App Privacy Policy

This Privacy Policy describes how the BoxSuite app collects, uses, stores, shares, and protects personal data of users who access the mobile application. By using the app, you agree to the data processing described below, within the limits of applicable law, including the LGPD when applicable.

1. Who we are

BoxSuite is an application used by customers of partner companies to track orders, assisted purchases, shopping groups, shipments, wallet activity, addresses, notifications, and operational history.

2. Data we may process

2.1. Data provided by you

• Name, email, phone number, tax ID, or another document linked to the account.
• Addresses registered in the app.
• Order, assisted purchase, shipment, wallet, and operational history data.
• Notes, messages, and instructions sent through app flows.
• Images and files uploaded as receipts or operational attachments.

2.2. Data collected automatically

• Authentication token and basic session data stored locally in a secure manner.
• Push notification token, when the user authorizes the feature.
• Technical device and app data required for security and proper functioning.
• Technical records of usage, requests, authentication, and platform operations.

2.3. Data received from third parties

• Payment gateways and providers.
• Push notification services.
• Tracking, transportation, and logistics services.
• Partner companies linked to your account.

3. Purposes of use

• Authenticate the user and keep the session active.
• Identify the partner company linked to the access.
• Display orders, purchases, shipments, wallet information, addresses, and history.
• Process payments, receipts, and operational requests.
• Send notifications about relevant account updates.
• Allow external payment, tracking, and operational support links to be opened.
• Prevent fraud, abuse, security incidents, and misuse.
• Comply with legal, regulatory, and contractual obligations.

4. Legal bases

Processing may occur based on contract performance, compliance with legal obligations, the regular exercise of rights, legitimate interest, and, when necessary, consent.

5. Device permissions

5.1. Photo library

The app may request access to the photo library so that you can select images and upload receipts or attachments related to payments and app operations.

5.2. Push notifications

The app may request permission to send push notifications about orders, payments, purchases, shipments, and other relevant updates.

5.3. What the app does not use

In its current configuration, the app does not depend on microphone, camera, audio, contacts, or precise location access to execute the main user flows.

6. Local storage

The app stores locally, with appropriate protection, information such as the authentication token, session data, push notification token, and pending navigation URLs linked to notifications.

7. Data sharing

Data may be shared, when necessary, with:

BoxSuite does not sell personal data.

• the partner company responsible for the user account;
• payment gateways, intermediaries, and payment providers;
• infrastructure, hosting, and notification service providers;
• logistics partners and tracking services;
• public authorities, when there is a legal obligation.

8. External links and services

In certain flows, the app may open external payment, tracking, or proof links. When this happens, the processing carried out by the third party will follow that third party's own rules and policies.

9. Role of BoxSuite and partner companies

Within the app context, BoxSuite may act as controller regarding authentication, security, infrastructure, and platform operation, and as processor on behalf of the partner company for processing related to services provided to the end customer.

10. Retention and security

We keep data for the time necessary to provide services, comply with legal obligations, record operations, and protect the platform against fraud and abuse. We adopt reasonable technical and organizational measures to protect the data processed in the app.

11. Your rights

Under the LGPD, when applicable, you may request:

• confirmation that processing exists;
• access, correction, blocking, deletion, or anonymization of data;
• information about data sharing;
• portability, when applicable;
• withdrawal of consent, in the corresponding cases;
• objection to processing, when allowed by law.

12. Minors

The app is not intentionally intended for persons under 18 years of age in violation of applicable law.

13. Updates to this policy

This policy may be updated periodically to reflect legal, regulatory, technical, or operational changes.

14. Contact

• Privacy email: privacidade@boxsuite.com.br
• General email: contato@boxsuite.com.br
• Website: https://boxsuite.com.br