Privacy Policy — Yackbox

1. Who We Are

Yackbox is a multi-channel organizational communication platform operated by Zengy Inc., a California corporation located at 18685 Main Street, #101-625, Huntington Beach, CA 92648.

In this Privacy Policy, "Yackbox," "we," "us," and "our" refer to Zengy Inc. "You" or "Customer" refers to the organization or individual who has registered for a Yackbox account. "Members" refers to the end recipients whose contact information is managed within your Yackbox account.

For privacy questions, contact us at: privacy@yackbox.com

2. Information We Collect

2.1 Account and Organization Information

When you create a Yackbox account, we collect:

Your name and work email address
Your organization's name
Billing and payment information (processed by Stripe; we do not store full card numbers)
Account credentials (passwords are hashed and never stored in plain text)

2.2 Member Contact Data

As a Yackbox customer, you upload and manage contact data for your organization's members. This data may include:

Names
Email addresses
Phone numbers (for SMS and WhatsApp)
Communication preferences and channel opt-in status
Custom fields you define

You are the data controller for your members' information. We process this data as your service provider (data processor) according to your instructions and our Terms of Service.

2.3 Consent and Compliance Records

Yackbox maintains timestamped records of all opt-in and opt-out events, including:

Channel (email, SMS, WhatsApp)
Consent source (how consent was obtained)
Date and time of opt-in or opt-out
IP address at time of consent (where applicable)

These records exist to help you demonstrate compliance with applicable laws. They are your organization's records, accessible to you at any time, and are never used by Zengy Inc. for any marketing purpose.

2.4 Message Delivery Data

When messages are sent through Yackbox, we collect delivery data including:

Delivery status per recipient (delivered, failed, bounced)
Email open and click events (tracked via pixel and link rewriting)
SMS delivery receipts from Twilio
WhatsApp read receipts
Opt-out events triggered by STOP replies, unsubscribe clicks, or in-app preference changes

2.5 Usage and Technical Data

We automatically collect technical data when you use Yackbox, including:

IP addresses and approximate location
Browser type and version
Pages visited and features used within the application
Error logs and diagnostic data

3. How We Use Information

We use the information we collect to:

Provide, operate, and improve the Yackbox service
Authenticate users and maintain account security
Process and deliver messages you send through Yackbox
Track delivery, open, and engagement statistics and report them to you
Maintain consent audit logs for compliance purposes
Process billing and payments
Send transactional communications about your account (service updates, billing, security)
Respond to support requests
Comply with legal obligations

We do not use your members' contact data to contact them for our own purposes. We do not use your members' data for advertising. We do not sell or rent any personal data to third parties.

4. SMS and Messaging Disclosures

SMS opt-in data and consent records collected through Yackbox are not shared with third parties for marketing or promotional purposes.

SMS messages sent through Yackbox are delivered via Twilio, Inc., our SMS infrastructure provider. Twilio processes phone numbers and message content solely to deliver messages. Their privacy policy is available at twilio.com/legal/privacy.

WhatsApp messages are delivered via the WhatsApp Business API through Meta Platforms, Inc. Their data practices are governed by Meta's privacy policy.

Email messages are delivered via Resend, Inc. Their privacy policy is available at resend.com/privacy.

Opt-Out Processing

Members can opt out of messages at any time:

SMS: Reply STOP to any message. Reply HELP for assistance.
Email: Click the unsubscribe link in any email, or use the List-Unsubscribe header.
WhatsApp: Use the opt-out link included in messages, or contact your organization directly.
All channels: Members can update all preferences through their personal preference portal link.

Opt-out requests are processed immediately. Message and data rates from your mobile carrier may apply to SMS messages.

5. How We Share Information

We share information only as necessary to operate the service:

Twilio: Phone numbers and message content, for SMS and WhatsApp delivery
Resend: Email addresses and message content, for email delivery
Stripe: Payment and billing information, for payment processing
Cloud infrastructure providers: Hosting and database services

All service providers are contractually bound to use your data only to perform services for Yackbox and are prohibited from using it for their own marketing purposes.

We may disclose information if required by law, court order, or to protect the rights and safety of Yackbox, our customers, or the public.

We do not sell personal data. We do not share personal data with advertising networks or data brokers.

6. Data Retention

We retain account data for as long as your account is active and for up to 90 days after account termination, after which it is deleted. Consent audit logs and compliance records are retained for a minimum of five years to support regulatory compliance requirements. You may request earlier deletion subject to applicable legal obligations.

Message content and delivery logs are retained for 24 months and then purged.

7. Security

We implement industry-standard security measures including:

Encryption in transit (TLS 1.2 or higher) for all data
Encryption at rest for sensitive data
Hashed and salted password storage (bcrypt)
Role-based access controls
Regular security reviews

No system is perfectly secure. If you believe your account has been compromised, contact us immediately at security@yackbox.com.

8. Your Rights

Depending on your location, you may have rights regarding your personal data, including:

Access: Request a copy of the data we hold about you
Correction: Request correction of inaccurate data
Deletion: Request deletion of your account and associated data
Portability: Request export of your data in a machine-readable format
Objection: Object to certain processing of your data

To exercise these rights, email us at privacy@yackbox.com. We will respond within 30 days.

If you are a member of an organization that uses Yackbox and wish to access, correct, or delete your data, you should contact that organization directly, as they are the data controller for your information.

9. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act and California Privacy Rights Act. We do not sell personal information as defined under California law. We do not share personal information for cross-context behavioral advertising.

California residents may submit rights requests to privacy@yackbox.com or by writing to: Zengy Inc., 18685 Main Street, #101-625, Huntington Beach, CA 92648.

10. Children's Privacy

Yackbox is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a minor, contact us at privacy@yackbox.com.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice in your Yackbox account. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of Yackbox after changes take effect constitutes acceptance of the updated policy.

12. Contact Us

For privacy questions or to exercise your rights:

Email: privacy@yackbox.com
Mail: Zengy Inc., Attn: Privacy, 18685 Main Street, #101-625, Huntington Beach, CA 92648