Privacy Policy

1. Who we are

The data controller is Product Enrichment LTD, a company registered in England and Wales, trading as ProductBox (company number 17369400). We process personal data in accordance with the UK GDPR and the Data Protection Act 2018, and we are registered with the Information Commissioner's Office.

• Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
• ICO registration number: ZC219736
• Email: support@productbox.net

2. What we collect

• Account data — your email address, password (stored as a salted hash) and account settings.
• Sign-in data — if you sign in with Google, the name and email address the provider shares with us. We never receive your password for those services.
• Uploaded lists — the product files you upload, stored so your jobs can run and so you can re-export results.
• Billing data — credit purchases and usage on your account. Card payments are handled by our payment processor (Stripe); we never see or store card numbers.
• Usage data — standard server logs (IP address, timestamps, requests) kept for security and debugging.
• Site statistics — our own first-party page-view analytics: a random identifier stored in your browser (localStorage), the pages you view, the referring page, your browser type and your country (derived from your IP address; the IP itself is not stored with the visit). Views are linked to your account while you are signed in.
• Advertising measurement — if you accept cookies, we use Google Ads conversion tracking to measure which advertisements lead to sign-ups. This sets Google cookies and shares a click identifier and conversion event with Google. Where you arrived from one of our advertisements, that identifier is stored with your account until the sign-up is reported to Google or the 90-day attribution window closes, whichever comes first. It is off by default and runs only after you accept; you can decline and the site works normally. We use no other third-party analytics and no cross-site advertising profiling.

3. How we use it

Solely to provide and improve the Service: running your enrichment jobs, maintaining your product library, billing, support, transactional email (verification, password reset, job completion, purchase receipts) and understanding how the site is used (the first-party statistics above). We never sell or rent your lists or your personal data, and we do not share them with third parties for marketing — the one exception is the advertising measurement described in section 2, which reports your sign-up to Google if you accepted cookies and arrived from one of our advertisements.

Our legal bases. We process your account data, uploaded lists and enrichment results to perform our contract with you — without them there is no service to provide. We keep security and sign-in logs, and our own first-party site statistics, under our legitimate interest in keeping the Service secure and understanding how it is used; you can object to this at any time using the contact details below. Advertising measurement and any marketing email run on your consent, which you can withdraw at any time without affecting the Service. We keep the records we are required to keep to comply with a legal obligation.

4. Where processing happens

Enrichment queries public product information (manufacturer pages, retailers, product databases). Product names from your list — never your identity, prices or internal codes beyond what is needed to match a product — are used in these lookups. Translation and text generation use third-party AI providers under data-processing terms that prohibit training on your data.

Some of our processors (hosting, AI, payment and email-delivery providers) operate outside the UK. Where personal data leaves the UK we rely on adequacy regulations or the UK International Data Transfer Agreement / Addendum with those providers.

We publish the full list at productbox.net/subprocessors, showing which services handle your account data and which receive product data only.

5. Retention and deletion

• Your uploaded file is trimmed to the columns you selected during import; the original is discarded straight away and never stored. The trimmed file is kept while the catalogue exists, and is deleted with it.
• Catalogues you can delete yourself at any time from your catalogue list. Deleting one removes its file and its per-row processing records.
• Your product library keeps the products you accepted, so deleting a catalogue never costs you results you have already paid for. The library is removed when you close your account.
• Export files are deleted 24 hours after they are built. You can re-export from your library at any time.
• Security and sign-in logs (IP address, timestamps, requests) are kept for 12 months and then deleted automatically.
• Payment records. Stripe is the merchant of record for your purchases and keeps the transaction records and invoices it is required to keep; you can reach them through Stripe. Our own copy of your credit balance and purchase history is deleted with your account.
• Closing your account erases your files, catalogues, library, support history and account data immediately. Go to Settings and confirm with your email address, or write to us and we will do it for you. There is no waiting period.

What stays. Verified product information — names, brands, barcodes, categories, specifications and images — remains in our shared product database. This is how a product that has been enriched once does not have to be enriched again, and it is why enrichment is priced the way it is. It describes publicly available products rather than you, and once your account is deleted nothing in it links back to you. The same applies when you delete a single catalogue: the products you accepted from it stay in that shared database, while the catalogue, its file and its processing records are removed.

6. Your rights

Under the UK GDPR you may request access, correction, export or deletion of your personal data, and you may object to or restrict processing. Write to support@productbox.net and we will respond within 30 days. You may also lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or, if you are in the EU, with your local supervisory authority.

7. Cookies and local storage

We use a session cookie to keep you logged in and, during social sign-in, a short-lived cookie that protects the sign-in flow against forgery. These are strictly necessary and are set without consent.

Our own site statistics use a random identifier kept in your browser's localStorage (see section 2), not a cookie.

If you accept cookies in our banner, Google Ads conversion cookies are set to measure advertising performance, and an advertising click identifier is stored in your browser. Nothing is set before you accept, and you can change your mind by clearing your browser storage for this site.

8. Changes

If this policy changes materially we will notify you by email or in the app before the change takes effect.