Privacy Policy

1. Introduction

Welcome to the Privacy Policy of impressBox ("we," "us," or "our"). We are committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website, use the impressBox Content Management System (the "Service"), or interact with us. Please read this policy carefully to understand our views and practices regarding your personal data.

2. Data Controller

For the purposes of the General Data Protection Regulation (GDPR) and other applicable data protection laws, the Data Controller is Dėžutė, UAB, located at Mindaugo str. 23A, LT-03231 Vilnius, Lithuania. We determine the purposes and means of processing your personal data when you create an account and use our Service.

3. Categories of Personal Data

We may collect and process the following categories of personal data about you:

3.1 Account Information

When you register for an account, we collect your name, email address, company name, billing information, and password (hashed).

3.2 Usage Data

We automatically collect information about how you interact with the Service, including IP addresses, browser types, log data, pages viewed, and timestamps.

3.3 Device Data

Information regarding the digital signage devices you connect to the Service, including hardware models, operating systems, network status, and MAC addresses.

3.4 Support and Communication Data

Records of your communications with our support team, feedback, and inquiries sent to us via email or contact forms.

3.5 End-User Data

If you utilize interactive features (e.g., remote control microsites or QR codes), we may temporarily process the IP addresses and interaction inputs of the end-users scanning those codes, strictly for the purpose of facilitating the interaction.

4. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Performance of a Contract: To provide you with the Service, manage your account, and handle billing.
• Legitimate Interests: To improve our Service, ensure security, prevent fraud, and provide technical support.

5. Purpose of Processing

We use your personal data to:

• Create and manage your impressBox account.
• Provide, operate, and maintain the Service.
• Process payments and manage subscriptions.
• Communicate with you regarding service updates, technical notices, and security alerts.
• Provide customer support and resolve technical issues.
• Analyze usage patterns to improve and optimize the Service.

6. Data Processing Roles

Under the GDPR, Dėžutė, UAB acts as a Data Controller for the personal data of our direct customers (account holders). However, regarding any personal data that our customers choose to display on their screens or collect from their viewers via the Service, the customer acts as the Data Controller, and we act purely as a Data Processor on their behalf.

7. Data Sharing

We do not sell your personal data. We may share your data with trusted third parties only in the following circumstances:

• Service Providers: Cloud hosting providers, payment processors, and customer support tools that assist us in operating the Service.
• Legal Requirements: If required by law, court order, or governmental authority to protect our rights or comply with legal processes.

8. International Transfers

We primarily store and process personal data within the European Economic Area (EEA). If we transfer your data outside the EEA to our service providers, we ensure appropriate safeguards are in place, such as the European Commission's Standard Contractual Clauses or ensuring the destination country has an adequacy decision.

9. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including the duration of your active subscription. Once your account is terminated, we will securely delete or anonymize your personal data within a standard retention period, except where we are required by law to retain it for a longer period (e.g., for tax or accounting purposes).

10. Security Measures

We implement appropriate technical and organizational security measures to protect your personal data from unauthorized access, accidental loss, disclosure, or destruction. This includes encryption of data in transit and at rest, secure access controls, and regular security assessments. However, no internet-based system is 100% secure, and we cannot guarantee absolute security.

11. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of Access: To request a copy of the personal data we hold about you.
• Right to Rectification: To request correction of inaccurate or incomplete data.
• Right to Erasure: To request the deletion of your personal data ("right to be forgotten").
• Right to Restrict Processing: To request a limitation on how we process your data.
• Right to Data Portability: To receive your data in a structured, commonly used format.
• Right to Object: To object to our processing of your data based on legitimate interests or direct marketing.

To exercise these rights, please contact us at [email protected].

12. Third‑Party AI Assistants and MCP Connectors

This section applies if you choose to connect your impressBox account to third‑party AI applications (such as Claude, ChatGPT, or similar AI assistants) via Model Context Protocol (MCP) or other API-based connectors provided by us.

12.1 User‑initiated access

The connector is inactive by default. It only functions if you manually configure your AI assistant to use our specific connector and provide a valid API Personal Access Token generated within your impressBox account.

12.2 Scope of access

When active, the connector allows the AI assistant to read or modify data in your impressBox account (e.g., viewing device status, modifying content, or scheduling playback) solely to fulfill the instructions you provide to that AI assistant.

12.3 Transmission to the AI provider

Data retrieved from your impressBox account through the connector is transmitted to the third‑party AI provider (e.g., Anthropic, OpenAI) to process your requests. The use of that data by the AI provider is governed by their own privacy policy and your agreement with them.

12.4 What the connector does not do

Our connector does not "train" AI models on your data unless explicitly permitted by your settings with the AI provider. It does not provide the AI provider with broad access to our database—only to the specific data requested by the AI assistant to answer your prompt.

12.5 Security

We recommend using scoped API tokens and regularly rotating them. You can revoke access at any time by deleting the API token in your impressBox settings.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by posting the new policy on this page and updating the "Last Updated" date. We encourage you to review this policy periodically.

14. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us at: