Privacy Policy

Unbox AI AB (Stockholm, Sweden; “Unbox”, “we”) makes BehaviorGPT, a model that ranks items for people from what they did. This policy covers the portal, the APIs, the SDKs, the widgets and tracking script, the apps and the MCP server.

We hold personal data in two roles:

• As controller, for the people who sign in to the portal or use an API key: we decide what is kept and why. Sections 2 to 4 describe this.
• As processor, for our customers' users, whose searches, views and orders a customer records with the Services. The customer decides, their own privacy policy applies, and our Data Processing Agreement with them governs what we do. Section 5 describes this.

• Account: your email address, the company name if you give one, the accounts you are a member of and your role, and where your first visit came from (a referral link or landing page).
• Sign-in: sign-in links we email you, your sessions with when they were last used and your browser's user agent, and your IP address, used to limit requests and stop abuse.
• Use: the requests your account and keys make (which route, when, how long it took), kept to show your usage, run limits and fix problems.
• What you put in: catalogs, files, links you import from, event streams, keys' sites and apps, share links, and your conversations with the portal's assistant.
• Messages: what you send us by email or in requests for early access.

• to run the Services: sign you in, keep your account, rank and show your catalogs, answer your requests;
• to keep them secure: rate limits, abuse detection, and investigating incidents;
• to email you sign-in links, invitations, and notices about your account or these policies;
• to develop and improve our services, including our models, and to create aggregated or anonymized data;
• to meet the law and enforce our Terms.

We do not sell personal data.

Under the GDPR, we rely on performing our contract with you (running your account), our legitimate interests (security, improving the Services, telling you about changes), and legal obligations.

The portal sets one cookie, which keeps you signed in. It also keeps a few things in your browser's local storage: the catalog you chose, where your first visit came from until you sign up, and similar settings. We use no analytics or advertising cookies in the portal.

The tracking script that customers put on their sites sets a first-party cookie, unbox_uid, on the customer's site, holding a random id for the visitor. The customer decides whether it waits for the visitor's consent; see section 5.

A customer can record what their users do: searches, views and orders, the items involved and their pages, the time and the browser's time zone, and a user id. With the tracking script that id is the random unbox_uid; otherwise it is the customer's own. A customer may also send a user's market, gender and age group. Our Terms ask customers not to send names, email addresses or other direct identifiers.

We use it to provide the Services to that customer, and to develop and improve our services, including our models. The customer can delete an event stream, with every event in it, at any time. Our Data Processing Agreement sets out the details.

If you are one of a customer's users, please contact that customer to exercise your rights; we will help them answer.

We share personal data only with service providers that process it for us, under contract:

• Microsoft Azure: hosting, databases and storage (North Europe region), and sending email.
• Anthropic: runs Claude for the portal's assistant and the apps built on it, such as the shopping assistant and gift finder. It receives what you ask and the items the answer needs.

We may also disclose data when the law requires it, to protect people or the Services, or to a successor in a merger or sale, which would remain bound by this policy. What you share by share link or embed is visible to anyone who has the link.

Data is kept in the European Union (Azure North Europe). Where a provider processes it elsewhere, such as in the United States, we rely on an adequacy decision, such as the EU-US Data Privacy Framework, or the EU Standard Contractual Clauses.

We keep account data while your account is open. A session ends 30 days after you sign in, or when you sign out. Catalogs and event streams are kept until you delete them or close your account. When an account closes, we delete its data, apart from what the law requires us to keep (such as accounting records) and backups, which are overwritten in their normal cycle. Request logs are kept only as long as we need them to run limits and investigate problems.

We protect data with appropriate technical and organizational measures. No system is perfectly secure: keep your keys secret, and tell us at admin@unboxai.com if you think one has leaked or you find a vulnerability.

Depending on where you live, you may ask to access, correct, delete or export your personal data, to restrict or object to how we use it, and to withdraw consent. Write to admin@unboxai.com; we answer within one month. You can delete your catalogs and event streams yourself in the portal, and we close accounts on request.

You may also complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se) or the authority where you live.

The Services are for businesses and are not directed at children. If we learn we hold a child's data as controller, we delete it.

We will post changes here and, if they are material, tell account holders by email before they apply. Questions or requests: admin@unboxai.com.