Security & data protection

Last updated: October 9, 2026

This is a courtesy translation. The Spanish version is the one that legally applies; switch to Español at the top to read it.

At Boxinger we protect each customer’s data and that of their users with strict isolation, encryption and data minimization, under Argentine Law 25,326 on the Protection of Personal Data and with an approach aligned to the GDPR standard. This page summarizes how we do it. For enterprise customers we also offer a signable Data Processing Agreement (DPA).

1. Isolation between customers

Each customer can access only their own data. Isolation does not depend on the application code: it is enforced in the database with PostgreSQL Row Level Security, which filters every query by the authenticated user before returning a single record. In practice, a user of one customer can never see another customer’s ideas, votes, comments or members, even if they try to manipulate the application from their browser.

2. Encryption

• In transit: all traffic travels over HTTPS/TLS. HTTP access is automatically redirected to HTTPS and HSTS is applied (forced secure connection).
• At rest: data is stored encrypted on Supabase’s infrastructure (on AWS).
• Passwords: stored hashed; we cannot see or recover them.

3. Use of data

We do not sell or rent data, we do not run third-party advertising and we do not build commercial profiles. We only process data to provide the contracted service and according to the user’s consent. We use no advertising cookies. Only on the public pages, and if the visitor accepts the cookie notice, we use Microsoft Clarity for browsing statistics; never inside the app, where boards and ideas live.

4. AI assistant and your data

The AI assistant is available only on the Team and Enterprise plans and is used when the team chooses to enable it. When used, only the board’s idea text, its description and vote and comment counts are sent to the model provider (Anthropic), with no names or emails of users. Anthropic does not use this data to train its models. If the assistant is not enabled, nothing is sent to the AI.

5. Data minimization

We collect only what the service needs to work. In particular, we do not store users’ IP addresses: from public forms we keep only an encrypted identifier of the connection, used to prevent abuse. Card details never reach Boxinger: they are processed directly by the payment gateways (Creem or Mercado Pago).

6. Data subject rights and deletion

• Access and rectification: users can view and correct their account and profile data from My profile.
• Deletion: ideas, teams and accounts can be deleted, along with their associated data.
• Traceability: administrative actions are kept in an audit log (who did what and when).

7. Providers (sub-processors)

To operate the service we share the necessary data with these providers, which process it on our behalf and with appropriate security measures:

• Supabase: database, authentication and files, with servers in the United States.
• Hostinger: web hosting and email delivery.
• Anthropic: AI assistant (Team and Enterprise only; idea text with no personal data).
• Creem and Mercado Pago: payment processing. Creem acts as reseller for payments in US dollars.
• Microsoft Clarity: usage statistics for the public pages (not the app).

We notify Enterprise customers of any change of sub-processors. The current list is part of the DPA.

8. Legal framework, residency and contact

• Legal framework: we comply with Argentine Law 25,326 on the Protection of Personal Data, with an approach aligned to the GDPR standard. We publish a Privacy Policy and Terms.
• Data residency: data is hosted primarily in the United States (Supabase/AWS). If your organization requires a specific region, contact us.
• Incidents: in the event of an incident affecting personal data, we notify the affected customers.
• DPA and contact: we offer a signable Data Processing Agreement for Enterprise customers. To request it or for privacy inquiries, write to hola@boxinger.com.

Informational page, not contractual. The data processing relationship with each customer is governed by the DPA signed between the parties.