Legal
Privacy Policy
DOC L-01 · EFFECTIVE 2026-07-08
This policy explains, in plain language, what personal data this website collects, what happens to it, and the rights you have. It reflects how the site actually works — nothing more is collected than what is described here.
Who is responsible
This website is operated by BoxBuild Agency, a United States company:
BoxBuild Agency
1111B S Governors Ave STE 23430
Dover, DE 19904, United States
[email protected]
For any privacy matter — questions, requests, complaints — one email to that address is all it takes.
What we collect, and where it goes
Contact form. When you submit the contact form, the details you enter (name, email, company, role, vertical, budget context, and your message) are forwarded directly to our customer relationship management system, GoHighLevel, a processor located in the United States. Submissions are not stored in this website’s own database — the site is a pass-through. We use that data to respond to you and, if you become a client, to manage the engagement. Transfers to the US are safeguarded by the processor’s standard contractual clauses.
Server logs. Our hosting infrastructure (Railway, with Cloudflare at the network edge) keeps short-lived technical logs — IP addresses, request times, user-agent strings — for security and reliability. These are not used to profile visitors.
Analytics. No analytics or tracking scripts are currently active on this site. If that changes, this policy will be updated first and any consent requirements honored.
Cookies
The site sets no marketing or tracking cookies. The only cookies that may appear are strictly technical ones required by the content management system for administrators who log in — visitors browsing the site receive none that identify them.
Legal bases
Where the GDPR applies, we process contact-form data on the basis of taking steps prior to entering a contract (Art. 6(1)(b)) and our legitimate interest in responding to business inquiries (Art. 6(1)(f)). Technical logs rest on legitimate interest in operating the site securely.
How long we keep data
Inquiry data is kept in the CRM for as long as a business relationship exists or a conversation is reasonably live, and deleted on request. Technical logs rotate on short cycles set by the infrastructure providers.
Your rights — GDPR (EU/EEA and UK visitors)
Under the GDPR you can request access to the personal data we hold about you, ask for correction or deletion, restrict or object to processing, and request a portable copy. You can also complain to a supervisory authority. One email to [email protected] starts any of these — no forms, no friction.
Your rights — CCPA/CPRA (California visitors)
California residents can ask what personal information we have collected, request its deletion or correction, and opt out of any sale or sharing of personal information. We do not sell or share personal information as defined by the CCPA/CPRA, and we do not discriminate against anyone for exercising these rights. The same email address handles all California requests.
Processors we rely on
- GoHighLevel (US) — CRM; receives contact-form submissions
- Railway (US) — application and database hosting
- Cloudflare (US/global) — DNS, security, and network edge
- Supabase (US) — media file storage
Changes
When this policy changes, the date at the top changes with it. Material changes will be flagged plainly, not buried.