Privacy Policy

1.1 Information You Provide

When you use our Service, you may provide us with:

• •Account Information: Name, email address, company name, job title, and other registration details
• •Customer Data: Any information, data, or input you make available to us for the purpose of providing the Service, including brand names, keywords, monitoring parameters, and business information
• •Google Account Data: Where you connect a Google account, the data described in Section 3 (Google User Data).
• •Payment Information: Billing details and payment card information (processed securely through third-party payment processors)
• •Communications: Information you provide when you contact us for support, provide feedback, or communicate with us

1.2 Automatically Collected Information

When you access our Service, we automatically collect:

• •Usage Data: Information about how you use the Service, including features accessed, queries made, and time spent on the platform
• •Device Information: IP address, browser type, operating system, device identifiers, and other technical information
• •Log Data: Server logs, error reports, and performance data
• •Cookies and Tracking Technologies: We use cookies and similar technologies to track activity and maintain session information

Legal Bases for Processing

Where the UK GDPR or the EU General Data Protection Regulation applies to our processing, we rely on the following legal bases:

Where we rely on legitimate interests, we have assessed that those interests are not overridden by your interests or fundamental rights. You have the right to object to that processing — see Section 8.

3.1 What Google User Data We Access

When you choose to connect a Google account to Whitebox, we request the following OAuth scopes and access the following data:

• •Google Search Console (read-only) — search performance data for the properties you select, including impressions, clicks, average position, and query and page-level metrics.
• •Google Analytics (read-only) — aggregated traffic and engagement metrics for the GA4 properties you select, including sessions, users, channel and source/medium data, and conversion events.

We only access Google user data after you explicitly grant permission through Google's OAuth consent screen, and only for the specific Google properties and accounts you select.

3.2 How We Use Google User Data

We use Google user data solely to provide and improve the user-facing features of the Service, specifically:

• •To display your organic search and website traffic performance inside the Whitebox dashboard;
• •To correlate that performance data with the AI-platform brand visibility data we collect, so we can show you how AI-driven referrals affect your traffic;
• •To generate the reports, insights, and recommendations you have asked the Service to produce;

3.3 Limited Use Disclosure

Whitebox's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, we do not:

• •Sell Google user data;
• •Transfer or use Google user data for advertising purposes of any kind, including serving, targeting, personalizing, retargeting, or measuring advertisements;
• •Transfer Google user data to data brokers, information resellers, or credit or lending decision-makers;
• •Use Google user data to build databases or profiles for purposes unrelated to the Service;
• •Use Google user data to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models.

Humans do not read your Google user data except (a) with your explicit prior consent for a specific purpose, such as a support request you have raised; (b) where necessary for security purposes, such as investigating abuse or a suspected security incident; or (c) where required to comply with applicable law.

4.1 Service Providers (Sub-processors)

We share information with a limited set of vendors who process data on our behalf, under written contracts that require them to protect the data, use it only on our instructions, and not use it for their own purposes. These fall into the following categories:

Google user data and AI providers. Where generating a requested insight requires it, aggregated metrics derived from your Google user data may be sent to our AI model provider(s) listed above solely to produce that output for you. These providers are contractually prohibited from retaining this data, using it to train their models, or using it for any purpose other than returning the requested output. Claude and Gemini models are accessed through Google Vertex AI, so Google — not Anthropic — is the sub-processor for that inference.

4.2 Within Your Organization

Data associated with your workspace, including data from Google accounts connected to that workspace, is accessible to other authorized users of your Whitebox account according to the permissions your administrator configures.

4.3 Legal and Safety Disclosures

We may disclose information where we believe in good faith that it is necessary to: comply with applicable law, regulation, legal process, or an enforceable governmental request; enforce our Terms of Use; detect, prevent, or address fraud, security, or technical issues; or protect the rights, property, or safety of Whitebox, our users, or the public. Where legally permitted, we will notify you before disclosing your data in response to such a request.

4.4 What We Do Not Do

We do not sell, rent, trade, store, or otherwise transfer your personal information or Google user data to third parties for advertising, marketing, data brokerage, or any other purpose beyond providing and improving the Service as described in this Privacy Policy.

