Privacy Policy

1. Introduction & Mission

SAI KYAW MIN KHANT (operating as BotBoxmm, "BotBox", "we", "us", or "our") is committed to protecting your privacy and safeguarding your personal and business communication data.

BotBox provides an enterprise customer communication platform that unifies messaging channels into a collaborative shared inbox. This Privacy Policy details how data is collected, processed, protected, and deleted across all supported channels, cloud storage, authentication systems, and assistive AI tools.

2. Supported Messaging Channels & Data Collection

When businesses connect their communication accounts to BotBox, or when end-users interact with a connected business, we process only the data strictly necessary to deliver real-time omnichannel messaging:

3. User Authentication & Google OAuth

• Email & Password Login: Passwords are protected using bcrypt cryptographic hashing with automatic salt generation. Session authentication utilizes JWT tokens equipped with session versioning (token_version) so that password resets immediately revoke all prior access and refresh sessions across devices.
• Google OAuth 2.0 (OpenID Connect): When signing in with Google, we request only your basic profile information (verified email address, full name, and avatar image) to provision your workspace identity. We never access your Google Drive, Google Contacts, or private emails.

4. AI Processing & Generative Services

BotBox offers assistive AI tools including Smart Replies, customer sentiment analysis, conversation summarization, CSAT estimation, and multi-language translation:

5. Push Notifications & Email Communications

• Web Push Notifications: Browser Web Push API subscription objects (endpoint URLs, p256dh keys, auth secrets) are stored exclusively to notify logged-in agents of incoming customer messages and team assignments.
• Transactional Emails: Your email is used solely for transactional purposes: workspace invitations, email verification, password reset links, billing notices, and critical security alerts. We do not engage in unsolicited third-party marketing.

6. Payment Slips & Financial Verification

For manual subscription billing via local mobile banking (KBZPay, WavePay, AYA, CB Bank):

• Transaction slips are uploaded through a streaming upload validator that limits file sizes and validates raster magic byte signatures (JPEG, PNG, WebP) to protect system integrity.
• Uploaded payment slips are stored in access-restricted directories viewable strictly by authorized tenant administrators and platform billing auditors.

7. Uploaded Media & File Attachments

Customer attachments, operator uploads, images, voice memos, videos, custom stickers, and bank logos are stored securely on our infrastructure with randomized UUID filenames, anti-traversal validation, and strict role-based access controls to prevent unauthorized access.

8. Credential Security & Encryption at Rest

All channel authentication secrets (Telegram Bot tokens, Facebook Page Access Tokens, Viber tokens, LINE Channel Secrets) are encrypted at rest using AES-based Fernet cryptography. Plaintext credential storage is completely eliminated from the platform architecture.

9. Meta Platform Policy & Data Deletion Compliance

When you connect a Facebook Page to BotBox, we strictly adhere to Meta's Developer Policies and Messenger Platform Guidelines:

10. Data Controller & Contact Information