Privacy policy

Last updated: November 12, 2026

This page explains what information StaffBox collects, why, and what you can do about it. We've kept it short and in plain language.

Who we are

StaffBox is a business based in Toronto, Ontario. We install a Mac mini set up with AI tools in your office and help you run it. You can reach us through the contact form on our home page.

What we collect on this website

• What you send us. When you use the contact form, the trial application, the chat assistant (Laura) or email us, we receive what you provide, such as your name, work email, phone number, company, team size and your message. Laura is an automated assistant with set answers; it doesn't use AI, and nothing you type is sent anywhere until you finish giving your details. Forms and chats are delivered to our inbox by a form-delivery service, Web3Forms.
• The free AI report. When you ask for a free AI report, we open the public homepage of the website you enter, as any visitor would, and may ask Google's public speed test to check it. We don't store the report or the page. If you enter your mobile number to see the full report, we receive your number, the business name and website you entered, and your score, so we can call or text you about it.
• Basic visit records. Our website host keeps standard server logs, such as your IP address, browser type and the pages requested. The site also loads its fonts from Google Fonts, so Google receives your IP address for that request.
• Advertising measurement. This site uses the Meta Pixel, a tool from Meta (Facebook and Instagram). It sets cookies and tells Meta which pages you visit and whether you send a form, so we can measure our ads and show them to people who may be interested. Meta handles that information under its own privacy policy. You can limit this in your Facebook or Instagram ad settings, or with your browser's tracking protection. The private trial agent page doesn't load it.
• Site analytics. We use PostHog, an analytics service, to see how people use the site: which pages and sections they view, how far they scroll, whether they play the video, which buttons they click, and which step of a form they reach. It may also record sessions (mouse movements, clicks and page changes) so we can see where pages are confusing. Anything typed into a form is hidden from these recordings. In the trial workspace and portal we record only which features are used, never what you paste, upload or get back. PostHog uses a cookie and your browser's storage to recognise a returning visitor, and we don't link this to your name. If your browser sends a Do Not Track or Global Privacy Control signal, we don't load it at all.

What we collect for the free trial

• Your answers on the trial application: your name, contact details, and what you tell us about your business, your tools and your work.
• If you're approved, your trial link carries your name, your business name and a short summary of your application, so the agent starts with some context.
• What you type or upload in the trial workspace (messages, invoice lists, statements, receipt photos) is sent to our AI provider to do the job. Your results are kept in your own browser so you can come back to them; clearing your browser data removes them. We don't keep a copy of what you send or get back on our own systems, only a count of how much you used, and the AI provider may keep it for a limited time under its own terms.
• Please don't give the trial agent passwords, card numbers or private details about your customers or staff.

What we collect when you're a client

• Contact and billing details for your business.
• Notes about how your box is set up, so we can support it.
• A record of each remote support session: when it happened, how long it lasted and what was done.

What stays on your box

Your business files, the logins to your tools and the history of what the box has done are stored on the computer in your office. We don't copy them to our own systems.

We connect to your box remotely only when you approve it. During a session we may see what is on screen in order to help. We don't keep copies of it.

AI providers

Your box uses AI tools through accounts that belong to you. To carry out a task, the box sends the AI provider the text that task needs. Each provider handles that information under its own terms and privacy policy, which you agree to directly with that provider when you open your account. That processing may take place outside Canada. During setup we tell you which providers your box uses.

How we use information

• To reply to you and arrange a discovery call.
• To set up, support and bill for the service.
• To keep the service secure and working properly.
• To meet our legal obligations.

We don't sell personal information.

Who we share it with

We share information only with the service providers that help us run the business, and only as far as they need it to do that job:

• Vercel hosts this website and runs the server that passes trial and online requests to the AI provider.
• Upstash stores usage counts for trial and online accounts (name, business, plan and how much was used), not what you send.
• Our AI provider processes what you send in the trial and online workspace, and on your box through your own account. Our current provider deletes it within 30 days, except content flagged for misuse.
• Web3Forms delivers form and chat messages to our inbox.
• Google PageSpeed Insights may test the speed of a website address you enter for the free AI report.
• PostHog provides site analytics, and Meta measures our ads, as described above.
• Google Fonts serves the site's fonts.
• Our email, payment and remote-support tools, for clients.

We may also disclose information when the law requires it. If we learn of a breach that could affect your information, we'll tell you without delay.

Where it's stored and for how long

Some of our service providers store information outside Canada, including in the United States, where it is subject to the laws of that country.

We keep information for as long as we need it for the purposes above, or as long as the law requires. If you contacted us but didn't become a client, you can ask us to delete your enquiry at any time.

Your choices

Under Canadian privacy law you can ask to see the personal information we hold about you, ask us to correct it, or withdraw your consent to our using it. Send your request through the contact form on our home page and we'll respond within 30 days.

If you're not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada.

Security

We use reasonable safeguards to protect the information we hold. No system is perfectly secure, so we can't guarantee absolute security. How we keep your data safe explains the safeguards in plain language.

Changes to this policy

If we change this policy, we'll post the new version here and update the date at the top.