-existing rights in underlying materials, Whiteboxx technology, templates, tools, models, platform components, and third-party or public-source materials included in or referenced by an output.

We may process customer content and outputs to provide, secure, support, troubleshoot, evaluate, and improve Whiteboxx for the customer and as permitted by the applicable agreement. We do not use customer content or outputs to train generalized AI models unless authorized by the customer or covered by a separate written agreement. Third-party AI providers may process data under their own service terms and our agreements with them.

AI outputs can be incomplete or inaccurate. Synthetic agents, personas, and modeled audience outputs are generated for research and analysis and should not be treated as verified profiles of real individuals. You are responsible for reviewing outputs before relying on them, especially for decisions that could affect people.

6. Connected services, including Google

You may choose to connect Whiteboxx to third-party services, such as identity providers, analytics tools, search tools, advertising platforms, business systems, file stores, or other data sources. We access only the information covered by the permissions granted through the relevant service, subject to the features you use and your organization's configuration.

If you authorize a Google connection, Whiteboxx may access Google account profile and email information, Google Analytics properties and reports, Search Console sites and performance data, and related metadata covered by the permissions you grant. We use this information to show available sources, retrieve selected evidence, and provide the analysis, reporting, and agent features you request.

Whiteboxx's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements where applicable. We do not use Google user data for advertising targeting, sell Google user data to data brokers, or use Google user data to train generalized AI models. Human access to Google user data is limited to purposes allowed by the Google policy, such as providing or improving user-facing features, security, legal compliance, or access that you affirmatively approve.

You can revoke a connection through the provider's settings, including Google Account connections, or by contacting us or your workspace administrator. Revoking access stops future retrieval from that service. It does not automatically delete information previously imported into Whiteboxx or outputs already generated from it.

8. Cookies and similar technologies

Whiteboxx uses cookies, browser storage, and similar technologies for authentication, session management, request security, preferences, diagnostics, and service operation. You can remove cookies and stored site data through your browser settings, but doing so may sign you out or prevent parts of the service from working.

This privacy-policy page does not load advertising trackers, analytics scripts, or third-party fonts. Hosting infrastructure may still record ordinary request information for security and reliability.

9. Retention

We retain personal information for as long as reasonably necessary to provide the service, maintain business records, comply with legal obligations, resolve disputes, enforce agreements, protect the service, and fulfill the purposes described in this policy. The retention period depends on the type of information, your organization's instructions, feature settings, contractual requirements, legal requirements, and security needs.

You or your organization may request deletion by emailing info@whiteboxx.ai. We will assess requests under applicable law and relevant agreements. Deletion may not be immediate across backups, logs, generated outputs, and third-party systems, and we may retain information where permitted or required by law.

10. Security and international transfers

We use technical and organizational measures designed to protect personal information, including encrypted HTTPS connections, authenticated sessions, access controls, and operational monitoring. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Whiteboxx and its service providers may process information in countries other than where you live, including the United States. Where required, international transfers are protected through appropriate safeguards, such as contractual commitments or other lawful transfer mechanisms.

11. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of personal information; object to or restrict certain processing; withdraw consent; opt out of certain disclosures or targeted advertising where applicable; appeal a denied request; or lodge a complaint with a data protection authority.

To make a request, email info@whiteboxx.ai with enough information to identify your account and describe your request. We may need to verify your identity or authority before responding. If your request concerns organization-controlled content, we may refer the request to that organization. If you are located in the EU/EEA or UK, you may also contact our appointed representative described in section 12.

You can also manage certain choices directly, such as disconnecting third-party services through their account settings, changing browser cookie settings, unsubscribing from marketing emails where offered, or asking your workspace administrator to adjust your account access.

13. Children

Whiteboxx is intended for business users and is not directed to children under 18. If you believe a child has provided personal information to us, contact us so we can investigate and address it.

14. Third-party links and services

Whiteboxx may link to or integrate with third-party websites, platforms, or services. Their privacy practices are governed by their own notices and terms. We are not responsible for the privacy practices of third parties that we do not control.

15. Changes and contact

We may update this policy from time to time. If we make material changes, we will provide notice as required by law. Unless otherwise stated, updates apply when posted.

Privacy contact:
Whiteboxx AI
info@whiteboxx.ai

Data Protection Officer:
Gautam Mehra
gautam@whiteboxx.ai