How we keep your data safe

Last updated: November 7, 2026

A short summary for owners: what the assistant can and can't do, where your information goes, and what happens if something goes wrong. Print or save as PDF

Think of it as a new employee

• It gets its own logins. We set up accounts for the assistant, the way you would for a new hire. It never uses your personal password.
• It only opens what you allow. You choose which inboxes, calendars, folders and tools it can reach, and you can add or remove access at any time.
• Read-only where it can be. If a job only needs to look something up, it gets permission to look, not to change.

Nothing goes out without your OK

• Emails, replies, quotes and posts wait as drafts until a person approves them.
• Routine sends, like appointment or payment reminders, run only on rules you've approved, from templates you've seen.
• It never pays, refunds, deletes, or changes account settings on its own.
• Instructions hidden inside an email or document can't make it send, forward or share anything. Anything an incoming message sets off becomes a draft for you to check.

Where your information goes

With the office computer

• Your files, the assistant's logins and its history stay on the computer in your office, on an encrypted disk.
• When it works on a task, it sends the AI provider only the text that task needs, through an account in your business's name.
• StaffBox doesn't keep copies of your data.

Online, from your phone or browser

• What you type or upload goes through our server to the AI provider to do the job. Our server doesn't store it.
• Your results are kept in your own browser. Use Sign out to remove them, for example on a shared office computer.
• We keep only a count of how much you used, to apply your plan's limits.

The AI providers

• We use business accounts, not personal ones, and choose providers whose business terms say your content isn't used to train their models.
• Our current provider deletes what it receives within 30 days. Content flagged for misuse can be kept longer under its terms.
• That processing may happen outside Canada, usually in the United States. During setup we tell you which providers your box uses.

What we keep out

Some information never goes near the assistant, whatever your business:

• Passwords, card numbers and banking details
• Social insurance numbers, ID documents and credit reports
• Health records, treatment notes and medical history
• Details about children beyond what a booking needs

If your business holds any of these, we set the assistant up so it can't reach them, and we tell you what's excluded.

When we help remotely

• We connect only when you approve it, and you can see the session.
• Every session is logged: when, how long and what was done.
• Our accounts use two-step login, and each client's access is kept separate.
• You can remove our access at any time.

If something goes wrong

• Switch it off. Unplug the office computer, or tell us and we'll pause the assistant straight away. Online, we can pause an account in minutes.
• Everything is logged. The assistant records what it did, when and why, so we can see exactly what happened.
• We tell you promptly. If we learn of a problem that could affect your information, we tell you without delay, so you can meet your own duties under Canadian privacy law.

If you stop using StaffBox

• We remove our remote access and hand over the computer's admin account.
• We change the assistant's passwords and switch off its connections to your tools.
• On request, we wipe the computer and confirm it in writing. The hardware and your AI accounts stay yours.

Questions

Ask us anything before you start. Use the contact form on our home page and we'll answer in plain language. Our privacy policy has the full details.