BoultBox Privacy Policy

Released on Jun 26, 2025

Effective from Jun 26, 2025

Thank you for using BoultBox. BoultBox is provided to you by Transcodezy IT Solutions Pvt. Ltd. (hereinafter referred to as "Transcodezy", "we", or "us"). We are committed to protecting your privacy. This Privacy Policy sets out how we collect, store, process, share and use your information when you access our website, software, and services (the "Services").

We only collect and use your personal information for legal, legitimate, and necessary purposes. Specifically, we collect and process your personal information to provide you with our services and functions. If you use other people's personal information to access our services and functions, please ensure that you have been authorized to do so, and we reserve the right to verify if such personal information is legally used at any time.

We will ask for your separate consent in specific circumstances in strict accordance with laws and regulations. In addition to this Privacy Policy, we may also explain our rules for processing your personal information through notifications on pages of the product, pop-up prompts, push notifications, and so forth. The processing of personal information for each service or function is subject to specific rules, which have the same effect as this Privacy Policy.

What information is collected and for what purpose

The table below lists the types of information you submit to us when you use the Services and the purposes for which we may use that information. We collect and use the following information to deliver, optimize, protect, and promote the Services.

You can create a BoultBox account using your email and complete your account information.

In the event that it is required by laws and regulations, necessary for us to provide the product or the Services...

The above information is collected for the purpose of reliably and securely providing the Services and for legitimate business purposes...

You agree that we can aggregate, integrate, identify, analyze, portray, or further process the personal information...

You have the right to refuse the automated decision-making service implemented by us.

We may use your Account Data for marketing purposes and send you information about BoultBox’s new products...

Provision of personal information to third parties

We will not reveal your personal information to any third party without your prior consent, except under any of the following circumstances:

• (a) We are required to cooperate with national or regional governmental organizations...
• (b) Where there is a substantial risk to a person's life or property;
• (c) Where there is a particular need to improve public health or promote the healthy development of youth.

For the sharing, transfer, or disclosure of your personal information under the above exceptional circumstances...

• (1) Names and contact details of the data controller and data protection officer;
• (2) Purpose of data processing;
• (3) Descriptions of the data subject type and the personal data type;
• (4) The type of recipient to whom the personal data has been or will be disclosed...
• (5) Records of transfer of personal data to a third country or international organization and records of appropriate safeguards;
• (6) Expected time to delete different types of data;
• (7) General description of technical and organizational security measures.

Sharing data with other users

When you use the Share functions of BoultBox, the Services display your nickname, email address, and usage information to users that you cooperate with, or information that you permit to share. This enable other users to share files and folders with you.

We may share your information with third parties

We may work with certain trusted third parties (such as customer support or IT service providers) that can help us better deliver, optimize, protect, and promote the Services. These third parties may have access to your information to perform tasks on our behalf, during which we remain responsible for the third parties' handling of your information in accordance with our requirements.

We may share infrastructure, systems, and technology with Flextech affiliates to deliver, optimize, protect, and promote the Services. These affiliates will use your information in conjunction with us and the information you have listed in the "What information is collected and for what purpose" section for the purposes described therein. We will be responsible for granting these companies access to your information.

You may choose to connect to your BoultBox account through a third-party service. By connecting to a service of this kind, you allow the third parties and us to exchange the information listed in the "What information is collected and for what purpose" section of this Privacy Policy so that the third parties and we can deliver, optimize, protect, and promote their services. In these cases, the use of your information will be governed by the privacy policies and terms of service of the third parties whose services you choose to connect through.

We will establish an output mechanism for cross-border data transfer with reference to the requirements of the GDPR and update it as required. Our processing of personal data will depend on the fundamental principles of the GDPR, the consent of valid data subjects, or other legitimate reasons. Apart from that, additional mechanisms will be put in place to protect data and meet the substantive requirements of the GDPR for data processing.

How we protect and store your information

We have a team dedicated to keeping your information secure and testing for vulnerabilities. In addition to two-factor authentication, encryption of files at rest, and alerts when new devices and apps link to your accounts, we continue to work hard to ensure the security of your information. We deploy automated technology to detect abusive behavior and content that could harm you, other users, or the Services.

After you have signed up for a BoultBox account, we retain the information you store in the Services for as long as your account exists or as long as necessary to provide you with the Services. If you want to delete your account, please send an email to helpdesk@boultbox.com with such a request and we will delete your account within 30 days after receiving your request. However, 1) we will not delete your account information until we have verified your user identity; 2) such deletion of information from our servers and backup storage may be delayed; 3) we may retain this information if necessary to fulfill our legal obligations, resolve disputes, or exercise our rights under the Contract.

We will store your personal information for the period required for providing the Services. However, in the event that laws and regulations require otherwise, you agree to keep the information for a longer term, it is necessary to ensure the security and quality of the Services, the information is required to settle disputes, or it is technically intractable to process the information as required, we will extend the retention period as per laws and agreement or to a reasonable extent after the expiration of the aforesaid period.

When the retention period expires, we will delete your personal information or de-identify it in accordance with laws and regulations.

We will collect, use, store, and transfer your information based on the principle of "minimization", and inform you of the purpose and scope of use of the information by means of user agreement, privacy policy, rules, pop-up notifications, notices, and so on.

