1. Introduction

At RedactBox ("we", "our", or "us"), we are committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our email redaction platform and services (the "Services").

Your privacy is important to us. We understand that when you upload email files for redaction, you are trusting us with sensitive information, and we take that responsibility seriously.

2. Information We Collect

2.1 Personal Information

We collect personal information you provide directly to us, including:

• Name and email address (for account registration)
• Payment information (processed securely through Stripe)
• Contact information when you reach out for support
• Account preferences and settings

2.2 Email Content Data

When you upload .mbox files or other email archives to our platform, we process:

• Email headers and metadata
• Email content and attachments
• Sender and recipient information
• Timestamps and other technical data

2.3 Technical Information

• Device information and browser type
• IP address and location data
• Usage patterns and service interactions
• Performance and error logs

2.4 Third-Party Authentication

We use Google and Microsoft Azure for secure sign-in. We only request basic profile information (name and email address) - we do not access your Google Drive, emails, or Microsoft files. Your uploaded email content for redaction is never shared with these authentication providers.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our email redaction services
• Process your email files and enable redaction functionality
• Generate redacted PDF exports and other requested formats
• Authenticate your account and provide customer support
• Process payments and manage subscriptions
• Send important service updates and notifications
• Analyze usage patterns to improve our platform
• Comply with legal obligations and enforce our terms

4. Data Processing and Storage

4.1 Email Data Processing

Your email files are processed securely within our UK-based infrastructure. We:

• Parse email content only for redaction purposes
• Apply your redaction choices to create sanitized versions
• Store processed data temporarily during your active session
• Allow you to export redacted content in various formats

4.2 Data Retention

We retain your data only as long as necessary to provide our services or as required by law. Email content is deleted immediately when you choose to delete it from your projects. User account data is permanently deleted when you delete your account - we do not retain this information.

5. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share information only in the following limited circumstances:

• Service Providers: With trusted UK-based partners who help us operate our platform (e.g., Stripe for payments, Google Cloud UK for hosting, Featurebase for customer support, Google Analytics for usage analytics)
• Legal Requirements: When required by law, court order, or government request
• Business Protection: To protect our rights, property, or safety and that of our users
• Business Transfer: In connection with a merger, acquisition, or sale of assets

6. Security Measures

We implement comprehensive security measures to protect your data:

• End-to-end encryption for data in transit and at rest
• UK-based Google Cloud infrastructure with strict access controls
• All data processing occurs within the UK
• Multi-factor authentication for account access
• GDPR-compliant data handling procedures
• Registered with the UK Information Commissioner's Office (ICO)

7. Your Data Rights

Under GDPR and UK data protection laws, you have the right to:

• Access your personal data and receive a copy
• Correct inaccurate or incomplete information
• Delete your data (subject to legal retention requirements)
• Restrict or object to data processing
• Data portability (receive your data in a structured format)
• Withdraw consent at any time

To exercise these rights, please contact us through our support system at redactbox.co.uk.

8. Cookies and Tracking

We use essential cookies to:

• Maintain your session and authentication state
• Remember your preferences and settings
• Analyze site performance and usage (with Google Analytics)
• Provide customer support through Featurebase integration

You can control cookie preferences through your browser settings or our cookie consent banner.

9. International Data Transfers

All your data is stored and processed exclusively within the UK using Google Cloud UK infrastructure. We do not transfer data outside the UK/EU for any purpose related to your email content processing.

10. Children's Privacy

Our services are not intended for individuals under 16 years of age. We do not knowingly collect personal information from children under 16. If you become aware that a child has provided us with personal information, please contact us immediately.

11. Policy Updates

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. We will notify you of significant changes by email or through our platform. Your continued use of our services after updates constitutes acceptance of the revised policy.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us through our support system:

For data protection matters, you also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.