Draft, pending legal review. This is a plain-language draft. It describes how BoxSoft works today and will be reviewed by a lawyer before it is final.
Privacy policy
Last updated
BoxSoft is quoting and scheduling software for exterior cleaning companies, operated from British Columbia, Canada. This policy explains what personal information we collect, why, and what you can do about it. It is written for two audiences: the companies that use BoxSoft, and the people whose details those companies enter into it.
Who we are
BoxSoft is operated from British Columbia, Canada, and follows the Personal Information Protection Act of British Columbia (PIPA) along with Canada’s federal privacy and anti-spam laws. You can reach us about anything in this policy at hello@boxsoft.app.
Two kinds of personal information
BoxSoft holds two kinds of personal information, and we treat them differently.
- Account information about the companies that use BoxSoft and their staff. We decide how this is collected and used, so we are responsible for it.
- Customer information that a company enters about its own customers: homeowners, property managers, and other people it quotes work for. The company decides what to collect and why. We store and process it on the company’s behalf and only as needed to run the service. If you are one of those customers, the company you dealt with is your first point of contact, and we will help them answer you.
What we collect and why
We collect only what the service needs to work.
- Account details: your company name, chosen subdomain, your email address, and a password, which we store only as a one-way hash. We use these to sign you in and to keep companies’ data separate.
- Customer contacts entered by a company: names, email addresses, phone numbers, and the role each contact plays for a property (for example approver or billing). We use these to send quotes and scheduling notices on the company’s behalf.
- Property records: addresses and measurements of cleanable features such as windows, gutters, and driveways. Measurements are not personal on their own, but an address can identify an occupant, so we protect property records too.
- Leads submitted through a company’s quote request form: name, contact details, address, and the services requested. The company receives these; we store them in that company’s account.
- Quote responses: whether a quote was accepted or declined and, for declines, a reason chosen from a short list. Responses are stored without any link to a person.
- Technical logs: IP addresses, browser information, and request timestamps, kept for security, to stop abuse, and to diagnose problems.
Emails and messages we send on a company’s behalf
When a company sends a quote or schedules a job, BoxSoft sends the email. These messages are transactional under Canada’s anti-spam legislation (CASL): they complete or confirm work the recipient asked about. Replies go to the company’s own email address, not to us.
Each company is responsible for having the recipient’s consent for any message that promotes its services beyond the transaction, and for honouring requests to stop. BoxSoft does not send marketing email to a company’s customers.
Where data is stored and who processes it
We run BoxSoft on a small number of infrastructure providers. Each one processes data only to provide its service to us.
- Cloudflare: hosting for the application, delivery of the emails described above, the Turnstile check that keeps spam out of quote request forms, and privacy-friendly analytics on this public website.
- Neon: the managed database where company, property, contact, and quote records are stored.
Some of these providers operate outside Canada, so personal information may be stored or processed outside Canada and be subject to the laws there.
How long we keep information
Property records are kept for as long as the company keeps its account, because the point of BoxSoft is that an appraisal outlives any one customer.
Contact details are kept apart from property records, and a company can delete a contact at any time. Deleting a contact removes their name, email address, and phone number and leaves the property record in place.
Technical logs are kept for a short period and then discarded.
When a company closes its account, we delete its data on request. Email hello@boxsoft.app to ask.
Your rights
Under PIPA you can ask what personal information we hold about you, ask us to correct it, and ask how it has been used. If a company entered your details into BoxSoft, ask that company first; it controls your information and we will help it respond. For account information, or if you cannot reach the company, write to hello@boxsoft.app and we will respond within the time the law allows.
If you are not satisfied with our answer, you can complain to the Office of the Information and Privacy Commissioner for British Columbia.
Security
Each company’s data is isolated at the database layer, passwords are stored only as hashes, and the private links that open quotes are stored only as hashes too, so a copy of our database cannot be used to open them. No method of storage or transmission is perfectly secure, and we will tell affected companies promptly if we learn of a breach involving their data.
Changes to this policy
When we change this policy we update the date at the top. For a change that affects how we use personal information, we will notify account holders by email first.
Questions about privacy: hello@boxsoft.app.