Privacy, with clear boundaries.

LionBox is developed and supplied by FASTAPP DEVELOPMENT SRL, a Romanian company serving teams in Europe and worldwide. In this notice, “we” means FASTAPP DEVELOPMENT SRL, which operates the LionBox website and provides your LionBox purchase or service. We are responsible for the personal data we collect for those purposes.

Company

FASTAPP DEVELOPMENT SRL · Romania

Tax identification number (CUI)

45042871

Trade Register number

J2021017436404

European unique identifier (EUID)

ROONRC.J2021017436404

Incorporated

12 October 2021

Registered office & contact address

Economu Cezarescu 44, Sector 6, 060754 Bucharest, Romania

General & privacy email

hello@lionbox.ai

Customer & order support

support@lionbox.ai

VAT number

RO45042871

Email hello@lionbox.ai with the subject “Privacy request” for questions about this notice or to exercise your rights. For help with an order, write to support@lionbox.ai. The legal seller’s details are also provided before a binding purchase and in your order documents.

This notice covers visits to our website, enquiries, launch updates, your LionBox account on the website and in the LionBox app, LionBox Cloud, the emails we send, customer administration, orders and support. It does not give us access to the documents and conversations you process on a LionBox appliance.

Normal AI inference and indexed knowledge run inside your office network. The website’s analytics do not measure employee prompts or appliance conversations. Your organisation controls the content it adds to LionBox and is responsible for its own lawful use, permissions and retention.

Administrator accounts, box management and software downloads are explained in The LionBox app and your boxes. See also our security architecture. If you request troubleshooting, share only the information needed; do not send confidential prompts, passwords, encryption keys or full document collections.

The LionBox app uses the same LionBox account as this website. You can sign in with an email address and password, with Google or with Sign in with Apple. With Apple, we receive the name and email address Apple shares, which can be a private relay address, and keep a token only so we can revoke the connection when you delete your account. If you enter your organisation’s name when you register, we keep it with your account.

To link and manage your boxes, LionBox Cloud keeps the serial numbers of the boxes you claim and when you claimed or released them, the box’s license and LionBox+ status, and the box’s security fingerprint. Each time the app downloads an update, model or certificate for your box, we record it with your account, IP address and app details. After an update, the app reports the software versions and whether the installation succeeded. When the app gets a pass to talk to your box, our security log records your email address, an identifier for that app installation and the phone’s public key. Requests from the app include its version and platform.

The app talks to your box directly on your office network or over Bluetooth. Box health, users, chats and documents, the Wi-Fi password you send to the box and pairing codes stay between your phone and the box; they are not sent to LionBox Cloud. The app uses the camera only to scan the QR code on the box, and sends the serial number and claim code from it to us to link the box. The app contains no analytics, advertising or crash-reporting tools and does not track you. App updates are downloaded from Expo’s servers, which see your phone’s IP address as any download server does.

You can delete your account in the app’s Settings. We then release your boxes, replace your profile with a deleted-account marker, clear IP addresses from your download records, remove your name from our security log, revoke Sign in with Apple and delete your login. We keep orders, invoices and subscriptions as the law and your contracts require, and a box’s technical history stays linked only to the internal identifier of the deleted account. You can also ask us for a copy of your account data.

