Privacy Policy

The data controller for boxed.ink is Dev Engine, a French sole proprietorship operated by Alexandre Guillôme.

• Trading name: Dev Engine
• Legal representative: Alexandre Guillôme
• SIREN: 911 591 691
• SIRET: 911 591 691 00041
• VAT number: FR56911591691
• Contact email: contact@boxed.ink

For the email lists collected by creators' forms, the page's creator is responsible for their list and boxed.ink acts as a processor (see section 5).

If you create a boxed.ink account, we process:

• Account data: your email address, plus your name and profile picture provided by Google if you sign in with Google. If you sign in by email, we keep a single-use sign-in link for up to 24 hours.
• Page content: your handle, name, bio, location, images, texts, links and blocks.
• Connected accounts: if you connect Instagram or TikTok, an access token (stored encrypted) and your public profile information (username, followers, latest posts) to display your blocks. You can disconnect them at any time from the editor.
• Creator subscription: your Stripe customer ID, your plan and its end date. Your card details are entered into and stored by Stripe, never by us.
• Selling products (if you turn it on): your Stripe seller account ID and its status. The identity information required to sell (ID document, bank details, etc.) is sent directly to Stripe and stored by Stripe. We also store the files you sell and your sales history.
• Technical data: connection and usage logs needed to run and secure the Service.

When you visit a page published on boxed.ink, we measure that page's audience to give statistics to its creator. This measurement uses no cookies and builds no individual profile. We record:

• your country and city, derived from your IP address by our host at the time of the visit (the IP address itself is not stored);
• your device type, operating system, browser and language;
• the site you came from (for example Instagram);
• how long you stayed, how far you scrolled and which blocks you clicked.

The page's creator sees these statistics in aggregate form (totals, breakdowns). Legal basis: our legitimate interest, and the creator's, in measuring the page's audience.

Some pages show content loaded from other services: website logos (Google), maps (OpenStreetMap), thumbnails and images from embedded platforms (YouTube, Twitch, Kick, Spotify, Deezer, Instagram, TikTok). Your browser then contacts those services, which receive your IP address under their own policies.

Creators on the Creator plan can add forms to their page to collect email addresses (newsletter, waitlist, free download…). When you sign up, we store your email address, the signup date, the site you came from and an encrypted (hashed) fingerprint of your IP address, used only to limit abuse.

For these signups, the page's creator is the data controller: they decide to collect these addresses and what they do with them. boxed.ink hosts their list on their behalf, as a processor, and never uses these addresses for its own purposes. The only email we send to signups is the signup confirmation email the creator can turn on, sent on their behalf, with a one-click unsubscribe link.

To unsubscribe or exercise your rights over this data, contact the page's creator. You can also write to us at contact@boxed.ink: we will forward your request or remove your signup.

When you buy a product on a page, the payment is processed by Stripe, directly on the seller's account. We store your email address (provided by Stripe), the amount, the order status and your download link. The seller is responsible for the sale and their obligations towards you.

• To create and manage your account, and host and display your page (performance of contract).
• To provide statistics, email forms and, where applicable, product sales (performance of contract).
• To manage the Creator subscription, billing and our accounting obligations (performance of contract and legal obligation).
• To contact you about the Service, security or your support requests.
• To prevent fraud, spam and abuse, and keep the Service secure (legitimate interest).
• To measure and improve boxed.ink's performance (legitimate interest).

We don't sell your data. We rely on service providers that are strictly necessary to run boxed.ink:

• Google: sign in with Google, website logos.
• Resend: sending sign-in emails, purchase emails and form confirmation emails.
• Vercel: hosting, file storage (Vercel Blob), audience and performance measurement of boxed.ink (Vercel Analytics and Speed Insights, cookieless).
• MongoDB: database.
• Stripe: payments, subscriptions, seller accounts and product purchases.
• OpenStreetMap: maps and address lookup for your page's location.
• Meta (Instagram) and TikTok: connecting your account and fetching your public content, if you connect them.
• Twitch, Kick, YouTube, Spotify, Deezer: fetching the public content shown in your blocks.

Some of these providers process data outside the European Economic Area. Where this is the case, appropriate safeguards are in place (such as the European Commission's Standard Contractual Clauses). We may also disclose data if required by law or to protect our rights.

• Account and page content: as long as your account exists, then deleted within a reasonable period after it's deleted.
• Visit statistics: as long as the page exists; they're deleted with it.
• Email form signups: until the creator deletes them or deletes their page.
• Connected account tokens: until you disconnect the account or delete your boxed.ink account.
• Billing data: up to 10 years, for our accounting and tax obligations.

boxed.ink only uses cookies needed for it to work:

• a session cookie, to keep you signed in;
• a language cookie, to remember the language you chose;
• a temporary cookie (15 minutes) that remembers the handle you picked while signing up.

We don't use advertising cookies. Public page statistics and boxed.ink's audience measurement work without cookies. You can manage cookies in your browser; blocking necessary cookies may prevent you from signing in.

We apply reasonable technical and organisational measures to protect data: encrypted connections, access tokens stored encrypted, signup IP addresses hashed, statistics and lists only accessible to their creator. No method of transmission or storage is 100% secure.

You have the right to:

• access your data;
• rectify it;
• have it deleted, including your account;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw your consent where processing is based on it;
• lodge a complaint with your data protection authority (in France, the CNIL – www.cnil.fr).

You can delete your account at any time from the My account page: your page and your data are then deleted right away. To exercise your other rights, write to us at contact@boxed.ink. We reply within one month.

The Service is not directed at children under 16. If you believe a child under 16 has given us data, contact us so we can delete it.

boxed.ink pages contain links to other sites we don't operate. We're not responsible for their content or their data practices.

We may update this policy. Material changes will be announced in the Service or by email.

For any question about this policy or your data, contact Dev Engine / Alexandre Guillôme at contact@boxed.ink.