Legal
Processors and sub-processors
Version 1.1 · October 27, 2026
BoxTempo uses these service providers. Most of them process personal data for BoxTempo under a data processing agreement; each row says when that is not the case. Some of them also process the Member Data that BoxTempo processes for boxes (see the data processing agreement in the terms of service).
We tell customers at least 30 days before we add or replace a provider that processes Member Data, by email to the box owner and on this page. A box can object in that time. A provider with the status "Planned" does not process data yet.
Convex
- Company
Convex, Inc. (United States)
- What it does
Database and server functions of the BoxTempo app and of the early-access form.
- Personal data
The data of the service: accounts, profiles, Member Data and early-access requests.
- Where
European Union: AWS region eu-west-1 (Ireland). Convex staff and some of its own providers in the United States can get access, for example for support and monitoring.
- Agreement and transfers
Standard contractual clauses 2021/914 in the Convex data processing addendum. Convex is not certified under the EU-US Data Privacy Framework. Differences from Annex 1 of our terms: the addendum uses module 2 of the clauses (not module 3), it allows Convex to use de-identified data for its own purposes, and it limits audits.
- Status
In use.
Cloudflare
- Company
Cloudflare, Inc. (United States)
- What it does
Hosting of boxtempo.com and of the BoxTempo app (Workers), DNS, encryption, protection against attacks, forwarding of the emails to hello@boxtempo.com (Email Routing), and the bot check of the form (Turnstile).
- Personal data
The technical data of every request (IP address, browser, page), the content of requests and answers while Cloudflare delivers them, the emails to hello@boxtempo.com while Cloudflare forwards them, and the browser signals of Turnstile.
- Where
A global network: normally the data centre nearest to the visitor. Also the United States.
- Agreement and transfers
EU-US Data Privacy Framework (Cloudflare, Inc.) and standard contractual clauses 2021/914, in the Cloudflare data processing addendum. For Turnstile, Cloudflare also acts as an independent controller to improve the service (Turnstile privacy addendum).
- Status
In use.
Resend
- Company
Plus Five Five, Inc., trading as Resend (United States)
- What it does
Sending of emails: sign-in codes, invitations, membership emails and the notices of early-access requests.
- Personal data
The email address of the receiver, the subject and text of the email, and delivery records.
- Where
Sending from the EU region (Ireland). Resend stores account data, email metadata and logs in the United States.
- Agreement and transfers
EU-US Data Privacy Framework (Plus Five Five) and standard contractual clauses 2021/914, in the Resend data processing addendum.
- Status
In use.
Google (Gmail)
- Company
Google LLC (United States)
- What it does
The mailbox of the operator. The emails to hello@boxtempo.com and the notices of early-access requests arrive there.
- Personal data
The name, email address and message of the persons who write to us or ask for early access.
- Where
Google data centres in the EU and in other countries.
- Agreement and transfers
Personal Google account: Google LLC processes the data as an independent controller, under its own terms and privacy policy. Before the launch, we plan a business mailbox with a data processing agreement.
- Status
In use.
PostHog
- Company
PostHog Inc. (United States), EU Cloud
- What it does
Statistics of visits to boxtempo.com, in cookieless mode and without identifying visitors. Only on the website, never in the app of a box.
- Personal data
Pages, the website that a visitor comes from, the type of browser, device and screen, and a daily code that PostHog makes from the IP address and browser data. PostHog does not keep the IP address.
- Where
EU Cloud in Frankfurt (Germany). The PostHog agreement allows processing outside the EU, also in the United States.
- Agreement and transfers
EU-US Data Privacy Framework (PostHog Inc) and standard contractual clauses 2021/914, module 2, in the PostHog data processing agreement.
- Status
In use on the website.
Stripe
- Company
Stripe Payments Europe, Limited, with Stripe, LLC (United States)
- What it does
Payments of the subscriptions of boxes.
- Personal data
The name and email address of the payer, billing data, card or bank data, and payments. BoxTempo does not see full card numbers.
- Where
European Union and the United States.
- Agreement and transfers
EU-US Data Privacy Framework (Stripe, LLC) and standard contractual clauses 2021/914, in the Stripe data processing agreement and its data transfers addendum. Stripe is also an independent controller for some data, for example to prevent fraud.
- Status
Not used yet. Customers pay by the method that they agree with BoxTempo in writing. We tell customers 30 days before Stripe starts.
Sentry
- Company
Functional Software, Inc., trading as Sentry (United States)
- What it does
Error reports of the BoxTempo app, so we can correct errors.
- Personal data
The technical data of an error: page, browser, time and internal identifiers.
- Where
EU region in Frankfurt (Germany) for the error data. Sentry keeps user accounts and usage data in the United States.
- Agreement and transfers
EU-US Data Privacy Framework (Functional Software Inc.) and standard contractual clauses 2021/914, in the Sentry data processing addendum.
- Status
In use.
Browser push services
- Company
The company of your browser or device, for example Apple, Google, Mozilla or Microsoft
- What it does
Delivery of the push notifications of the app of a box, when you turn them on.
- Personal data
An address of your device for notifications, and the notification. The text is end-to-end encrypted, so the push service cannot read it. Your lock screen shows it.
- Where
The data centres of that company, also outside the EU.
- Agreement and transfers
Your browser chooses this service, and BoxTempo has no contract with it. The encryption protects the text of the notification.
- Status
In use in the app of a box.
Questions
Write to hello@boxtempo.com for a copy of an agreement or of the transfer safeguards.