• Enquiries: your name, email, company, team-size range, message and correspondence you choose to send. When you submit the contact form, we send your enquiry to our team inbox by email through our email provider, so we can reply to you; it is not stored in a website database.
• Launch updates: the email address you enter in the launch-updates form, when you signed up and where your visits came from. See Emails we send and email tracking.
• Accounts: your email address, password credentials managed by our authentication provider or, if you continue with Google, the name, email address and profile picture Google shares with us (never your Google password), sign-in records and, if you choose, your marketing-email consent with the time it was given or withdrawn. When you order without signing in, we create an account for the email address you give so you can see your order and invoice; it has no password until you set one from the link in our order email.
• Email communications: the emails we send you and you send us, delivery status, bounces and spam complaints, and whether an email was opened or a link in it was clicked. See Emails we send and email tracking.
• Customer and order administration: contact details, account information, billing and delivery addresses, company and tax details, purchased items, order status and communications, when you use those services.
• How you found us: with an order, enquiry or launch-updates signup, how you heard about LionBox or where your visits came from. See How you found us.
• Box management: claimed boxes, licenses, downloads and update results from the LionBox app. See The LionBox app and your boxes.
• Withdrawals: when you use Withdraw from contract, your name, email address, order number, what you are withdrawing from, any details you add and the time we received it. We email this to our support inbox and send you a confirmation. If you are signed in, we also note your account email and whether the order is in your account.
• Payments: payment status and transaction references needed to reconcile an order. Card details are entered on the payment provider’s service, rather than in our website analytics.
• Technical information: IP address, browser and device information, request and security logs processed by our hosting services to deliver and protect the website. Our hosting provider derives an approximate country from your IP address. We use it only to pre-select the country at checkout, which you can change, and to show the cookie choices that apply where you are. It is not stored with your account or order and does not set your price; VAT and delivery follow the address you enter.
• Optional analytics: consented visits, campaign labels, approximate location, device category, public-page interactions and loading performance. We filter measurement URLs and exclude form contents, authentication tokens, account identifiers and order numbers. With Microsoft Clarity, after you allow analytics yourself, a recording of how you use our public pages (pages viewed, clicks, mouse movement and scrolling), with text you type hidden; it never runs on checkout, account, sign-in or withdrawal pages. Separately, we count, without identifiers, how many visitors accept or reject analytics.
• Optional advertising measurement: with marketing consent, Meta receives the pages you visit, actions such as viewing the product, adding it to your cart, contacting us, signing up or buying, the order value, Meta’s browser and click identifiers, your IP address and device details, and hashed copies of the email address, phone number, name and address you give us. Google Ads receives the same kinds of information for its ads. See Advertising with Meta and Google.
• Error reports: when a page fails, the error, the page address without its query string, browser and device type, and the steps that led to it, so we can fix the website.
• Support: product serial number, issue description and diagnostic information you voluntarily supply. Please remove unrelated personal and company content before sharing.

When you place an order or send an enquiry, we keep how you told us you heard about LionBox, and the campaign labels, referring website and landing page of your first and latest visit to our website. With an order we also keep ad click identifiers from the link you arrived through, only if you allowed analytics your Google Analytics identifiers, and only if you allowed marketing Meta’s browser and click identifiers with the IP address and browser details the order came from. This is linked to your order. For an enquiry, a short summary without identifiers is added to the email our team receives. When you sign up for launch updates, the campaign labels, referring website, landing page and the short link you came through are stored with your address at our email provider, without identifiers.

Some links we post on other websites, such as Reddit, Facebook or LinkedIn, are short links on lionbox.ai/go/. When you open one, our server counts the click and sends you on to the page with that link’s campaign labels. We keep the time, the referring website, your approximate country, your device type and the app it was opened in, if it says so, and whether it was your first click on that link that day, but not your IP address, browser details or any identifier. To tell a first click from a repeat one, we keep a one-way code made from your IP address and browser details with a random key; the code and the key are deleted the next day, and after that the code cannot be linked to you. If you then send an enquiry or sign up for launch updates, we add one to that link’s count, without anything that identifies you. This uses no cookies or browser storage, and is based on our legitimate interest in knowing which posts bring visitors.

We use it to understand which channels bring customers, based on our legitimate interest; the Google Analytics identifiers rely on your analytics consent. If you allowed analytics, LionBox Cloud reports the purchase to Google Analytics without your name, email address or order number. While analytics is allowed, your browser keeps where your visits came from for up to 90 days, as described in the Cookie policy.

We remove the click, Google Analytics and Meta identifiers, IP address and browser details after 180 days and keep the source labels with the order. Deleting your account removes this information. You can object by emailing hello@lionbox.ai.

We advertise on Facebook and Instagram, and with Google Ads. To measure those ads and show them to people likely to need LionBox, our website uses the Meta Pixel and Meta’s Conversions API. With your marketing consent, your browser sends Meta the pages you visit and actions such as viewing the product, adding it to your cart, starting checkout, contacting us, signing up for launch updates, creating an account or buying, with the product, its price and a browser identifier. Our server sends Meta a copy of the same events with your IP address, browser details, Meta’s browser and click identifiers and, when you have given them to us, your email address, phone number, name and address, each hashed (converted to a one-way code) before it leaves our server. When a payment is confirmed, LionBox Cloud sends Meta the purchase with the order number, value and products, in the same way.

Meta uses this to match visits to Meta accounts, to report which ads led to visits and purchases, to deliver our ads to people who are likely to respond and to let us reach people who visited our website, or who resemble them. Meta Platforms Ireland Limited and we are joint controllers for collecting this information on our website and sending it to Meta, under Meta’s controller addendum; Meta is responsible for what it does with it afterwards, as described in Meta’s privacy policy, which also explains how to exercise your rights with Meta. Meta may process it in the United States, under the EU–U.S. Data Privacy Framework.

