Privacy policy for the United States

This policy explains what personal information VizzBox collects, why, and what you can do about it. We've tried to write it the way we'd explain it to you in person. It's the version for people in the United States, and it includes the notices required by the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, the "CCPA") and similar state laws.

It covers our website at vizzbox.com, the VizzBox portal your organisation uses at its own address (for example, yourcafe.vizzbox.com), and the VizzBox player on your screens. You can reach us at support@vizzbox.com.

The short version

• We collect what we need to run VizzBox, and we use it for that.
• We don't sell your personal information, and we don't share it for cross-context behavioral advertising.
• We measure visits to our website with Google Analytics; you can turn it off, and we honor Global Privacy Control.
• The content an organisation puts on its screens belongs to that organisation.
• You can ask to know, correct or delete your personal information.

When you visit our website

Measuring visits. On vizzbox.com we use Google Analytics (through Google Firebase) to count visits and see which pages are useful. It sets cookies and records things like the pages you look at, roughly where you are (worked out from your IP address), and your device and browser. You can turn it off at any time with "Cookie settings" at the bottom of every page, and it doesn't run at all if your browser sends a "Global Privacy Control" or "Do Not Track" signal. It never runs in organisations' portals or in our staff console. We use it only to understand our own website, not for advertising.

Prices and this policy. To show prices in dollars or rupees, and the right version of this policy, our server looks up which country your IP address is in, using a database that runs on our own server (from DB-IP). Your address isn't sent anywhere else for this.

Your choices in your browser. The language you pick and your choice about measurement are kept in your browser's local storage.

Fonts. The site's typefaces come from Google Fonts, so Google receives your IP address when a page loads.

Logs and error reports. Our servers keep short technical logs (IP address, the page requested, browser type) to keep the service running and secure, and if something breaks in your browser, the page may send us a report of what went wrong.

The live demo. The demo page plays our own made-up café's screen. Watching it records nothing about you beyond what's described above.

When your organisation uses VizzBox

Your account. Your name, email address, role and preferred language, and your password, which we store only as a secure hash that nobody can read back.

Your organisation. Its name and portal address, the locations and screens you add, and the people you invite.

Your content. The pictures, videos, PDFs, web page links, designs and schedules you add. They're yours: we store and process them only to show them on your screens.

Your screens. Each player sends us what's needed to manage it: the device model, its Android version or browser, screen size, app version, network status and when it last checked in. It also records what it played and when (proof of play), which you can download as reports. On an Android player, someone in your organisation can ask for a screenshot of what the screen is showing; screenshots are kept with your organisation's data.

Payments. Payment is handled by Stripe, which collects your card details; we never see or store them. We keep a record of your plan, your payment status and your billing country.

Emails. We send the emails the service needs: help signing in, invitations, alerts when a screen goes offline, and billing notices. We don't send marketing emails unless you've asked for them.

What the CCPA asks us to tell you

In the last 12 months we've collected these categories of personal information:

We collect this from you, from your organisation, from your screens, and from our website analytics. We keep each category as described under "How long we keep it" below.

We disclose personal information to our service providers for business purposes only: DigitalOcean (hosting), Google (website analytics, notifications to Android players, fonts), Stripe and Razorpay (payments), and an email delivery service. We don't sell personal information, we don't share it for cross-context behavioral advertising, and we have no actual knowledge of selling or sharing the personal information of anyone under 16.

How long we keep it

• Your account and your organisation's data are kept for as long as your organisation uses VizzBox.
• When an organisation is closed, we keep its data for 30 days in case the closure was a mistake, then delete it, apart from records the law requires us to keep, such as invoices and payment records.
• A copy of your data that you ask to download stays available for a week, then it's deleted.
• Backups and server logs are kept for a limited time and then removed.

Your rights

Depending on the state you live in, including California, you have the right to:

• know what personal information we've collected about you, where it came from, why, and who we've disclosed it to, and get a copy of it;
• have it corrected if it's inaccurate;
• have it deleted, subject to exceptions the law allows;
• opt out of the sale or sharing of your personal information (we don't do either) and of targeted advertising (we don't do it);
• not be discriminated against for using any of these rights.

To make a request, write to support@vizzbox.com. We'll need to confirm it's you, usually by asking you to reply from the email address on your account. You can also use an authorized agent, who will need your signed permission. We'll answer within 45 days, as the law requires. If we turn down your request in a state that allows appeals, you can appeal by replying to our answer.

An organisation's owner can also download a copy of the organisation's data from the portal, and close the organisation there, which deletes its data as described above. If you use VizzBox as a member of an organisation, that organisation decides much of what's stored about you; you can ask them, or us.

Children

VizzBox is a tool for businesses and isn't meant for children. We don't knowingly collect personal information from anyone under 18.

Keeping it safe

Passwords are hashed, the website and the portal only work over encrypted connections, each organisation's data is kept separate from every other organisation's, and only the staff who need it can reach it. No system is perfectly secure, so please use a strong password, and tell us at support@vizzbox.com if you notice anything wrong.

Changes to this policy

When we change this policy we'll update the date at the top, and we'll email account owners about any change that matters to them.

Contact

VizzBox, support@vizzbox.com