Privacy Policy

Customers: the businesses that sign up for MesaBox and the people on their teams. We decide how customer account data is used.

Visitors: people who use a MesaBox chat box on a customer’s website or MesaBox page. The customer decides how that information is used, and we process it on their behalf and under their instructions.

Account data: name, business name, email, mobile number, website, and a password stored in hashed form. Team members’ names, emails and roles.

Unfinished sign-ups: if you start signing up and stop before adding a card, we keep what you entered (email, and your name, business, mobile number and website if you got that far) so we can follow up about your sign-up.

Billing data: handled by our payment processor, Stripe. We never see or store full card numbers; we keep only the card brand, last four digits, and expiry date.

Visitor submissions: what a visitor types or uploads into a chat box, such as project details, name, email, phone number, files, and the time they chose for a call.

Technical data: IP address (used to keep the service secure and to stop abuse), browser and device information, the page where a chat box was used, and time zone (so call times show correctly).

Browser storage: we use your browser’s storage to keep you signed in and to remember a visitor’s progress. We don’t use advertising cookies or track people across other websites.

To run the service: deliver leads, book calls, send the confirmations, reminders and notifications MesaBox provides, and keep accounts secure.

To read project descriptions: when a visitor describes a project in their own words, we send that text to our AI provider, Anthropic, which organizes it into the business’s questions. Anthropic processes it only to provide this service and does not use it to train its models.

To bill customers and send receipts.

To prevent spam, fraud and abuse, including limits on how often a chat box can be used.

To improve MesaBox using aggregated information. We don’t sell personal information, and we don’t use visitor submissions for advertising.

We share data only with service providers that help us run MesaBox, under confidentiality and data-protection terms: Supabase (database, file storage and servers), Stripe (payments), Resend (email delivery), Anthropic (AI reading of project descriptions), Twilio (text messages), Google Workspace (our own email and support), and Lovable (website hosting).

We may also disclose information when the law requires it, to protect people’s safety or our rights, or as part of a merger or sale of the business, in which case this policy continues to apply.

Some MesaBox features send text messages: a booking link when a caller asks for one during a call with a business’s MesaBox phone assistant, a booking confirmation and reminder when a visitor checks the box to get them, and account alerts that MesaBox customers turn on in Settings. We send them through our provider, Twilio.

Message frequency varies. Message and data rates may apply. Reply STOP to any message to stop getting texts, or HELP for help. You can also email contact@mesabox.ai.

We don’t sell, rent or share mobile numbers or text message consent with third parties or affiliates for their marketing or promotional purposes. Text message opt-in data and consent are never shared with anyone except the providers that deliver the messages.

We keep account and lead data while a subscription is active. After cancellation, leads remain available to view and export for 30 days, and are then deleted. Leads marked as spam are deleted after 30 days.

Deleting an account removes its data right away, except records we must keep for billing, tax or legal reasons. Backups roll off within 30 days.

Details from unfinished sign-ups are kept for up to 12 months. Email contact@mesabox.ai to have them deleted sooner.

Customers can view, update or delete their account from Settings, and export their leads at any time.

Visitors who want to see, correct or delete what they submitted should contact the business whose chat box they used. We’ll help that business respond.

Depending on where you live (including California and other US states), you may have rights to access, correct, delete or get a copy of your personal information, and to not be treated differently for using them. Email contact@mesabox.ai and we’ll respond within 45 days.

MesaBox is a service for businesses. Account holders must be 18 or older, and MesaBox isn’t directed to children under 13. We don’t knowingly collect children’s information. If you believe a child has sent information through a chat box, contact us and we’ll delete it.

Data is encrypted in transit and at rest. Uploaded files are private and shared only through links that expire. Access is limited to people who need it to operate the service.

MesaBox stores and processes data in the United States.

If we make material changes to this policy, we’ll email customers before they take effect and update the date above.

Futurous LLC, 5900 Balcones Drive, Ste 100, Austin, TX 78731. Email: contact@mesabox.ai.