Privacy Notice

1. Who we are

SoftBox
Business ID: 1034495-8
Aittoniementie 67
12750 Pilpala
Finland

Privacy and support enquiries: [email protected]

2. Our role

SoftBox is the data controller for personal data used to operate the Sage Confirmation website and business, such as account, contact, billing, support and service-administration information.

Where a customer uploads purchase-order or supplier-confirmation content containing personal data, SoftBox generally processes that content on the customer's behalf. In that situation the customer determines why the personal data is used and is normally the controller, while SoftBox acts as its processor for the Service.

3. Personal data we may process

Depending on how you use the Service, we may process business contact and account information such as names, work email addresses, organisation details and authentication identifiers; billing and payment-request information; support messages and feedback; and technical or service information such as login/session data, timestamps, security information and PDF-extraction usage records.

Customer-provided purchasing content may include purchase-order data, supplier confirmations, supplier names, references, part numbers, quantities, prices, units, delivery dates and any personal data that the customer or supplier includes in those files.

4. Why we use personal data

We use personal data to provide and administer the Service, create and secure user access, process payment requests and invoices, provide support, troubleshoot problems, protect the Service against misuse, maintain business and accounting records, and make reasonable improvements to the beta.

For personal data for which SoftBox is the controller, the legal basis will depend on the context and may include performing a contract, complying with a legal obligation, or SoftBox's legitimate interests in providing, supporting, securing and improving a B2B software service. Where SoftBox processes customer content as a processor, the customer is responsible for determining the applicable legal basis for that content.

5. AI-assisted PDF extraction

If a user chooses the PDF Beta, the selected supplier-confirmation PDF is sent to the OpenAI API for structured extraction. The extracted fields are shown to the user for human review before they are imported and compared with the purchase order.

Sage Confirmation requests that the API response is not stored as application state. OpenAI states that data sent to its API is not used to train its models by default, although standard abuse-monitoring logs may be retained by OpenAI for up to 30 days unless different retention controls apply.

6. Service providers

SoftBox uses service providers to operate Sage Confirmation. Current providers include Supabase for authentication and database services, Railway for application hosting, OpenAI for optional AI-assisted PDF extraction, Cloudflare for domain/proxy and security services, and Google Workspace for business email and support communications.

These providers process data only as needed for their role in delivering the relevant service and under their applicable terms and data-processing arrangements.

7. International data transfers

Some service providers may process personal data in countries outside Finland, the European Economic Area or the United Kingdom. Where applicable data-protection law requires safeguards for an international transfer, SoftBox relies on the transfer mechanisms and safeguards available under the relevant provider arrangements.

8. How long we keep data

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including operating the beta, providing support, maintaining security and complying with accounting, tax or other legal obligations. Retention may also depend on the customer's instructions where SoftBox acts as a processor.

When data is no longer needed for those purposes, it will be deleted or anonymised where reasonably practicable, subject to legal or technical retention requirements.

9. Your data-protection rights

Depending on the applicable law and circumstances, you may have rights to request access to personal data about you, correct inaccurate data, request deletion or restriction, object to certain processing, receive portable data, and withdraw consent where processing is based on consent.

To exercise a right concerning data for which SoftBox is the controller, contact [email protected]. If your request concerns personal data contained in files supplied by your employer or another Sage Confirmation customer, you may need to contact that customer as the controller.

10. Automated decisions

Sage Confirmation does not use personal data to make solely automated decisions that produce legal or similarly significant effects on individuals. AI-assisted PDF extraction is reviewed by a user before import, and the deterministic comparison workflow is designed to surface purchasing differences for human review and action.

11. Security

SoftBox uses reasonable technical and organisational measures intended to protect personal data against unauthorised access, loss, misuse or alteration. Access to customer workspaces is authenticated and customer data is separated through application and database access controls.

12. Complaints

You can contact SoftBox first at [email protected] if you have a privacy concern. You also have the right to lodge a complaint with a competent data-protection authority. In Finland, the supervisory authority is the Office of the Data Protection Ombudsman. If UK data-protection law applies to you, you may also have the right to complain to the UK Information Commissioner's Office.

13. Changes to this notice

We may update this Privacy Notice as the beta, our providers or legal requirements change. The current version and its update date will be published on this page.