The short version
Boxana is a platform. We are the controller for our own site and for the accounts of the businesses that use us — we collect a name, an email, and what is needed to run and bill the service. We are the processor for the shops we host: the shopper data inside a shop belongs to that shop, and we only act on its instructions.
We never see full card numbers — Stripe handles payment. We do not sell personal data to anyone, and we do not use it to train models. Email boxana+privacy@kypos.cy at any time to see, correct or delete what we hold.
1. Which data this policy covers
This policy applies when:
- you visit boxana.io or send us the request form on it;
- you hold an account in the Boxana admin at https://shop-admin.boxana.io — as a merchant, an owner, or a member of staff;
- you contact us by email about the platform.
It does not replace the privacy policy of a shop built on Boxana. If you bought something from a shop that runs on our platform, that shop is the data controller for your order, and its own privacy policy governs. This one explains what we do underneath, as its supplier — see section 5.
2. Who is responsible for your data
The data controller is Kypos Ltd (registration number HE 488430), trading as Boxana.
- Address: Voreiou Ipeirou 2, Oasis Park, Flat/Office Q2, 8035 Paphos, Cyprus
- Email: boxana+privacy@kypos.cy
We are a small business and are not required to appoint a Data Protection Officer. Your message goes to the people who run the platform.
This policy follows the GDPR (Regulation (EU) 2016/679) and the Cyprus data protection law 125(I)/2018.
3. What we collect, why, and for how long
Each thing we do with your data needs a legal basis. Here is all of it, for the data we hold as controller.
| What we do | Data used | Legal basis | How long we keep it |
|---|---|---|---|
| Answer a request sent from our site | Name, email, what you told us about your business | Steps taken at your request before a contract | 2 years from your last message |
| Create and run your platform account | Name, email, password (hashed) or Google sign-in, role, shop you belong to, sign-in history | Performance of a contract | For as long as your account is open, then 30 days after it is closed |
| Record what staff changed in the admin | User id, action, time, the record affected | Our legitimate interest in an accountable audit trail, and the shop's legal obligations | 6 years |
| Bill for the service and keep accounts | Billing contact, company details, VAT number, invoices, payment references | Legal obligation, and performance of a contract | 6 years after the end of the tax year, for tax and accounting |
| Provide support | Correspondence, screenshots you send, the account it concerns | Performance of a contract | 2 years from your last message |
| Keep the platform up, secure, and free of abuse | IP address, device and browser info, request and error logs | Our legitimate interest in security and service continuity | 12 months |
| Restore the service after a failure | Whatever the backup contains | Our legitimate interest in service continuity | Backups roll off after 35 days. A deletion request is applied to live data at once, and to backups as they expire |
| Send service notices about your account | Name, email | Performance of a contract | For as long as your account is open |
Where the basis is our legitimate interest, we have checked that our interest does not override your rights. Ask us at boxana+privacy@kypos.cy and we will explain our reasoning.
We do not run advertising or behavioural tracking on boxana.io, and we do not send marketing email to people who have not asked for it. If that ever changes, this section changes with it and we ask for consent first.
4. Signing in with Google
The Boxana admin lets you sign in with a Google account instead of a password. If you choose that, Google tells us your name, email address, profile picture and Google account identifier. That is all we ask for, and we use it only to create your account, sign you in, and show who did what in the admin.
Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not sell Google user data, we do not transfer it except as needed to provide or improve the features you are using or as required by law, we do not use it for advertising, and we do not allow humans to read it except with your consent, for security, to comply with the law, or on aggregated anonymised data.
You can disconnect Boxana from your Google account at any time at myaccount.google.com/permissions. Doing so stops the sign-in method; ask us at boxana+privacy@kypos.cy if you also want the account itself closed.
5. Shop data we handle for our customers
Every shop on Boxana holds personal data about its own shoppers — names, addresses, order history, support messages. For that data:
- the shop is the controller, and decides what is collected and why;
- Boxana is the processor, and acts only on the shop's documented instructions;
- our staff access it only where needed to run, fix or support the service, under a duty of confidentiality;
- we do not use it for our own purposes, do not sell it, do not disclose it to anyone the shop has not approved, and do not use it to train machine-learning models;
- when a shop leaves, it can export its data, and we delete or return it as described in our Terms of Service.
