Privacy policy

Last updated: [[TODO: date of counsel approval]]

Who we are

This website is operated by BoxTrunk (“we”). Contact: info@boxtrunk.com.

What this website collects

Assessment answers

The data assessment asks about your business: industry, operating history, approximate record volume, the systems you use, the kinds of records you keep, how they are written, whether outcomes are recorded, your confidence about rights, which categories of sensitive information exist, and your licensing preferences. Answers are multiple choice, plus an optional short description if you choose “Other industry.”

Contact details, only if you provide them

If you ask for a copy of your result or a review, we collect your name, company, role, email, optional phone, and state or country, together with the time you agreed to follow-up and, separately, whether you agreed to marketing email. The buyer inquiry, security documentation, privacy request, and subscription forms collect the details shown on each form.

Referral partners

Some businesses reach the assessment through a link from a Boxtrunk referral partner. Before you submit contact details, that partner sees only that an assessment started or was completed through their link, its reference, its start date, and its status. After you submit contact details, they also see your answers, your result, and your contact details. The consent sentence at the contact step says this before you submit (consent wording version 2026-10-08-draft). [[TODO: counsel to confirm the referral partner disclosure wording]]

Referral partner accounts

For each referral partner we keep their name, email, the business vertical they work in, sign-in records, and the dates they acknowledged our conduct rules. We do not record which training materials a partner views.

What we do not collect through this website

Files, exports, screenshots, or records from your business systems
Your customers’ names or contact details
Logins, passwords, payment details, or government identifiers
Contracts or agreements

Technical information

A session cookie (bt_as) that lets you resume the assessment for up to seven days, and an attribution cookie (bt_attr) that records the campaign or referral link you arrived from for up to 30 days. Both are first-party and cannot be read by scripts on the page.
For referral partners only, a sign-in cookie (bt_pp) that keeps a partner signed in to the partner portal for up to 14 days. It is first-party and cannot be read by scripts on the page.
A one-way, salted hash of your IP address, used to limit abuse. We do not store the IP address itself.
Analytics from PostHog: a first-party cookie (ph_…_posthog) that recognizes your browser on return visits for up to a year, the pages you view, the campaign you arrived from, what you click, and recordings of how you move through the site. Anything you type into a form is hidden from recordings and never sent to PostHog. The partner portal sends no analytics.
A bot check from Cloudflare Turnstile on forms.

How we use it

To produce your readiness result and, if you ask, email it to you
To follow up about your assessment or inquiry, if you agreed to that
To send guides and updates, only if you separately agreed to marketing email
To measure how the assessment performs, using coarse categories rather than your answers or contact details
To protect the website from abuse

[[TODO: counsel to state legal bases / notice-at-collection wording for applicable state laws]]

Who processes it for us

Vercel (website hosting)
PostHog (analytics and session recordings, hosted in the United States)
Supabase (database for assessment and inquiry records)
Resend (email delivery)
Cloudflare (bot checks)
The referral partner who sent you to the assessment, if any, as described under “Referral partners” above (a recipient, not a processor)
[[TODO: booking tool, e.g. Cal.com]] (scheduling, if you book a review)

We do not sell personal information. We do not share your assessment answers with AI companies.

How long we keep it

[[TODO: counsel to set retention periods for incomplete sessions, completed assessments, leads, and inquiries]]

Your choices

You can ask for a copy of what we hold about you, ask us to correct or delete it, or stop marketing email at any time. Use the privacy request form or email info@boxtrunk.com. We confirm your identity before acting on a request.

[[TODO: counsel to add jurisdiction-specific rights and response times]]

Security

Data is encrypted in transit and at rest. The database is reachable only by our server, and access is limited to the people who need it. Lead records are kept separate from any workspace used to prepare licensed data.

Children

This website is for businesses and is not directed to children.

Changes

We will update the date above when this policy changes.