Whitebox
Privacy Policy
Last Updated: July 2026
Welcome to Whitebox, a Generative Artificial Intelligence (GenAI) based brand monitoring service (the "Service"). The Service was developed and is owned and operated by Whitebox Ltd. ("Company" or "we", "us", "our"). This Privacy Policy describes how we collect, use, process, and disclose your information when you use our Service. By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy.
1. Information We Collect
1.1 Information You Provide
When you use our Service, you may provide us with:
- •Account Information: Name, email address, company name, job title, and other registration details
- •Customer Data: Any information, data, or input you make available to us for the purpose of providing the Service, including brand names, keywords, monitoring parameters, and business information
- •Google Account Data: Where you connect a Google account, the data described in Section 3 (Google User Data).
- •Payment Information: Billing details and payment card information (processed securely through third-party payment processors)
- •Communications: Information you provide when you contact us for support, provide feedback, or communicate with us
1.2 Automatically Collected Information
When you access our Service, we automatically collect:
- •Usage Data: Information about how you use the Service, including features accessed, queries made, and time spent on the platform
- •Device Information: IP address, browser type, operating system, device identifiers, and other technical information
- •Log Data: Server logs, error reports, and performance data
- •Cookies and Tracking Technologies: We use cookies and similar technologies to track activity and maintain session information
1.3 Third-Party Data
We may collect publicly available information about your organization from third-party sources, including AI platforms, search engines, and public databases, to provide and improve our Service.
2. How We Use Your Information
We use the information we collect for the following purposes:
- •Service Provision: To provide, maintain, and improve the Service, including monitoring AI platforms and generating insights and analytics
- •Account Management: To create and manage your account, process subscriptions, and handle billing
- •Communications: To send you service-related notifications, updates, security alerts, and support messages
- •Personalization: To customize your experience and provide relevant insights based on your monitoring parameters
- •Analytics and Improvement: To analyze usage patterns, improve our algorithms, and enhance Service functionality
- •Security: To detect, prevent, and address technical issues, fraud, and security vulnerabilities
- •Legal Compliance: To comply with legal obligations and enforce our Terms of Use
- •Marketing: With your consent, to send promotional communications about new features, products, and events (you may opt out at any time)
Important Note on AI Training
We do not use your Customer Data to train the artificial intelligence models utilized by our Service. We never use Google user data to develop, improve, or train generalized or non-personalized AI or machine learning models. We may use publicly available information collected from public web sources — never data obtained through Google APIs and never data from your account — to improve our models.
3. Google User Data
This section applies specifically to data we access from your Google Account through Google APIs ("Google user data"). It supplements, and where there is any conflict, overrides the rest of this Privacy Policy.
3.1 What Google User Data We Access
When you choose to connect a Google account to Whitebox, we request the following OAuth scopes and access the following data:
- •Google Search Console (read-only) — search performance data for the properties you select, including impressions, clicks, average position, and query and page-level metrics.
- •Google Analytics (read-only) — aggregated traffic and engagement metrics for the GA4 properties you select, including sessions, users, channel and source/medium data, and conversion events.
We only access Google user data after you explicitly grant permission through Google's OAuth consent screen, and only for the specific Google properties and accounts you select.
3.2 How We Use Google User Data
We use Google user data solely to provide and improve the user-facing features of the Service, specifically:
- •To display your organic search and website traffic performance inside the Whitebox dashboard;
- •To correlate that performance data with the AI-platform brand visibility data we collect, so we can show you how AI-driven referrals affect your traffic;
- •To generate the reports, insights, and recommendations you have asked the Service to produce;
3.3 Limited Use Disclosure
Whitebox's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular, we do not:
- •Sell Google user data;
- •Transfer or use Google user data for advertising purposes of any kind, including serving, targeting, personalizing, retargeting, or measuring advertisements;
- •Transfer Google user data to data brokers, information resellers, or credit or lending decision-makers;
- •Use Google user data to build databases or profiles for purposes unrelated to the Service;
- •Use Google user data to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models.
Humans do not read your Google user data except (a) with your explicit prior consent for a specific purpose, such as a support request you have raised; (b) where necessary for security purposes, such as investigating abuse or a suspected security incident; or (c) where required to comply with applicable law.
4. How We Share, Transfer, and Disclose Information
We do not store your personal information or your Google user data. We do not sell your personal information or your Google user data, and we do not transfer or disclose it to third parties for any purpose other than those described below.
