Box

Box Privacy Notice: User-Focused Overview

*This summary is based only on the text provided and is not legal advice. The document states that customers who began using Box on or after November 4, 2025 may be subject to a different notice. Several linked sections and contact details are missing from the provided text.*

1. Data Collection and Use

Box collects information through:

• Information you provide: Data supplied when visiting Box websites, creating or using an account, requesting features, attending events, or contacting Box.
• Automatic collection: Information about how you use Box Services and the devices used to access them.
• Cookies and tracking technologies: Box and service providers may place cookies or similar technologies. Details are deferred to a separate Cookie Notice.
• Third-party sources: Information from third-party applications where you authorize Box to access it.

Box uses information primarily to:

• Provide, operate, maintain, and improve Box Services;
• Enable account features, integrations, collaboration, and sharing;
• Secure the services and protect users;
• Comply with legal obligations, resolve disputes, and enforce agreements; and
• Communicate with users, including promotional or newsletter communications where permitted.

Box may process and transfer information to the United States and other countries, potentially with different privacy protections than your home country.

Content: The policy refers to “Content” and says Box will not share it except with permission, as needed to provide services, through selected integrations, for security, or when legally required. The provided text does not fully explain whether Box personnel or automated systems inspect content or metadata.

2. User Rights and Choices

Depending on your location and account structure, you may be able to:

• Access, update, or delete account information;
• Manage marketing and newsletter preferences;
• Control use of Box integrations and sharing of personal information;
• Decline certain requests for information; and
• Raise complaints or concerns about Box’s handling of personal information.

You can exercise choices through your Box account or by contacting Box. Some information is required to create or operate an account or provide requested features; refusing it may prevent use of the relevant service.

Additional rights may apply under GDPR, U.S. state privacy laws, or other regional laws. The policy points to separate regional information but does not list all rights or response procedures in this text.

For business accounts, the organization’s agreement with Box generally controls where it conflicts with this notice. Your organization may also control the account and have access to or authority over account content.

3. Third-Party Sharing

Box may share information or Content with:

• Vendors and service providers acting for Box;
• Third-party Box integrations or products you choose to use;
• Authorities, courts, or others when required by law or legal process; and
• Parties where necessary to protect users, Box, or service security.

Box may combine information obtained from third-party applications with information collected through Box. The third party’s privacy notice and authorization procedures may govern that access.

4. AI/ML Training

The provided notice does not state whether user data or Content is used to train artificial intelligence or machine-learning models. It also does not expressly promise that Content will never be used for that purpose. Users should review the current policy, product-specific terms, and business-account agreement or obtain clarification from Box, especially before storing confidential or sensitive material.

5. Key User Obligations and Restrictions

Users should:

• Provide information needed to create and operate their account;
• Ensure they have permission before connecting third-party applications or sharing Content;
• Review the privacy and authorization practices of integrations;
• Comply with applicable agreements and organizational policies; and
• Avoid using the service for children under 18, since Box Services are not directed to minors and Box says it does not knowingly collect their information.

The notice itself does not provide detailed acceptable-use rules, security obligations, or content restrictions; those may appear in separate Box terms.

6. Liability and Disputes

The notice describes security measures, including encryption at rest and during transmission, controlled server access, and compliance programs. However, these are commitments to protective measures—not a guarantee that data breaches or loss cannot occur.

This document contains no detailed liability disclaimer, damages cap, indemnity provision, governing-law clause, arbitration clause, or court-selection clause. Those terms likely appear in Box’s service agreement or terms of use.

For unresolved privacy or data-use concerns, users may contact Box’s U.S.-based, third-party dispute-resolution provider free of charge. Box states it will respond to inquiries within 30 days.

7. Policy Changes

Box may change the notice by updating the date at the top. For material changes, Box may provide more direct notice by email or post a notice on its website before the changes take effect. Users are encouraged to review the notice periodically. There is no promise that every user will receive individualized notice.

Box Terms of Service — Key User Implications

Effective date: August 17, 2026. This summary focuses on the operative terms supplied, not the archived versions. It is not legal advice; the separate Privacy Policy, Acceptable Use Policy, Box AI policy, Regional Terms, and any paid contract may add important requirements.

