Privacy Policy
This policy explains how BoxSight, a trading name of Stijn Benjamin (KvK 85508365, established at Hoogstraat 19 A, 3011 PD Rotterdam, the Netherlands), handles personal data. Contact: hello@boxsight.app.
BoxSight has two roles under the GDPR:
- Controller for data about our own website visitors, prospects and the people who hold BoxSight accounts. That is what this policy covers.
- Processor for the data our customers store in BoxSight (their customers, contacts, containers and so on). For that data the customer is the controller and our Data Processing Agreement applies. If your details appear in a customer's BoxSight environment, contact that organization directly.
1. Data we collect
- Account data: name, email address, organization name, language preference and hashed authentication credentials, when you register.
- Billing data: subscription plan, seat count, invoice history and payment status. Card details are handled directly by Stripe and never touch our servers.
- Support and correspondence: emails you send us.
- Service logs: technical logs (IP address, timestamps, requested endpoints) and error reports needed to keep the Service secure and reliable.
- Website analytics: our marketing site uses cookieless, anonymous page-view counting (PostHog, EU cloud). No cookies or local storage are set, no personal profile is built, and no consent banner is therefore required.
2. Purposes and legal bases
- Providing and securing the Service, including authentication and support (performance of a contract, art. 6(1)(b) GDPR).
- Billing and bookkeeping (contract and legal obligation, art. 6(1)(b) and (c); Dutch tax law requires us to keep invoices for 7 years).
- Service emails such as trial reminders, payment confirmations and important product or legal changes (contract / legitimate interest, art. 6(1)(b) and (f)).
- Anonymous usage statistics of the marketing site (legitimate interest, art. 6(1)(f); no personal data is retained).
- Error monitoring and abuse prevention (legitimate interest, art. 6(1)(f)).
We do not sell personal data and do not use it for automated decision-making with legal effect.
3. Recipients and subprocessors
We use a small set of service providers to run BoxSight:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | EU (AWS eu-west-1) |
| DigitalOcean | Backend hosting | EU |
| Vercel | Frontend hosting (static assets) | EU/US (global CDN) |
| Stripe | Payment processing and invoicing | EU/US |
| Resend | Transactional email | EU/US |
| Sentry | Error monitoring | EU/US |
| PostHog | Anonymous website analytics | EU |
Where a provider processes data outside the EEA, transfers are covered by an adequacy decision (such as the EU-US Data Privacy Framework) or the European Commission's Standard Contractual Clauses. Vessel position (AIS) and carrier container data contain no personal data. The current subprocessor list for Customer Data is maintained in the DPA.
4. Retention
- Account data: for the duration of your account, then deleted within 30 days of account deletion.
- Trial organizations that do not subscribe: data deleted after a reasonable period (at least 30 days after trial expiry).
- Invoices and billing records: 7 years (Dutch fiscal retention duty).
- Technical logs and error reports: up to 90 days.
5. Security
Data is encrypted in transit (TLS) and at rest. Access to production data is limited to what is strictly necessary, data is strictly separated per organization, and we keep regular backups. Payment data is handled exclusively by Stripe (PCI-DSS certified).
6. Your rights
You have the right to access, rectify, erase and receive a copy of your personal data, to restrict or object to processing, and to withdraw consent where processing is based on consent. Email hello@boxsight.app and we will respond within one month. You can also lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
7. Cookies
The marketing site (boxsight.app) sets no cookies. The application (app.boxsight.app) stores authentication tokens and interface preferences (such as language) in your browser; these are strictly necessary for the Service to function and are not used for tracking or advertising. No third-party marketing cookies are used anywhere.
8. Changes
We may update this policy, for example when we add a subprocessor. Material changes are announced by email or in the Service. The date at the top shows the latest revision.
9. Contact
Stijn Benjamin, trading as BoxSight
Hoogstraat 19 A, 3011 PD Rotterdam, the Netherlands
KvK: 85508365 · VAT: NL004106731B83
hello@boxsight.app