1. Information We Collect

We collect information you provide directly to us, such as when you create an account, upload scripts, or contact us for support. This includes:

Name and email address
Payment information (processed securely via Stripe — we never store card numbers)
Script content and production documents you upload
Usage data and feature interaction logs
Correspondence sent to our support, sales, billing, privacy, or legal email addresses, including sender and recipient details, subject, plain-text body, selected headers, full raw MIME content, and attachment metadata
Attachment bytes that our inbound-mail security controls quarantine for restricted operator review

2. How We Use Your Information

We use the information we collect to provide, maintain, and improve AppleBoxe, process transactions, send transactional emails (call sheets, notifications), and respond to support requests. We do not sell your personal data to third parties.

3. Legal Basis for Processing (EEA/UK/Switzerland)

If you are located in the European Economic Area, the UK, or Switzerland, we process your personal information under these legal bases: performance of a contract (providing the Service you signed up for), legitimate interests (improving and securing the Service, preventing abuse), consent (where you have opted in, such as marketing email), and legal obligation (responding to lawful requests from authorities).

4. Script & Production Data

Your uploaded scripts and production documents are stored securely and are only accessible to you and members of your organization that you explicitly invite. We do not use your script content to train AI models without your explicit consent.

5. Data Retention

We retain account, script, and production data while your account is active and as needed to provide AppleBoxe. For inbound correspondence, our scheduled retention periods are 365 days for support, sales, and billing operations; 730 days for privacy requests; and 2,555 days for legal correspondence and inbound-mail audit records. A legal hold or another legal obligation may require us to retain relevant records longer. Inbound messages remain in access-controlled AppleBoxe systems and are not automatically forwarded to a personal inbox.

A confirmed account deletion removes the account identity and eligible AppleBoxe product data, subject to team-workspace transfer, billing-transfer, security, dispute, and legal requirements. File or payment-provider cleanup may complete asynchronously if a provider is unavailable. Minimal Stripe customer and subscription identifiers remain in the cleanup queue during automated retries and, if necessary, dead-letter review; completed cleanup records are retained for 30 days for reconciliation. Stripe may separately retain transaction records under its own legal obligations and privacy policy. You may contact privacy@appleboxe.com for privacy assistance.

6. Your Privacy Rights

Depending on where you live, you may have the right to access the personal information we hold about you, correct inaccurate information, delete your information (see Data Retention above for how account deletion works), receive a copy of your information in a portable format, and object to or restrict certain processing.

California residents have corresponding rights under the CCPA/CPRA, including the right to know what personal information we collect, delete it, correct it, and limit use of sensitive personal information. We do not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of — but you are welcome to submit a Do Not Sell/Share request out of caution and we will confirm this in writing.

To exercise any of these rights, contact privacy@appleboxe.com. We will respond within the time required by applicable law and may need to verify your identity first.

7. International Data Transfers

AppleBoxe and its service providers operate primarily in the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States. Where required, we rely on our service providers' Standard Contractual Clauses or other lawful transfer mechanisms to protect information transferred internationally.

8. Cookies

We use session cookies for authentication and essential platform functionality. We do not use third-party advertising cookies.

9. Third-Party Services

AppleBoxe integrates with the following third-party services, each with their own privacy policies:

Supabase — Authentication and database storage
Stripe — Payment processing
Resend — Transactional email delivery, including replies from our operator inboxes
Anthropic — AI-powered script analysis (data processed per its API terms)
Cloudflare — Content delivery, application security, Turnstile bot detection, and inbound-mail processing through Email Routing, Workers, and Queues; mailbox content and audit data are stored in D1 and private R2 storage, with operator access controlled by Cloudflare Access

If we add or replace a sub-processor that will process personal data on our behalf, we will update this list; material changes will be reflected here with a new "Last updated" date above.

10. Children's Privacy

AppleBoxe is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, contact privacy@appleboxe.com and we will delete it.

11. Security

We implement industry-standard security measures including TLS encryption in transit, row-level security in our database, and hashed credential storage. No method of transmission over the internet is 100% secure, but we take reasonable steps to protect your data. If a breach affecting your personal information occurs, we will notify affected users and any authorities required by applicable law without undue delay.

12. Data Processing Agreement

Organizations on our Studio or Enterprise plans that need a Data Processing Agreement (DPA) for their own compliance purposes may request one at privacy@appleboxe.com.

13. Contact

Questions about this policy? Contact us at privacy@appleboxe.com.

Privacy Policy