With the same consent, Google Ads runs through the Google tag already used for analytics. It receives the pages you visit, the ad you clicked, when you send our contact or launch-updates form and when you buy, with the value and order number, and contact details you typed into our forms, which Google’s tag hashes in your browser (enhanced conversions). Google uses it to report which ads led to enquiries and purchases and to show our ads to people who visited our website. Google is responsible for its processing as described in Google’s privacy policy and its ads data terms; Google may process it in the United States, under the EU–U.S. Data Privacy Framework.

This relies on your consent in the European Economic Area, the United Kingdom, Switzerland and anywhere else we do not apply the United States rules. In the United States it is on by default; sending it to Meta or Google can count as “selling” or “sharing” personal information for cross-context behavioural advertising under some state laws. You can opt out at any time with Do not sell or share my personal information at the bottom of every page or in Cookie settings, and a Global Privacy Control signal is treated as an opt-out. Withdrawing stops new information from reaching Meta and Google; it does not erase what they already received.

We use information to answer enquiries, arrange purchases, issue invoices, deliver products, manage requested services, and handle repairs and refunds. The applicable basis is taking steps at your request or performing our contract. When communicating with a company’s representative, we also rely on our legitimate interest in managing that business relationship.

We keep records required by accounting, tax and other applicable laws because of those legal obligations. Website security, abuse prevention, fraud checks and defending legal claims rely on our legitimate interests, balanced against your rights.

Optional analytics, advertising measurement with Meta and Google, launch updates and marketing emails rely on your consent. You can refuse analytics and advertising in Cookie settings and withdraw marketing consent with the unsubscribe link in any marketing email or by emailing hello@lionbox.ai. Refusing marketing or measurement does not prevent an enquiry or purchase.

Visitors in the United States get website analytics and advertising measurement by default, with a notice explaining it when they first visit. They can opt out in that notice, with Do not sell or share my personal information at the bottom of every page or at any time in Cookie settings. If your browser sends a Global Privacy Control signal, both stay off until you allow them. Where this policy refers to allowing analytics or marketing, this includes United States visitors who have not opted out. Sending information to Meta and Google for advertising, described in Advertising with Meta and Google, can count as selling or sharing personal information under some state laws; no one pays us for personal data.

We do not use your enquiry content to train a public AI model. We do not make decisions with legal or similarly significant effects about you solely through automated profiling.

Service emails. When you create an account or place an order, we send the emails needed to provide that service: order confirmations and status updates from orders@lionbox.ai, and account emails such as sign-up confirmation and password resets from noreply@lionbox.ai. Replies to order emails reach our support team at support@lionbox.ai. We send these to perform our contract with you or take the steps you requested, so they continue while your account or order is active, even if you do not receive marketing.

Marketing emails. We send product news and offers only if you opt in. The marketing checkbox at registration is unticked by default, and leaving it unticked does not affect your account or orders. Marketing emails come from hello@news.lionbox.ai. You can unsubscribe at any time with the link in every marketing email or by writing to hello@lionbox.ai. When you opt in at registration, we store your choice, the time and the wording you agreed to with your account. Our email provider keeps whether each address is subscribed or unsubscribed, so we can respect your choice and demonstrate it.

Launch updates. When you enter your email address in the launch-updates form and press the sign-up button, which says next to it that you agree to receive launch emails, we add your address to our launch-updates list with our email provider, Resend, together with where your visit came from (see How you found us), and send you news about the LionBox launch from hello@news.lionbox.ai. If the address unsubscribed from our emails before, we do not add it again on the strength of the form alone: we send one email from hello@lionbox.ai with a confirmation link that works for seven days, and add the address back only when you click it. Every launch update has an unsubscribe link, and these emails are marketing emails, measured as described below. If someone signed you up without your agreement, use that link or email hello@lionbox.ai and we will remove the address.

Opens and clicks. Our emails can contain a small invisible image (a tracking pixel) that tells us whether the email was opened, and links pass briefly through our tracking addresses (links.lionbox.ai and links.news.lionbox.ai) before reaching their destination so we can count clicks. These events can include the time, the link clicked and technical information such as your IP address and email app or browser. We use them to improve our communications and to keep our email delivery reliable, not to build advertising profiles. Open data is imprecise: some email apps load images automatically or through privacy proxies, and others block them. To limit open tracking, turn off automatic image loading in your email app; unsubscribing stops marketing emails and their tracking.

