Privacy Policy

1. Who is responsible

Belacsbox Inc. (Ontario, Canada), operating as Belacsbox, is responsible for personal information about our customers and the people who contact us. Our Privacy Officer is accountable for how we handle it and can be reached at legal@belacsbox.com.

We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act respecting the protection of personal information in the private sector (Law 25) and, for people in the European Union and United Kingdom, the GDPR and UK GDPR.

For information your site collects from your visitors, you are responsible and we act as your service provider (processor). See section 5.

2. What we collect

3. Why we use it

• To provide the Service: run your account, save and publish your sites, connect domains, send sign-ups to tools you choose. (GDPR basis: performance of our contract with you.)
• Billing: manage your plan, send trial-end and renewal reminders, and handle payment problems. (Contract; legal obligation.)
• Security and safety: protect accounts, detect and stop fraud, spam, phishing and other abuse, check sites before they go live, and keep an audit log. (Legitimate interests; legal obligation.)
• Support: answer your questions. (Contract; legitimate interests.)
• Improving the Service: understand which features are used, using our own records, not third-party trackers. (Legitimate interests.)
• Legal: meet tax, accounting, consumer-protection and mandatory reporting duties. (Legal obligation.)

We do not sell personal information, do not use it for advertising profiles, and do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Automated safety checks can hold a site for review; a person makes the final decision on any appeal.

4. Information about your site's visitors

Sites built with Belacsbox can collect information from visitors, such as sign-up forms and contact messages. For this information, the site owner decides what is collected and why, and we process it on the owner's behalf. If you are a visitor to a site built with Belacsbox, please contact that site's owner about your information; we will help them respond.

Published sites do not set cookies of ours. A site owner may choose to add Plausible (no cookies) or Google Analytics; Google Analytics only loads after the visitor accepts a cookie banner.

5. AI writing help

When you use AI writing help, the text you ask about and the relevant section content are sent to Anthropic, PBC, which provides the Claude AI models through its commercial API. Under Anthropic's commercial terms, by default Anthropic does not use inputs or outputs from its commercial products to train its models. We never send your visitors' form entries or sign-up lists to the AI provider. AI requests and responses also pass through our safety checks and are recorded in your account's activity so you can see what was used.

6. Cookies

This website, belacsbox.com, sets no cookies and loads no analytics or advertising trackers. The Belacsbox editor app uses only strictly necessary cookies to keep you signed in and secure. Password-protected pages on published sites use a necessary cookie to remember that a visitor entered the right password, for up to 7 days.

7. Who we share it with (subprocessors)

We share personal information only with service providers that help us run Belacsbox, under written agreements that require them to protect it and use it only for us, or where the law requires it.

Integrations you turn on yourself, such as Mailchimp, Kit, Google Sheets or a webhook, receive the data you choose to send them under their own terms.

We may also disclose information when required by law, to respond to valid legal requests, to report child sexual abuse material as Canadian law requires, to protect people from harm, or as part of a sale or reorganisation of our business, in which case the new owner must keep this policy's protections.

We will update this list before adding a new subprocessor that handles customer data. Account owners can ask to be told of changes by email at legal@belacsbox.com.

8. Where your information is stored

We are based in Canada. Our providers store and process information mainly in the United States, and Cloudflare serves published sites from data centres around the world. Information stored outside Canada or Quebec is subject to the laws of those places and may be accessed by their courts and authorities. Before transferring information outside Quebec we assess the protection it will receive, and our agreements require providers to protect it to the standard this policy describes. For EU and UK data, Canada is recognised as providing adequate protection for organisations covered by PIPEDA, and onward transfers rely on the provider's approved transfer mechanism, such as Standard Contractual Clauses or the EU-US Data Privacy Framework.

9. How long we keep it

• Account and site content: while your account is open. After it closes, we keep it for a limited period so you can return or export it, then delete it. Backups expire on their normal schedule.
• Sign-in records with IP addresses: 12 months, then the IP address is removed.
• Activity (audit) log: an append-only record of who did what, which cannot be edited. It holds no IP addresses and no form contents, so it never exposes your visitors' information. It is kept while your account is open and for as long afterwards as we need it for security and legal reasons.
• Billing records: as long as tax and accounting laws require (in Canada, generally 6 years).
• Abuse reports and evidence: as long as needed to handle the report and as required by law.
• Security incident records: at least 24 months, as PIPEDA requires.

10. Security and account isolation

Every customer account is separated from every other account at the database level: one customer cannot see or reach another customer's sites, settings or data, and this is checked by automated tests on every change. A small number of Belacsbox team members can access accounts only for support, security and legal reasons, and every such action is recorded in the audit log. We encrypt data in transit, store passwords only as secure hashes, publish customer sites on a separate domain (belacsbox.site) from our app, and limit access to the people who need it.

If a breach creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada (and, where it applies, Quebec's Commission d'accès à l'information) as soon as feasible.

11. Your rights

You can ask to access, correct or delete your personal information, to get a copy in a portable format, and to withdraw consent where we rely on it. Depending on where you live you may also object to or restrict some processing. Much of this you can do yourself in your account (edit your details, export your content, close your account). For anything else, email legal@belacsbox.com. We reply within 30 days and may need to confirm your identity first. We may keep some information where the law requires it.

12. Emails from us

We send service emails you need, such as sign-in links, trial-end notices, renewal reminders, receipts and security alerts. We send marketing emails only if you have agreed to receive them, and every marketing email has a one-click unsubscribe link, honoured within 10 business days.

13. Children

Belacsbox is not for children. You must be an adult to create an account, and we do not knowingly collect information from children under 16.

14. Changes to this policy

If we make a significant change we will email account owners before it takes effect and update the date at the top of this page.

15. Contact and complaints

Privacy Officer, Belacsbox Inc., Ontario, Canada: legal@belacsbox.com

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, to Quebec's Commission d'accès à l'information if you live in Quebec, or to your local data protection authority if you live in the EU or UK.