How your conversations with Boxy are handled
This page covers how Boxy handles your data. For information about how Boxy works and what it can do, see About Boxy.
To monitor the quality and accuracy of Boxy’s responses, and to identify and correct errors, Runbox logs both sides of each conversation — your messages and Boxy’s replies. This allows Runbox to review interactions where Boxy may have given incorrect or incomplete information and to improve Boxy accordingly.
Runbox logs these conversations on the basis of legitimate interests: maintaining the accuracy and reliability of a support tool is a reasonable purpose, and the privacy impact is low. Conversations with Boxy concern Runbox product questions rather than sensitive personal data, and logs are accessible only to a small number of authorised Runbox staff.
Before being written to the log, your messages are automatically sanitised: email address local parts (the part before the @) are replaced with [redacted], values following password-related keywords are redacted, and long numeric strings that resemble payment card numbers are redacted. You should still avoid sharing passwords, payment details, or sensitive personal information in the chat — there is no need to do so, and doing so offers no benefit.
Conversation logs are stored on Runbox’s own servers in Norway and are retained for 10 days, consistent with Runbox’s log retention policy for other services. They are accessible only to authorised Runbox support staff. They are not shared with any third party beyond the AI and search providers listed below, who process your messages transiently as described.
In addition to being available for staff to review individually, logged conversations are also reviewed automatically once a day: a summary of the topics discussed is produced, and any conversation where Boxy may not have given a satisfactory answer is flagged for staff attention. This automated review is carried out by Mistral AI — the same provider already listed below, used here for an additional purpose — using the sanitised log data described above. The summaries it produces are written without personal details, and any links to logged conversations in them stop working when the conversation itself is deleted after 10 days. The review exists solely to help Runbox identify gaps in Boxy’s knowledge base and improve future responses.
Separately, a member of staff can ask for an individual logged conversation to be translated into English by Mistral AI when it is written in another language. This happens only on request, one conversation at a time, and the translation is shown to the staff member and not stored.
Boxy’s replies are generated by one of the AI providers listed below, depending on which is currently in use — Runbox may change this from time to time. Whichever provider generates the reply, every message is also screened by Mistral AI for harmful content and used to retrieve relevant sections of Runbox’s knowledge base. Mistral AI, Scaleway and TensorX are subject to the GDPR, and OnshoreAI to the UK GDPR. None of them uses your messages to train its AI models. Boxy only uses AI providers based in Europe, under the GDPR or equivalent data protection law.
| Provider | Location | GDPR transfer basis | Trains on data |
|---|---|---|---|
| Mistral AI | Paris, France | EU-based company — no transfer required | No |
| Scaleway | Paris, France | EU-based company — no transfer required | No |
| OnshoreAI (Hostcomm Ltd) | United Kingdom (data centre in Harlow, Essex) | European Commission adequacy decision for the UK | No |
| TensorX | Dublin, Ireland | EU-based company — no transfer required | No |
All AI processing runs through Runbox’s own server in Norway, which calls each provider’s API directly.
If Boxy’s knowledge base does not fully answer your question, Boxy can look in two further places, and tells you which one any information came from.
Runbox’s own websites. Boxy can search runbox.com and its other sites, such as help.runbox.com, blog.runbox.com and the Runbox community forum. Your message itself is never sent to the search service. Instead, Boxy writes a short search phrase about the Runbox feature or setting involved — for example, “IMAP settings” — and is instructed never to include personal information in it. Email addresses and long numbers are also removed automatically from the phrase before it leaves Runbox’s server. Searches are made by Runbox’s server, never from your device, so your IP address is not passed to the search service.
Other companies’ help pages. For questions about another company’s email app or account — for example, a setting in Apple Mail or an app password for Gmail — Boxy can read a small number of those companies’ own help pages, chosen by Runbox. Runbox’s server keeps its own copy of these pages and refreshes it once a week, so when Boxy reads one, nothing from your conversation is sent to anyone.
Searches of Runbox’s websites are carried out by Mojeek, whichever AI provider is generating the reply:
| Search carried out by | Location | GDPR transfer basis |
|---|---|---|
| Mojeek (Mojeek Ltd) | United Kingdom | European Commission adequacy decision for the UK |
Mojeek runs its own independent search index and its published privacy policy states that it does not record IP addresses; in any case, the only address it sees is that of Runbox’s server, not yours. Search phrases, and the names of any help pages Boxy reads, also appear in Boxy’s conversation log, sanitised in the same way, and are deleted with it after 10 days.
When you use the send to support feature, your conversation is transmitted to Runbox’s server in Norway, where it becomes a support ticket for the support team. Your email address, which you provide when sending, is used only to allow the team to respond to your enquiry and is not used for any other purpose. Your country, worked out from your IP address on Runbox’s own server, is added to the ticket; the IP address itself is not.
If you are asked for message headers, you can paste them in when sending and they are attached to the ticket as a file. Headers contain the email addresses and IP addresses of the sender and of the servers that handled the message, so they include other people’s details as well as yours. Once sent, the ticket is ordinary support correspondence: it is not deleted after 10 days, and is kept under Runbox’s ticket policy, at Runbox’s discretion.
The DNS Compliance Checker looks up publicly available DNS records for the domain you enter. The lookups are made by Runbox’s server in Norway, not from your device, so your IP address is not passed on, and they are answered by Quad9, a Swiss non-profit foundation. Boxy does not keep a record of the domains you check or of the results.
Once the results are shown, you can choose “Discuss these results with Boxy”. This is optional, and nothing is sent to Boxy unless you choose it. If you do, the domain and the results are sent to Boxy as the start of a conversation in a separate chat window; to carry them across, they are held briefly in your browser’s local storage and removed as soon as the chat window opens. From that point it is an ordinary conversation with Boxy, covered by the rest of this page: it is logged for 10 days and processed by the AI providers listed above. The same notice that appears at the start of any Boxy conversation is shown beneath the link, so you can read it before you choose.
As a Runbox customer, your data rights under GDPR are set out in Runbox’s Privacy Policy at runbox.com/about/privacy-policy/. These rights include access to, rectification of, and erasure of your personal data.
Country detection uses IP geolocation data provided by IPLocate.io, processed locally on Runbox’s servers. No IP addresses are sent to IPLocate.io.
For more detail on how each provider handles data, see Mistral’s Privacy Policy, Scaleway’s Generative APIs Privacy Policy (the policy specific to the AI service Boxy uses, rather than Scaleway’s general cloud-hosting terms), and Mojeek’s Privacy Policy. For questions specifically about how Boxy processes your data, contact Runbox’s Data Protection Officer at dataprotectionofficer@runbox.com.
← Back to Boxy