Privacy Policy

Effective Date: April 4, 2026

LeBox (“we,” “us,” “our”) operates the lebox.pro website and related services (“Service”). This Privacy Policy describes how we collect, use, store, and protect your information.

1. Information We Collect

1.1 Account Information

When you create an account, we collect your email address, full name, and optionally your business name. This information is required to provide the Service.

1.2 Payment Information

Payment processing is handled entirely by Stripe. We do NOT store credit card numbers, bank account numbers, or other payment credentials on our servers. We receive only a Stripe customer ID and subscription status.

1.3 Usage Data

We collect storage usage metrics (file sizes, counts), download activity (IP address, timestamp, user agent), and upload activity for the purpose of operating the Service, enforcing plan limits, and providing download tracking to account holders.

1.4 Uploaded Files

We store files you upload to the Service. We do NOT inspect, analyze, scan, index, or process the contents of your files for any purpose other than storage and delivery. See Section 3 for details.

2. How We Use Your Information

We use your information solely to:

• Provide, maintain, and improve the Service
• Authenticate your identity and manage your account
• Process payments and manage subscriptions
• Send transactional emails (share notifications, portal upload alerts)
• Enforce our Terms of Service
• Comply with legal obligations

We do NOT:

• Sell, rent, or trade your personal information to third parties
• Use your data for advertising or marketing purposes (other than Service-related communications)
• Use your files for AI training, machine learning, analytics, or any purpose beyond storage and delivery
• Share your information with third parties except as described in Section 5

3. File Privacy — Critical Disclosures

Your files are your property. We act solely as a storage and delivery intermediary.

3.1 What We Do

• Store your files on encrypted infrastructure (Supabase/AWS)
• Encrypt files in transit using TLS 1.2+ and at rest using AES-256
• Generate temporary signed URLs for authorized downloads
• Delete files when you request deletion or when transfers expire

3.2 What We Do NOT Do

• Access, view, or inspect the contents of your files
• Use your files for AI training, model development, or machine learning
• Scan files for content moderation (unless required by law or upon receiving a valid legal request)
• Share file contents with any third party (except as required by law enforcement with valid legal process)

3.3 What You Should NOT Store

LeBox is designed for creative media files (photos, videos, design assets). As outlined in our Terms of Service, you should NOT upload:

• Social Security numbers, government IDs, or other PII
• Financial records (bank statements, tax returns, credit card numbers)
• Medical or health records (HIPAA-protected information)
• Passwords, API keys, or authentication credentials
• Any data subject to regulatory compliance requirements (HIPAA, PCI-DSS, FERPA, GLBA, SOX)

While we implement industry-standard encryption, no system is completely immune to security incidents. By uploading sensitive data in violation of our Terms, you accept full responsibility for any consequences of its exposure. We strongly recommend using purpose-built, compliance-certified services for storing regulated data.

4. Data Security

4.1 Technical Safeguards

• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher
• Encryption at rest: All stored files are encrypted using AES-256 on the storage infrastructure
• Access controls: Row-Level Security (RLS) policies ensure users can only access their own data
• Authentication: Supabase Auth with secure session management
• Password hashing: All passwords (account, vault, portal, transfer) are hashed using bcrypt and never stored in plaintext

4.2 Limitations

No security system is perfect. Despite our best efforts, we cannot guarantee that unauthorized access, data breaches, or security incidents will never occur. In the event of a security incident that affects your personal information, we will notify affected users in accordance with applicable law.

We are not liable for damages resulting from the unauthorized disclosure of content that was uploaded in violation of our Terms of Service, particularly content containing PII, financial data, or other sensitive information that should not have been stored on the Service.

5. Third-Party Services

We use the following third-party services to operate LeBox:

Each of these services has their own privacy policy. We share only the minimum information necessary for each service to function.

6. Cookies

We use essential cookies only for authentication and session management. We do NOT use:

• Tracking cookies
• Advertising cookies
• Third-party analytics cookies
• Social media tracking pixels

7. Data Retention

• Active files: Stored until you delete them or they reach their expiration date
• Expired transfers: Files are permanently deleted by our automated cleanup process
• Account data: Retained while your account is active
• Deleted accounts: All associated data (files, transfers, portals, vaults) permanently deleted within 30 days
• Download logs: Retained for 90 days for transfer tracking, then automatically purged
• Payment records: Retained by Stripe in accordance with their data retention policy and applicable financial regulations

8. Your Rights

You have the right to:

• Access: View all personal data we hold about you
• Correction: Update or correct your account information
• Deletion: Delete your files, close your account, and request permanent data removal
• Portability: Download your files at any time
• Objection: Object to specific data processing activities

To exercise any of these rights, contact us at privacy@lebox.pro. We will respond within 30 days.

9. Children’s Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected data from a child under 18, we will delete it promptly.

10. International Users

The Service is hosted in the United States. If you access the Service from outside the United States, you consent to the transfer of your data to the United States, which may have different data protection laws than your country of residence.

11. California Privacy Rights (CCPA)

California residents have additional rights under the California Consumer Privacy Act. We do not sell personal information. You may request disclosure of the categories and specific pieces of personal information we have collected. Contact privacy@lebox.pro to exercise these rights.

12. Data Breach Notification

In the event of a data breach that compromises your personal information, we will:

• Notify affected users via email within 72 hours of confirming the breach
• Provide details about the nature of the breach and the data potentially affected
• Describe the steps we are taking to address the breach
• Report to applicable regulatory authorities as required by law

Our notification and liability obligations do not extend to content that was uploaded in violation of our Terms of Service, including PII, financial data, or other prohibited content categories. Users who uploaded such content in violation of our Terms assume full responsibility for any consequences.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to the address associated with your account. The “Effective Date” at the top of this page indicates when the policy was last revised. Continued use of the Service after changes constitutes acceptance.

14. Contact

For privacy-related questions, requests, or concerns:

• Email: privacy@lebox.pro
• Legal: legal@lebox.pro