We attach great importance to information security. We have a dedicated team to develop and employ a variety of security technologies and programs. We carry out security background checks on personnel in charge of security management and those in critical security positions. We have established a complete information security management system and internal mechanisms for handling security events and more. We take appropriate security measures and technical means in line with industry standards to store and protect your personal information, so as to prevent your information from being lost or accessed, disclosed, used, damaged, or revealed without authorization. All reasonable and feasible measures are being taken for protecting your personal information. In addition, we use encryption technology to ensure the confidentiality of data and apply trusted protection mechanisms to prevent malicious attacks on data.

We train and assess our employees in terms of data security awareness and security abilities to enhance their comprehension of the importance of protecting personal information. We authenticate the identity of employees who process personal information and control their access, sign nondisclosure agreements with our employees and partners who have access to your personal information, and clarify job responsibilities and code of conduct, so that only authorized personnel can access personal information. In the event of any violation of the nondisclosure agreements, the employment will be terminated immediately with the violator held accountable by law. Moreover, there are also confidentiality requirements that relevant personnel must follow when they leave their posts.

We kindly remind you that the Internet is not absolutely secure. Hence, you should carefully protect your personal information when you interact with other users through third-party social software, emails, SMS, and other services integrated into BoultBox under the condition that you are uncertain whether your information is completely encrypted during transfer.

Also, we appreciate your understanding that due to the technical restrictions, rapid development, and various latent and malicious attacks pertaining to the Internet industry, we may not be able to keep your information secure a hundred percent even though we make every effort to enhance our security measures. Hence, the system and communication network based on which you use our product and/or the Services may encounter security problems in other processes beyond our control.

Our security management system regards the disclosure, damage, or loss of personal information as the most serious security event. Once it occurs, our highest-level emergency plan will be implemented with multiple departments dealing with the event as one emergency response team.

We formulate an emergency plan for network security events to promptly respond to system vulnerabilities, computer viruses, cyber-attacks, network intrusions, and other security risks. In case of an event endangering network security, we will immediately carry out the plan, take remedial actions, and report to competent authorities as required.

The disclosure, damage, and loss of personal information are regarded as the most serious security events. Accordingly, we organize members of working groups to perform security plan drills on a regular basis to avoid such events. In the event that such events do occur, we will carry out the emergency plan as a top priority and form an emergency response team to trace the cause and mitigate losses in the shortest time possible.

In case of a personal information security event, we will, as required by laws and regulations, inform you of the basic information about the security event and its possible impact, the measures we have taken or will take, recommendations on actively preventing and mitigating risks for you, and remedial measures for you. We will inform you of event-related information in a timely manner through our notifications or the contact information you have provided to us including SMS, phone number, and email address. If it is difficult to inform our users one by one, we will make announcements in a reasonable and effective way. Meanwhile, we will report the disposal of the personal information security event in accordance with the requirements of regulatory authorities. We appreciate your understanding that according to laws and regulations, if measures taken by us can effectively avoid the harm caused by disclosure, tampering, and loss of information, we may choose not to notify you of a personal information security event unless a regulatory authority requires us to do so.

We refer to the requirements of the GDPR, select appropriate measures for technical security protection based on the nature, scope, background, and purpose of data processing, as well as the risks to individuals, and regularly test and evaluate the measures to maintain their effectiveness.

If data is accidentally disclosed, we will notify affected people as soon as possible and report to competent authorities within 72 hours. If it is impossible to report it within 72 hours, the reason for the delay will be clarified.

We take appropriate technical and organizational measures to achieve our data protection objectives, such as the principle of data minimization and the integration of necessary safeguards into data processing to protect the rights of data subjects and make sure any data processed is necessary for a specific purpose by default.

Where we store and process your information

While providing the Services, we may store, process, and transfer your information in India, and you agree to provide your information. Your information may also be stored on the local device used to access the Services.

How you control and access your information

In accordance with laws, you can exercise your rights. Contact us at helpdesk@boultbox.com. You can view, change, download, delete, or share your info from your BoultBox account.

• 1. The right of access

You may know what personal information BoultBox collects, saves, and shares.

• 2. The right of rectification and supplementation

If any error exists in your personal information, you can rectify or add missing information.

• 3. The right of erasure

You may request us to delete your personal information in certain circumstances:

Our processing violates laws or your agreement.

Our processing purpose is fulfilled or no longer necessary.

We have stopped providing the product or retention period expired.

You withdraw your consent.

Other circumstances required by law.

Deleted data may remain in backups until updated.

• 4. The right of withdrawal of consent

You may withdraw consent for additional collection or use of personal information.

You can disable device permissions or change consent scope.

Withdrawal means we can’t continue that service, but past use is unaffected.

• 5. The right of account deletion

You may delete your BoultBox account.

[Menu] > [Settings] > [Security Center] > [Deleting an account].

Once deleted, you can’t use BoultBox. We’ll stop providing the Services and delete your personal information as required.

• 6. The right of copy and data portability

You have the right to copy your collected personal information or transfer it to another subject.

We’ll update third parties as needed to comply with your rights.

If your request is unjustified or excessive, we may:

• (a) Charge a reasonable fee for admin costs.
• (b) Refuse to act on the request.

You can control your personal information under Japan APPI:

• a. Request disclosure of retained info
• b. Request corrections or deletions
• c. Stop use if info obtained unlawfully
• d. Stop providing info to third parties unlawfully

Change

If BoultBox merges or reorganizes, your info may transfer to a new entity and you will be notified.

This policy may change; we’ll post updates and notify you if changes affect your rights.

Contact Us

If you have any questions or concerns about BoultBox, the Services, or your privacy, please feel free to contact us at helpdesk@boultbox.com