1. Data Collection and Usage

• The Terms do not list specific data categories in detail. They incorporate Box’s Privacy Policy, which governs how Box collects, stores, and uses personal information.
• Box may process:
• Account and registration information;
• Profile and usage information;
• Payment and billing information;
• Uploaded files and other electronic documents (“Content”);
• Box AI queries and outputs;
• Information generated through use of the Services, including API, AI Unit, and other resource consumption data.
• Box may transmit, process, use, and disclose Content and related information:

1. As necessary to provide the Services;

2. As otherwise permitted by the Terms;

3. To comply with law, regulation, or legal orders; or

4. In emergencies.

• Content is generally stored in the United States, and other processing may occur outside the United States. Box Zones may provide location-specific storage, but some metadata and processing may still occur in the United States.
• Users retain ownership of uploaded Content, but sharing Content may allow recipients to access and use it without further restrictions or compensation.
• Box does not guarantee Content will be secure or free from loss or damage.

2. User Rights

• You retain ownership of your Content and confidential information.
• You may generally request access to Content after account termination, but the request must be made within 14 days. Box has no obligation to preserve or retrieve Content after that period.
• This access right may not apply when Box terminates an account for violating the Terms or Acceptable Use Policy.
• You may unsubscribe from commercial communications through account settings, by contacting privacy@box.com, or through Box’s preference center. Service and administrative notices may still be sent.
• The Terms do not independently describe rights to access, correct, delete, restrict, or export personal data. Those rights must be determined from the Privacy Policy and applicable law.
• If an employer, school, or other organization manages your account, it may view usage and profile data and manage, modify, or delete Content.

3. Third-Party Sharing

• Box may share information with agents and service providers acting on its behalf to operate the Services.
• Disclosure may also occur when legally required or to address emergencies.
• Optional third-party applications and products operate under separate agreements between you and the third-party provider. Box disclaims responsibility for those products and their handling of information.
• Organization-managed accounts may be accessible to the organization’s administrators.
• Box Zones may involve third-party infrastructure providers, although the current Terms do not identify them by name.

4. AI/ML Training

• For Box AI, Box states it will not train Box AI using your queries or outputs without explicit consent.
• Box AI may nevertheless modify, aggregate, de-identify, or otherwise process confidential information to generate requested outputs.
• Queries and outputs are treated as your confidential information, but are not “Content.”
• AI outputs are not human-generated or human-filtered. Box disclaims responsibility for accuracy, bias, and your reliance on outputs.
• You are responsible for obtaining legally required notices and consents if AI queries contain personal or sensitive data.

5. Key Obligations and Restrictions

Users must:

• Provide accurate, current registration information;
• Protect credentials, avoid account sharing, and promptly report unauthorized use;
• Maintain rights and permissions for all Content;
• Comply with applicable laws, export controls, and intellectual-property rights;
• Use separate accounts for separate users;
• Avoid malware, harassment, unlawful or harmful Content, unauthorized access, scraping, bots, service disruption, resale, reverse-engineering-type conduct, and exceeding plan or usage limits.
• Organizations must maintain sufficient user licenses. Box may bill for excess users after notice, and excess charges generally are not refundable.
• Box Sign users must determine legal suitability and preserve signed files and logs themselves.
• AI users are responsible for retaining outputs and evaluating their legality and reliability.

6. Liability and Disputes

• Services are provided “as is” and “as available.” Box disclaims implied warranties and does not promise uninterrupted, error-free, secure, or loss-free service.
• Box’s aggregate liability is generally limited to the greater of 1.5 times the most recent monthly or annual fee paid or $100, excluding certain indemnification obligations. Consequential, special, punitive, and similar damages are excluded where legally permitted.
• You may have to indemnify Box for third-party claims involving your Content, unlawful use, or infringement.
• U.S. users: California law; exclusive courts in Santa Clara County.
• Most non-U.S. users: England and Wales law; exclusive courts in London.
• Japan users: Japanese law; exclusive courts in Tokyo.
• Claims generally must be pursued individually rather than through class, consolidated, or representative proceedings, to the extent legally permitted.

7. Changes and Termination

• Box may change the Terms and will post the latest version online.
• Material changes may be notified through the Services and/or by email. Continued use after notice or publication constitutes acceptance.
• To reject changes, users must stop using the Services and cancel.
• Box may suspend or terminate access for violations, risk of harm, nonrenewal, or potentially at its discretion. Content may become inaccessible, so maintain independent backups.