BlackBox is operated by BlackBox Intelligence Ltd ("we", "us", "our"). This policy explains how we collect, use, store, and protect personal data when you use the BlackBox platform at blackbox.fyi.
We are the data controller for personal data processed through the Service. For GDPR purposes, our lawful bases for processing are contract performance (generating the report you requested) and legitimate interests (platform security and abuse prevention).
We collect the following categories of data:
| Category | Examples | Why we collect it |
|---|---|---|
| Report inputs | Location, operation type, situation brief, subject name, email (if provided) | To generate the intelligence briefing you requested |
| Correspondence | Name, email address and message content submitted through the contact form | To answer your enquiry |
| Account data | Email address, remaining report credits, access code | Account management and billing |
| Technical data | IP address, browser type, access timestamps | Security, abuse prevention, platform reliability |
| Payment data | Transaction records (payment details handled by Stripe) | Billing and fraud prevention, card details are handled by Stripe and not retained by us |
| Cookies | Signed account cookie (bb_email) | Identifying a paid report account. No tracking cookies. |
Third-party subject data. When you provide a subject name, email, domain, or other information about a third party for enrichment purposes, you are responsible for ensuring you have a lawful basis to process that information and that its use complies with applicable data protection law in your jurisdiction.
We use your data to:
We do not sell your personal data to third parties. We do not use your data for targeted advertising. BlackBox products are ad-free.
We share data only with the following categories of third party, and only to the extent necessary:
We will disclose personal data to law enforcement or regulatory authorities where required to do so by applicable law, or to protect the rights, property, or safety of BlackBox, our users, or third parties.
Reports are never written to a database. A finished report is held in server memory for up to 15 minutes so your browser can collect it, then discarded. We cannot retrieve a report after that point, and neither can you — download the PDF before you leave the page.
We do not retain the contents of your situation brief, subject details, or any other report input beyond the life of the request that produced it.
Server logs record the fact and outcome of each request — timestamps, IP address, status codes and errors — and are retained for 30 days for security and abuse prevention.
Your email address and remaining report credits are held in our database for as long as you hold credits, and for a reasonable period afterwards to comply with legal obligations and resolve disputes. Payment records are retained for six years to meet tax and accounting requirements.
Contact form correspondence is retained for 12 months from the date of the last message in the exchange.
You may request deletion of your data at any time — see Your Rights below.
BlackBox sets one cookie. After a completed purchase we set bb_email, a signed, HttpOnly, Secure cookie holding the email address you paid with, so the site can identify your account and check your remaining credits. It lasts 365 days. If you change browser or device, enter the access code issued at checkout on the report generator to set this cookie again. There is no password gate.
There is no automated recovery for a lost access code. If you lose yours, you can contact support@blackbox.fyi and we'll assist where possible, but this is handled case-by-case rather than as a standard account-recovery process.
We set no analytics, advertising, or tracking cookies of any kind, and we do not use an analytics platform.
Our cookie notice records your acknowledgement in your browser's local storage under bb_cookie_consent. That value never leaves your device and is not sent to us.
Full detail is in our Cookie Policy.
If you are a resident of the UK, European Union, or California, you have the following rights regarding your personal data:
To exercise any of these rights, contact us at support@blackbox.fyi. We will respond within 30 days. Where we cannot satisfy your request, we will explain why.
If you believe we have not handled your data appropriately, you have the right to lodge a complaint with the relevant supervisory authority (in the UK: the ICO; in the EU: your national data protection authority).
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Access to platform systems is restricted. Sensitive configuration values are stored as environment variables, not in source code.
No method of transmission over the internet is completely secure. We cannot guarantee absolute security, but we take it seriously and will notify you if we become aware of a breach affecting your data.
Our platform is hosted on infrastructure that may process data in the United States and other jurisdictions. Where we transfer personal data outside the UK or EEA, we ensure appropriate safeguards are in place, including standard contractual clauses or equivalent mechanisms recognised under applicable data protection law.
BlackBox is not directed at or intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, contact us immediately at support@blackbox.fyi.
We may update this Privacy Policy from time to time. Material changes will be communicated via a notice on the platform or by email. The date at the top of this page indicates when it was last updated. Continued use of the Service after changes take effect constitutes your acceptance of the updated policy.
Privacy and general enquiries: support@blackbox.fyi
BlackBox Intelligence Ltd · blackbox.fyi