Privacy Policy

1. Data controller & scope

IndexBox is the controller for personal data obtained through the website, web application, APIs, and customer support. Payments are processed via Stripe acting as our processor. This policy applies to trial users, paying customers, invited collaborators, and website visitors.

2. Data we collect

• Account data: name, email address, organisation details, roles, and plan selections provided during signup or onboarding.
• Usage & telemetry: login timestamps, IP address, device/browser characteristics, and workspace actions needed to secure the service and enforce limits.
• Payment data: billing identifiers, invoice history, and payment method metadata recorded by Stripe. Full payment credentials are stored only by Stripe.

3. Purpose & legal basis

We process personal data to deliver contracted services, comply with legal obligations, and pursue legitimate interests such as platform analytics, fraud prevention, and product communications. Where required, marketing emails rely on consent and may be withdrawn at any time.

4. Sharing, transfers & retention

Personal data is shared only with vetted sub-processors (hosting, monitoring, email, payments) under written agreements. Where data is transferred outside the EEA, we rely on appropriate transfer safeguards. Customer data is retained for the duration of the subscription and archived for a limited period for audit and disaster recovery before deletion.

5. Your rights

• Request access, correction, portability, or deletion of your personal data.
• Object to processing based on legitimate interests or restrict specific processing activities.
• Submit complaints to your local supervisory authority if you believe your data protection rights are infringed.

Requests can be sent to companies@indexbox.io.

6. Contact

For privacy questions, contact companies@indexbox.io.