The data-processing terms are set out in section 7 of the Terms of Service, which is the written contract required by Article 28 of the GDPR. If you shopped at a Boxana-built store and want your data seen, corrected or erased, contact that store — it holds the decision. If you cannot reach it, email boxana+privacy@kypos.cy and we will pass the request on.
6. Who else sees your data
We do not sell, rent or trade personal data. We share it only with the suppliers who make the platform work, each under a written contract that limits them to our instructions:
| Sub-processor | What it does | Where it processes |
|---|---|---|
| Google Cloud / Firebase | Hosting, database, authentication, file storage | EU and United States |
| Vercel | Hosting and delivery of shop and admin front ends | EU and United States |
| Stripe | Card payments for shops on the platform | EU and United States |
| Resend | Sending transactional email on a shop's behalf | EU and United States |
A shop may also connect its own suppliers — a courier, an accountant, an analytics tool. Those are the shop's choice and the shop's responsibility, and they appear in its own privacy policy, not here.
We also disclose data to:
- our accountant, and the tax authorities — invoices and billing records, as the law requires;
- authorities or courts — if we are legally required to hand something over.
If our business is ever sold or merged, data may transfer with it. You would be told first, and this policy would continue to apply until you were told otherwise.
7. Data sent outside Europe
Some of our suppliers are US companies and some data is processed outside the European Economic Area. Those transfers are covered by the European Commission's adequacy decision for the EU–US Data Privacy Framework, and by Standard Contractual Clauses approved by the Commission where the Framework does not apply.
You can ask us at boxana+privacy@kypos.cy for a copy of the safeguards that apply.
8. How we protect your data
Everything runs over HTTPS. Passwords are hashed, never stored in the clear. Card details never touch our servers. Access to production data is limited to the people who need it, is logged, and is separated per shop so that one shop cannot read another's records. Backups are encrypted.
No system is perfectly secure. If a breach ever puts your rights at risk, we will tell the Office of the Commissioner for Personal Data Protection within 72 hours and tell you without undue delay. Where we are the processor, we tell the shop without undue delay so that it can meet its own deadline.
9. Your rights
Under the GDPR you can ask us to:
- Give you a copy of the data we hold about you
- Correct it if it is wrong or incomplete
- Delete it, where we do not have to keep it by law
- Restrict what we do with it while a dispute is sorted out
- Send it elsewhere, in a machine-readable format
- Stop processing based on legitimate interest — you can object at any time
- Withdraw consent at any time, for anything based on consent. This does not undo what we did before you withdrew it.
We do not make any decision about you by automated means alone, and we do not profile you.
Email boxana+privacy@kypos.cy. We verify who is asking before we disclose or delete anything, and we reply within one month. If your request is complicated we may need up to two months more, and we will tell you within the first month if so. It is free, unless a request is clearly excessive or repetitive.
Where the data is held on behalf of a shop, we forward your request to that shop rather than act on it ourselves — the law puts the decision with the controller.
10. Children
Boxana is a business tool. Accounts are for adults acting for a business, and the site is not aimed at children. Under the Cyprus law 125(I)/2018, a child in Cyprus can consent to online services from age 14; below that, a parent must consent. If you believe a child has given us data, email boxana+privacy@kypos.cy and we will delete it.
11. Cookies and similar storage
boxana.io sets no analytics, advertising or tracking cookies. The admin at https://shop-admin.boxana.io uses strictly necessary storage only: a session token to keep you signed in, and preferences such as your language. Those are exempt from consent under the ePrivacy rules because the service does not work without them.
A shop built on Boxana decides its own cookie set and publishes its own cookie policy. Nothing optional is set there until the shopper opts in.
12. Other websites
Our pages sometimes link elsewhere. Once you follow a link, this policy stops applying and the other site's does.
13. Changes to this policy
If we change this policy in a way that affects you, we will update the date at the top and, for anything significant, email account holders. We will ask for your consent again where the law requires it — your continued use of the platform is not treated as agreement to a material change.
14. Complaining
If you are unhappy with how we handle your data, please tell us first at boxana+privacy@kypos.cy. You also have the right to complain directly to the Office of the Commissioner for Personal Data Protection in Cyprus:
You do not have to come to us first. You can go straight to them.
15. Contact us
- Privacy questions: boxana+privacy@kypos.cy
- Legal notices: boxana+legal@kypos.cy
- Everything else: boxana+contact@kypos.cy
- Post: Kypos Ltd, Voreiou Ipeirou 2, Oasis Park, Flat/Office Q2, 8035 Paphos, Cyprus