Privacy-first setup for European customers

BoxSofa limits customer data and analytics to what is useful, secure and transparent for European customers.

Essential data

We collect the information needed to process an order, including contact details, delivery address, selected products and support messages.

Checkout and first-order offer

We use your checkout email and successful payment history to check first-order eligibility. An essential checkout cookie keeps your unfinished discounted payment private so you can continue or cancel it; the cookie expires after 72 hours. Order and offer records are kept as needed for fulfilment, fraud prevention and legal duties.

Analytics consent

Traffic source and conversion analytics are optional. They are only recorded after the visitor accepts analytics cookies or tracking in the consent banner.

Customer account data

Customer login is used to show that customer only their own orders, membership status and support history.

Data processors

Supabase provides database and account services, Vercel hosts the website, Stripe processes secure card payments and Resend supports transactional email delivery. Each provider processes data only for the relevant service.

Questions and rights

Customers may ask to access, correct or delete eligible personal data by contacting BoxSofa support. Some order and payment records may be retained where required for legal, tax, fraud-prevention or dispute purposes.