6.1 Retention Periods

We retain personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Residual copies may persist in encrypted backups for up to 35 days after deletion from our production systems, after which they are overwritten on our standard backup rotation. Backups are not used to restore deleted accounts.

6.2 Revoking Google Access

You can disconnect a Google integration at any time from Settings→Connectors in the Whitebox dashboard. You may also revoke Whitebox's access directly through your Google Account at myaccount.google.com/permissions. When access is revoked, we stop accessing your Google user data immediately, delete the associated OAuth tokens, and delete the previously retrieved Google user data within 30 days.

6.3 Deleting Your Data

You may request deletion of your account and all associated personal information, including all user data, at any time by emailing office@thewhitebox.io. We will verify your request, complete the deletion within 7 days, and confirm to you in writing once it is complete, except where we are required by law to retain specific records (such as billing records).

We may retain anonymized or aggregated data that can no longer be associated with you or your organization, and which is never derived from Google user data.

7.1 Safeguards We Rely On

Where personal data is transferred out of the UK or the EEA, we make that transfer under an appropriate safeguard recognised by applicable data protection law:

• •Adequacy. Transfers to Israel are made in reliance on the European Commission's adequacy decision for Israel, and on the corresponding UK adequacy regulations.
• •Standard Contractual Clauses. Transfers to sub-processors in countries without an adequacy decision, including transfers to the United States, are made under the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum where the UK GDPR applies.
• •Transfer risk assessment. Before engaging a sub-processor outside the UK or EEA, we assess the laws and practices of the destination country and the supplementary measures needed to protect the transferred data.
• •Supplementary technical measures. Data in transit is encrypted using TLS 1.2 or higher and data at rest is encrypted using AES-256 or equivalent, as described in Section 5.

7.2 Requesting a Copy

You may request a copy of the safeguards we rely on for a particular transfer by emailing office@thewhitebox.io. We may redact commercially confidential terms before providing it.

8.1 How to Exercise Your Rights

To exercise any of these rights, email office@thewhitebox.io. We may ask you for information to verify your identity before we act. Exercising your rights is free of charge, and we will respond within one month of receiving your request. If your request is complex, or if you have made several requests, we may extend that period by up to two further months and will tell you within the first month if we do.

8.2 Where We Act on Behalf of a Customer

For Customer Data — information our business customers submit to the Service, and data collected through the Whitebox Pixel on their websites — Whitebox acts as a processor and the customer is the controller. If you are a visitor to one of our customers' websites and wish to exercise your rights in relation to that data, please contact that organisation directly. If you contact us instead, we will refer your request to the relevant customer without undue delay and support them in responding to it.

8.3 Right to Complain

If you are unhappy with how we have handled your personal information, we would like the chance to put it right, so please contact us first. You also have the right to lodge a complaint with a data protection supervisory authority — in the EEA, the authority in the country where you live, work, or where the issue arose; in the United Kingdom, the Information Commissioner's Office; and in Israel, the Privacy Protection Authority. Contacting us first does not affect that right.

9.1 Categories We Use

9.2 A Note on Visitor Identification

You should be aware of what the visitor identification tools above do. They attempt to resolve your visit to our website — using your IP address, device signals, and the vendor's own data — to an identified company and, in some cases, to an identified individual, including a name, job title, professional email address, or social profile. That is processing of your personal information. We use it only to understand commercial interest in Whitebox and to contact prospective business customers. We do not use it to build profiles for advertising, and we do not sell it. These tools run only if you accept the "Visitor identification" category, and you can withdraw that consent at any time.

9.3 Managing Your Choices

We ask for your consent through a banner the first time you visit, and we set no analytics or visitor identification cookies before you give it. You can change or withdraw your choice at any time:

• •Reopen your preferences using the cookie settings control, available here and in the website footer.
• •Block or delete cookies through your browser settings. Blocking strictly necessary cookies may stop parts of the website working.
• •Opt out of Google Analytics across all websites using Google's browser opt-out add-on.
• •Send a Global Privacy Control or "Do Not Track" signal from your browser. We treat a Global Privacy Control signal as a withdrawal of consent to the analytics and visitor identification categories.