01Who we are and what this covers
NoaBox is a project-management service operated by WeStack Solutions LLP (“NoaBox”, “we”, “us”). This policy covers the NoaBox web app at app.noabox.ai and your workspace addresses (<workspace>.noabox.ai), our integrations with Slack and GitHub, emails we send, and this website.
For your account information (who you are, how you sign in, billing contacts) we decide how it’s used. For the content your team puts in a workspace (work items, comments, pages, files and AI conversations), the organization that owns the workspace decides what goes in and who sees it, and we process it on its behalf to provide the service.
02What we collect
Account information
- Your email address and name, and optionally an avatar.
- If you sign in with Google or GitHub: your name, email, profile picture and account ID from that provider, and the access tokens it issues to us.
- Answers you give during onboarding (such as your team and role) and preferences such as theme.
Workspace content
- Workspaces, projects, members, roles and invitations (including the email addresses you invite).
- Work items, comments, labels, dates, time entries and the history of changes to them.
- Pages, files and attachments you upload. Password-protected pages are stored only in encrypted form.
- Notifications we generate for you.
Noa (AI) conversations
- The messages you send to Noa and its replies, including text extracted from files you attach to a conversation.
- Whether web search was on for a message, and records of AI usage (model, tokens and credits) for billing and limits.
Integrations you connect
- Slack: your Slack workspace’s ID and name, an encrypted bot token, and the link between each Slack member and their NoaBox account, which we make by matching email addresses.
- GitHub: the repositories you grant, and for linked commits the message, link, branch, time and the author’s name, GitHub username and avatar. We don’t store commit authors’ email addresses.
Billing information
- Your Stripe customer ID, plan, subscription status, invoices and credit-pack purchases, and the billing contact’s email. Card details are entered on Stripe’s pages; we never receive or store them.
Security and usage information
- Sign-in sessions, including the device’s browser details and IP address, which you and your workspace admins can review.
- A workspace audit log of changes (who changed what, with old and new values), visible to workspace admins.
- Basic request logs (address requested, status and timing). These don’t include your IP address or the contents of your requests.
03How we use information
- To provide NoaBox: create your account and workspace, store and show your content, and run the features you use.
- To sign you in and keep your account secure, including one-time codes, session management, rate limits and lockouts.
- To send service emails (sign-in codes, invitations, verification) and notifications, including Slack DMs if your workspace connects Slack.
- To run Noa when you or a teammate ask it something, and to meter AI credits.
- To bill for paid plans and credit packs, and to enforce plan limits.
- To provide support, investigate problems and comply with the law.
We don’t sell personal information, we don’t use it for advertising, and we don’t use your workspace content to train AI models.
04Noa and AI processing
Noa runs on Anthropic’s Claude models. When you use Noa (in the app or by mentioning @NoaBox in Slack), we send Anthropic what it needs to answer: your message, recent messages in the conversation, the text of files you attached, and workspace information Noa looks up for you, such as work items, comments, time logs, activity and members’ names and email addresses. Noa only looks up what the person asking is allowed to see.
If you turn on web search for a message, Anthropic runs the searches Noa writes. Web search is off by default and isn’t available in Slack.
Under Anthropic’s commercial terms for API customers, Anthropic doesn’t use this data to train its models. Your conversations are stored in NoaBox until you delete them, or until your account or workspace is deleted.
AI output can be wrong. In the app, Noa proposes tickets and edits that a person has to confirm; in Slack it acts only when asked, with the asking person’s permissions.
07How long we keep information
- Account and workspace data: for as long as the account or workspace exists.
- Noa conversations: until you delete them, or until your account or workspace is deleted.
- Sign-in codes expire after 10 minutes, invitations after 7 days (unless renewed), and sign-in sessions after 30 days.
- Session records, the audit log and AI usage records are kept for security and billing for the life of the workspace.
- Billing records may be kept longer where tax or accounting law requires it.
08Deleting your data
You can delete any Noa conversation at any time.
To delete your account, email founders@noabox.com from the address on the account. Deleting it removes your profile, sign-in methods, sessions, memberships, Noa conversations, AI usage records, time entries and notifications. Content you created inside a workspace, such as work items, comments, pages and files, belongs to that workspace and stays there without your name attached. Workspaces you own are not deleted automatically, so delete or hand over those workspaces first, and cancel any paid plan.
A workspace owner can delete the whole workspace. This removes its members, projects, work items, comments, pages, files metadata, AI conversations, audit log and integrations, and cancels any paid subscription immediately.
Uploaded files are not yet erased from storage automatically when they’re deleted in the app. To have them erased, or to request a copy or deletion of any other data, email founders@noabox.com and we’ll take care of it.
09How we protect information
- Connections to NoaBox, our database and file storage are encrypted in transit (TLS).
- Sign-in codes, session tokens and invitation links are stored only as hashes; Slack tokens are encrypted.
- Password-protected pages are encrypted in your browser with AES-256; we never see the password, and a lost password can’t be recovered.
- Sessions can be revoked instantly, and sign-in attempts are rate-limited.
- Incoming webhooks from Stripe, GitHub and Slack are verified with signatures.
No system is perfectly secure. If we learn of a breach that affects your information, we’ll tell you and the relevant authorities as the law requires.
10International transfers
NoaBox is operated from India, our servers run in Google Cloud’s Mumbai region, and some providers, including Anthropic, process data in the United States and other countries. Where the law requires it, we rely on appropriate safeguards for these transfers, such as standard contractual clauses.
11Your rights
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict how we use it, and to withdraw consent. Users in the EU, UK and India (under the GDPR, UK GDPR and the Digital Personal Data Protection Act, 2023) have these rights by law.
To use them, email founders@noabox.com. If your information is in a workspace run by your employer or another organization, we may refer your request to that organization. You can also complain to your data-protection authority.
12Children
NoaBox is for teams at work and isn’t directed at children. You must be at least 16 to use it.
13Changes to this policy
If we make material changes, we’ll update the date above and let account owners know by email or in the app before the changes take effect.
14Contact
WeStack Solutions LLP operates NoaBox. For privacy questions, requests or complaints, including as our grievance contact, email founders@noabox.com.