Privacy Policy — Teambox

Teambox (“Teambox”, “we”, “us”) operates the website teambox.app and the WhatsApp CRM platform at app.teambox.app. This policy explains what information we collect, how we use it, and the choices you have.

1. Who we serve

Our customers are businesses (“Customer”) that use Teambox to communicate with their own end-users (“End-User”) over WhatsApp and other channels. We act as a data processor on behalf of the Customer for the End-User data they bring to the platform.

2. Information we collect

2.1 Account information

When you create a Teambox account we collect your name, email, organisation, and authentication identifiers from your sign-in provider (e.g. Google or email/password).

2.2 WhatsApp Business data

When you connect a WhatsApp Business number, we receive and store the messages, media, contact phone numbers, and profile names that Meta delivers to our webhook. This information is used only to operate your inbox and the AI agent you have configured.

2.3 Google Calendar data (optional integration)

If you connect Google Calendar, we access:

calendar.readonly — to check the busy/free periods of your primary calendar so the AI agent can offer real available slots to your customers.
calendar.events — to create the confirmed appointment as a calendar event after your customer accepts a time.

We store only the OAuth refresh token, your account email, and your calendar timezone. We do not read, store, or display the contents, titles, or attendees of your existing calendar events. Calendar access can be revoked at any time from your Google account permissions or from the Integrations tab in Teambox.

Teambox's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

2.4 Usage data

We log basic technical information — IP address, browser type, page views, and timestamps — to operate, secure, and improve the service.

3. How we use information

To provide the Teambox inbox, AI agent, and integrations you have configured.
To authenticate users, prevent abuse, and secure the platform.
To communicate with you about your account, service updates, and support.
To comply with legal obligations.

We do not sell your data, your End-Users' data, or your Google data, and we do not use it to train third-party AI models for advertising.

4. AI processing

When the AI agent is enabled, the contents of relevant messages and the configured knowledge base are sent to a Large Language Model provider (currently OpenAI) solely to generate the next response. We have agreements with our LLM provider prohibiting the use of this data to train their general models.

5. Sharing

We share information only with the service providers we rely on to run Teambox, under contracts that require them to protect your data:

Hosting and infrastructure: Vercel, Supabase
Messaging: Meta (WhatsApp Business API)
AI model provider: OpenAI
Optional integrations you enable: Google, and others you connect

6. Data retention

We retain account and conversation data for as long as your Teambox account is active. You may export or delete your data at any time by contacting . On account closure, data is deleted within 30 days, except where retention is required by law.

7. Security

Data is encrypted in transit (TLS) and at rest. OAuth refresh tokens are stored encrypted. Access is restricted to a small number of engineers who require it to operate the service.

8. Your rights

Depending on your jurisdiction, you may have rights to access, correct, export, or delete your personal data, and to object to certain processing. To exercise these rights, email .

9. International transfers

Teambox processes data on infrastructure located in regions including the European Union and the United States. By using Teambox you consent to your data being processed in these locations under appropriate safeguards.

10. Children

Teambox is intended for use by businesses and is not directed to children under 16. We do not knowingly collect personal data from children.

11. Changes

We may update this policy. We will post the new version here with a revised “Last updated” date. Significant changes will be announced via email or in-app notice.

12. Contact

Questions about this policy or your data? Reach us at: