How it works About Pricing Inventory Blog Contact Get started →

Privacy Policy

Last updated: September 27, 2026

BoxShare ("BoxShare", "we", "us") operates boxshare.io, a marketplace that connects ecommerce publishers with advertisers for package-insert advertising. This policy explains what data we collect, why, and how it is protected and shared.

1. Data we collect

  • Account data: name, email address, password (hashed), and optional two-factor authentication secret.
  • Google sign-in: if you choose "Continue with Google", we receive your Google account email address, display name and profile ID via Google's OAuth service. We use this solely to create and authenticate your BoxShare account. We do not access your Gmail, Drive, Contacts or any other Google data.
  • Business data: brand name, website, industry, shipment volumes, audience demographics and fulfillment addresses you provide.
  • Store integrations: if you connect Shopify or WooCommerce, we store API credentials and read order/discount data needed to verify shipment volume, provision discount codes and attribute sales. We never modify products, orders or customer data.
  • Usage data: QR-code scan events (timestamp, IP address, user agent, referrer), page views and campaign activity.
  • Payment data: billing is processed by Stripe. We store Stripe customer IDs and transaction records; full card numbers never touch our servers.

2. How we use it

  • Operate the marketplace: matching, placements, printing, fulfillment and attribution.
  • Process payments, payouts, invoices and subscription billing.
  • Send transactional email (account alerts, placement notices, tracking numbers, dunning) via Resend.
  • Improve the product (aggregate, de-identified analytics).
  • Meet legal, tax and fraud-prevention obligations.

3. Who we share it with

  • Stripe — payments, payouts (Connect), card storage.
  • Cloudprinter — print production and delivery of cards to fulfillment addresses.
  • Resend — transactional email delivery.
  • OpenRouter — AI features (brand profiling, card art, content). Prompts may include brand descriptions you provide.
  • Google — authentication only, when you choose Google sign-in.

We do not sell personal data. Marketplace counterparties see only the business details required to review and fulfill a placement (e.g. a publisher sees the advertiser's card design and offer, not their email).

4. Cookies & sessions

We use a session cookie for sign-in and security. We do not use third-party advertising trackers.

5. Retention & security

Data is retained while your account is active and as required for tax/legal records. We use TLS encryption, hashed passwords, optional TOTP two-factor authentication, firewall and access controls. No method of transmission or storage is 100% secure; notify us immediately of any suspected breach.

6. Your rights

You may access, correct, export or delete your account data at any time from account settings or by emailing info@boxshare.io. Deleting your account removes personal data except records we must keep by law. EU/UK residents have GDPR rights including access, rectification, erasure, portability and objection; California residents have CCPA rights (we do not sell personal information).

7. Children

BoxShare is a business service and is not directed at children under 16.

8. Changes & contact

We will post material changes on this page with a new date. Questions: info@boxshare.io or our contact page.