Last updated: 24 August 2026
This policy explains what personal data BoxPilot collects, why, and the rights you have over it. BoxPilot is a product of Rightbox Ltd, and we are the "data controller" for the information described here.
Who we are
Rightbox Ltd (trading as BoxPilot), a company registered in England and Wales, company number 12645057. Registered office: Creative Industries Centre, Glaisher Drive, University of Wolverhampton Science Park, Wolverhampton, West Midlands, England, WV10 9TG.
For anything to do with your data, contact us at hello@boxpilot.co.uk.
The data we collect
Account information
When you create a workspace, we collect your name, work email address, company name and a password (stored encrypted). If you invite colleagues, we hold the same for them.
Your workspace data
BoxPilot stores the procurement information you enter or import, such as packaging specifications, supplier records, prices, purchase orders and files. This is your business data. It may contain personal data where you include named contacts (for example, a supplier contact name and email). You control this data and can export or delete it at any time.
Technical and usage information
Like any web service, our systems record basic technical data such as IP address, browser type and log records, which we use to keep the service secure and working.
Cookies
We use only strictly necessary cookies, for example to keep you logged in. We do not use advertising or tracking cookies, so no cookie-consent banner is required. If we later add privacy-friendly, cookieless analytics, we will update this policy.
Why we use it, and our lawful basis
- To provide the service (create your account, run your workspace, send service emails). Lawful basis: performance of our contract with you.
- To keep BoxPilot secure and improve it. Lawful basis: our legitimate interests in running a safe, reliable service.
- To reply to you when you contact us. Lawful basis: legitimate interests, or contract.
- To send you marketing, only where you have asked us to. Lawful basis: consent, which you can withdraw at any time.
Who we share it with
We do not sell your data. We use a small number of trusted service providers ("sub-processors") to run BoxPilot, who process data only on our instructions:
- Vercel — website and application hosting.
- Neon — database (where your workspace data is stored).
- Vercel Blob — storage for files you upload.
- Resend — sending our transactional and service emails.
We may also share data where required by law, or to protect our rights.
International transfers
Some of our providers may store or process data outside the UK. Where they do, we rely on appropriate safeguards recognised under UK data-protection law (such as UK adequacy regulations or standard contractual clauses). [To confirm: the exact hosting regions for Vercel and Neon, so this section can state them precisely.]
How long we keep it
We keep your account and workspace data for as long as your account is active, and for a reasonable period afterwards so you can reactivate or export it. You can delete your data, or ask us to, at any time. We may keep limited records where the law requires it.
Your rights
Under UK data-protection law you have the right to access, correct, delete, restrict or object to our use of your personal data, and to receive a copy in a portable format. To exercise any of these, email hello@boxpilot.co.uk. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk, though we would appreciate the chance to put things right first.
[To add once registered: our ICO registration number.]
Security
We take reasonable technical and organisational measures to protect your data, including encryption in transit, access controls and reputable hosting providers. No system is perfectly secure, but we work to keep your information safe.
Changes to this policy
We may update this policy from time to time. If we make a significant change, we will let you know. The date at the top shows when it was last updated.
Contact
Questions about this policy or your data? Email hello@boxpilot.co.uk.