Suggestion Box Ai

    Suggestion Box AiBack to Home

    Privacy Policy

    Last updated: August 21, 2026

    In short

    Suggestion Box Ai is built so that even we cannot read the messages sent through it. We collect the minimum data needed to run the service, never sell it, and never use it for advertising. This policy explains what we collect, how we use it, and your rights. Our Terms of Use govern use of the service itself.

    1. Data We Collect

    • Account data: email, organization name, hashed password.
    • Billing data: processed by Stripe; we do not store card details.
    • Messages: end-to-end encrypted content; we cannot read message bodies.
    • Technical data: minimal logs (IP, timestamp) for security and rate limiting only.

    2. How We Use Data

    We use data only to operate, secure, and improve the Service; to process payments; to send essential transactional emails; and to comply with legal obligations. We do not sell your data and do not use it for advertising.

    3. Identity Protection

    Messages submitted through the Identity Protected channel are not linked to a member's personal identity in our database. Senders may voluntarily disclose their identity within the message body; we cannot prevent or detect such disclosures.

    4. Encryption & Security

    Messages are encrypted client-side using AES-GCM via the Web Crypto API. Encryption keys are stored locally in the administrator's browser and are not transmitted to our servers. We employ Row-Level Security, rate limiting, and strict access controls. For a full description of our security measures, see our Security Policy.

    5. Data Retention

    Account data is retained for as long as your account is active. Messages are retained until manually deleted by the administrator. Upon account deletion, all associated data is permanently removed within 30 days, except where retention is required by law.

    6. Your Rights (GDPR, UK GDPR, CCPA)

    You have the right to:

    • Access the personal data we hold about you.
    • Rectify inaccurate or incomplete data.
    • Erase your data ("right to be forgotten").
    • Restrict or object to certain processing.
    • Data portability — receive your data in a machine-readable format.
    • Withdraw consent at any time.
    • Lodge a complaint with your local data protection authority.

    To exercise these rights, email team@suggestion-box.ai. We respond within 30 days.

    7. Sub-processors

    We rely on a limited set of vetted sub-processors: Supabase (database & auth hosting), Stripe (payments), and Resend (transactional email). Each is bound by data processing agreements consistent with applicable law.

    8. Data Residency (Ireland, EU)

    All account data, encrypted message records, and attachments are stored and processed in Ireland (European Union), within an EU data centre region operated by our infrastructure sub-processor. Choosing EU residency gives you concrete advantages:

    • GDPR by default — your data sits under one of the world's strongest privacy regimes, with enforceable rights and supervisory oversight.
    • No onward transfer required — data stays inside the EEA for normal operation, so no reliance on ad-hoc cross-border mechanisms.
    • Strong legal protection — Irish and EU law require lawful process before any authority can compel disclosure; we do not grant bulk or standing access to any government.
    • Resilience and security — EU-certified data centres with encryption at rest, encryption in transit, redundancy, and independent audit standards.
    • Neutral jurisdiction — hosting outside your own country reduces the risk of local interference with sensitive whistleblowing and suggestion data.

    Where a transfer outside the EEA is unavoidable (for example, payment processing or transactional email), we rely on Standard Contractual Clauses or another lawful transfer mechanism, and only the minimum data necessary is transferred.

    9. Local Compliance & Country-of-Use Statistics

    To help organizations meet local data-protection obligations in their country of use — including registration and annual reporting with national regulators such as Uganda's Personal Data Protection Office (PDPO) under the Data Protection and Privacy Act, 2019 — we record and make available aggregate message-volume statistics only. These statistics may be stored and retained in the organization's country of use for filing purposes.

    What is recorded for compliance reporting:

    • Counts of messages received over a reporting period.
    • Counts by category (for example suggestions, ideas, complaints, safeguarding reports).
    • Counts per organization account and platform totals.
    • Date of first and most recent activity in the reporting window.

    What is never recorded, exported, or accessible: we do not read, log, record, copy, transcribe, or export the actual content of any message or reply exchanged between users and administrators. Message bodies are encrypted client-side and are not readable by us, and no message content, attachment, sender identity, IP address, or device identifier is ever included in compliance statistics, exports, or reports. Compliance outputs contain numbers only.

    Advantages of this approach: organizations can satisfy local registration and annual reporting duties, demonstrate accountability to their regulator, and evidence responsible processing volumes — all without any loss of confidentiality for the people who speak up.

    10. International Transfers

    Where data is transferred outside your region, we rely on Standard Contractual Clauses or other lawful transfer mechanisms.

    11. Cookies

    We use only strictly necessary cookies and local storage required for authentication and encryption key management. We do not use tracking or advertising cookies.

    12. Contact

    Questions about this Privacy Policy or our privacy practices? Contact us at team@suggestion-box.ai.