4.1 Service Providers (Sub-processors)
We share information with a limited set of vendors who process data on our behalf, under written contracts that require them to protect the data, use it only on our instructions, and not use it for their own purposes. These fall into the following categories:
| Category | Purpose | Provider(s) |
|---|---|---|
| Cloud hosting and infrastructure | Hosting the Service, storing account and Customer Data | Google Cloud Platform |
| AI model providers | Generating the insights and summaries you request | Google, OpenAI, Claude |
Google user data and AI providers. Where generating a requested insight requires it, aggregated metrics derived from your Google user data may be sent to our AI model provider(s) listed above solely to produce that output for you. These providers are contractually prohibited from retaining this data, using it to train their models, or using it for any purpose other than returning the requested output.
4.2 Within Your Organization
Data associated with your workspace, including data from Google accounts connected to that workspace, is accessible to other authorized users of your Whitebox account according to the permissions your administrator configures.
4.3 Legal and Safety Disclosures
We may disclose information where we believe in good faith that it is necessary to: comply with applicable law, regulation, legal process, or an enforceable governmental request; enforce our Terms of Use; detect, prevent, or address fraud, security, or technical issues; or protect the rights, property, or safety of Whitebox, our users, or the public. Where legally permitted, we will notify you before disclosing your data in response to such a request.
4.4 What We Do Not Do
We do not sell, rent, trade, store, or otherwise transfer your personal information or Google user data to third parties for advertising, marketing, data brokerage, or any other purpose beyond providing and improving the Service as described in this Privacy Policy.
5. How We Protect Your Data
We maintain administrative, technical, and physical safeguards designed to protect your information, including Google user data, against unauthorized access, disclosure, alteration, and destruction. These measures include:
- •Encryption in transit. All data transmitted between you, the Service, and Google APIs is encrypted using TLS 1.2 or higher.
- •Encryption at rest. Stored data, including OAuth tokens and refresh tokens, is encrypted at rest using AES-256 or equivalent.
- •Credential handling. Google OAuth access and refresh tokens are stored encrypted in a dedicated secrets store in Google Secret Manager, are never written to application logs, and are never exposed to client-side code or to other customers.
- •Access controls. Access to production systems and to customer data is restricted to authorized personnel on a least-privilege, need-to-know basis, requires multi-factor authentication, and is reviewed annually.
- •Tenant isolation. Customer data is logically segregated so that one customer's data, including their Google user data, cannot be accessed by another customer.
- •Monitoring and logging. We log access to production systems and monitor for anomalous activity and unauthorized access attempts.
- •Secure development. We apply code review, dependency scanning, and vulnerability scanning to our development lifecycle.
- •Vendor diligence. We assess the security practices of sub-processors before granting them access to any data and bind them by contract to comparable protections.
- •Incident response. We maintain an incident response process and will notify affected users and, where required, the relevant supervisory authority of a personal data breach without undue delay and in accordance with applicable law.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at office@thewhitebox.io.
6. Data Retention and Deletion
6.1 Retention Periods
We retain personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.
| Data | Retention |
|---|---|
| Account information | For the life of your account, then deleted within 90 days of account closure |
| Google OAuth tokens | Until you disconnect the integration, revoke access via your Google Account, or close your account — deleted immediately upon any of these events |
| Customer Data (brands, keywords, monitoring parameters) | For the life of your account, then deleted within 90 days of account closure |
| Billing and transaction records | Retained for 7 years as required by applicable tax and accounting law |
| Server and security logs | 90 days |
Residual copies may persist in encrypted backups for up to 35 days after deletion from our production systems, after which they are overwritten on our standard backup rotation. Backups are not used to restore deleted accounts.
6.2 Revoking Google Access
You can disconnect a Google integration at any time from Settings→Connectors in the Whitebox dashboard. You may also revoke Whitebox's access directly through your Google Account at myaccount.google.com/permissions. When access is revoked, we stop accessing your Google user data immediately, delete the associated OAuth tokens, and delete the previously retrieved Google user data within 30 days.
6.3 Deleting Your Data
You may request deletion of your account and all associated personal information, including all user data, at any time by emailing office@thewhitebox.io. We will verify your request, complete the deletion within 7 days, and confirm to you in writing once it is complete, except where we are required by law to retain specific records (such as billing records).
We may retain anonymized or aggregated data that can no longer be associated with you or your organization, and which is never derived from Google user data.
7. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
We will respond to your inquiry within a reasonable timeframe in accordance with applicable data protection laws.