Bounces and complaints. Our email provider tells us when a message is delivered, bounces or is reported as spam. We use these events to stop emailing invalid addresses and to stop marketing to anyone who complains, keeping a minimal suppression record so we do not email that address by mistake.

Legal bases. Service emails rely on performing our contract. Marketing emails, and the open and click measurement in them, rely on your consent. Delivery, bounce and complaint processing, and open and click measurement in service emails, rely on our legitimate interest in delivering important messages reliably and protecting our email from abuse. You can object to that processing by emailing hello@lionbox.ai.

We use Vercel to host the website and LionBox Cloud, which runs in its Frankfurt region, and, with consent, for website traffic and performance measurement; Supabase for our account and authentication database and for software downloads; Resend to send and track our emails, from its servers in the United States; Google Workspace for our company mailboxes, which receive the emails you send us; Google Analytics when configured and consented; Microsoft Clarity, when configured and after you allow analytics, for visit recordings and heatmaps, told not to use them for advertising; Meta and Google Ads, with marketing consent, as described in Advertising with Meta and Google; Revolut for external payment processing, which receives your name, email address and phone number with the payment; FGO, our invoicing provider, which receives your billing name, company, tax and registration numbers, address, email address and phone number to issue the fiscal invoice and submit it to the tax authority where the law requires; the European Commission’s VIES service, which receives only a VAT number and its country to check it; Sentry, in its EU data region, to record errors in LionBox Cloud and on this website, configured to leave out names, email addresses, IP addresses and request contents; on the website it receives only error reports, sets no cookies and does not wait for analytics consent, based on our legitimate interest in keeping the site working; Upstash to limit repeated requests, using your account identifier or IP address for up to an hour; Apple and Google when you choose to sign in with them; and Expo to deliver LionBox app updates. Delivery partners receive the recipient and address information needed to transport a product. Professional advisers or public authorities may receive relevant records where necessary or legally required.

Some providers act on our instructions; payment providers and authorities may act as independent controllers for their own obligations. Their privacy notices describe that processing: Vercel, Supabase, Resend, Google, Meta, Microsoft, Revolut, Sentry, Apple and Expo.

International customers and service providers can involve processing outside the European Economic Area. Where a restricted transfer takes place, an applicable adequacy decision or appropriate safeguards, such as the European Commission’s standard contractual clauses, must cover it. Contact us for information about the safeguards relevant to your data.

Retention depends on the purpose. Enquiry correspondence is kept while we answer and follow up on your request. Customer records remain for the active relationship and any applicable warranty, complaint or legal-claim period. Invoices and accounting records are kept for the period required by applicable law, including after an account is closed.

Launch-update and marketing-email details are used until you withdraw or the requested communications end; a minimal suppression record may be retained to respect an unsubscribe or complaint, and consent records are kept for as long as needed to demonstrate consent. Email delivery and engagement events are kept only as long as needed for deliverability, troubleshooting and improving our communications. Security records are kept for the period needed to investigate abuse and protect the service. In LionBox Cloud, we clear IP addresses and app or browser details from download and security records after 90 days, delete security-log entries after two years and remove the recipient address from email delivery records after one year. Records subject to a legal dispute may be retained until that matter ends.

Cookie and browser-storage durations are listed in the Cookie policy. Provider-side analytics retention is separate from cookie expiry. We review records against these purposes and remove or anonymise data when it is no longer needed. Ask us about the retention applicable to a particular record.

Under the GDPR where applicable, you can request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. You may withdraw consent at any time; this does not change the lawfulness of earlier processing. Some requests are subject to legal conditions, including retention of required invoices.

Email hello@lionbox.ai, or delete your account yourself in the LionBox app’s Settings. We may ask for proportionate information to verify your identity. We normally respond within one month; if a legally permitted extension is necessary, we explain it within that month. Requests are normally free of charge.

You may complain to Romania’s ANSPDCP, or the competent supervisory authority in your place of residence, work or the alleged infringement. Customers outside the EEA may also have rights under applicable local law.

We use access controls and appropriate technical and organisational measures to protect the information we handle. No system eliminates every risk. Protect your account credentials and avoid sharing sensitive company material through a public enquiry form.

The website and product are intended for adults and professional teams. We do not knowingly solicit children’s personal data. Contact us if you believe a child has supplied information.

We update this notice when our services or processing change and show the revision date above. We provide additional notice or obtain fresh consent where required. A revised policy does not retrospectively create consent for a new purpose.