Effective date: 11 September 2026 Who we are: Boxed 88 Pty Ltd (ABN 91 652 388 835), West Perth, Western Australia Contact: privacy@stori.bot
Boxed 88 Pty Ltd ("we", "us", "our") operates StoriBot, available at stori.bot and app.stori.bot, together with the StoriBot connector for AI assistants and the managed service we provide to some customers (together, "the Service").
This policy explains what personal information we collect, why, where it goes, how long we keep it and what you can do about it. We handle personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles. If you are in the European Economic Area or the United Kingdom, section 11 sets out the additional rights you have under the GDPR and the UK GDPR.
StoriBot is built for business use. Most of the information that passes through it belongs to the business that connected it, and that business decides what StoriBot reads and who sees what it makes. Where we process information on a customer's behalf, the customer is the controller and we are their processor. This policy describes both what we do as a processor and what we do with the small amount of information we hold about you directly.
1. What StoriBot does with data
StoriBot connects to the systems a business already runs on and keeps one part of that business current: an update, a view, a file, or an agent your team can ask questions of. To do that it reads the systems you connect, drafts from what it finds, and keeps a record of where every number came from.
By default it only reads. Every write to a connected system is one you granted, for that operation, and an instance-level switch turns every write off at once.
2. Information we collect
Account information. Your email address, and your name and profile picture if you sign in with Google. Credentials are managed by AWS Cognito in Sydney. Sign-in tokens are stored on your device.
Content you upload. Files, documents, spreadsheets and other material you put into a Stori. This can include personal, confidential or commercially sensitive information at your discretion.
Data from connected systems. When you connect an accounting, finance, file, analytics, CRM, work-tracking, meeting-notes or social platform, StoriBot reads the data that connection is scoped to. The systems that connect today are listed at stori.bot/integrations, and that page states what each one reads and what, if anything, it can write. We store the credential for each connection (an OAuth grant or an API key you supply) encrypted, scoped to your instance, and use it only for the operations you granted.
Content you create. Drafts, pages, files, updates, the questions you ask the agent and its answers, review comments, and the lineage record that ties each figure to its source.
Connections through AI assistants. If you connect an AI assistant such as Claude or ChatGPT to StoriBot, you authorise it against your StoriBot account using OAuth. StoriBot then receives the requests the assistant makes on your behalf and any content you send through it, and returns results to the assistant. See section 6.
Usage and technical information. Device and browser information, approximate location derived from IP address, and how you use the website and the app. IP addresses are not stored as user records but appear transiently in infrastructure logs.
Information you send us. Anything you provide when you book a walkthrough, request a sample, or contact support.
3. How we use information
We use information to:
- provide, operate, secure and support the Service
- authenticate you and the connections you make
- draft, refresh and deliver the things you build in StoriBot, and record their provenance
- carry out the writes you granted, and nothing else in a connected system
- understand how the Service is used so we can improve it
- communicate with you about your account, changes to the Service and support requests
- meet our legal obligations
We do not sell personal information. We do not use it for advertising. We do not use your content, your connected data or your outputs to train any AI model, ours or anyone else's.
4. AI processing
StoriBot uses frontier AI models to draft and to answer questions. Model requests are routed through OpenRouter, a gateway operated by a Stripe company, to the model provider you select for each task.
Inference is the one part of the Service that may happen outside Australia. The prompt, which can include your content and connected data, is sent to the model you chose, which may be served overseas.
By default, StoriBot restricts inference to a set of models served under terms that prohibit data collection and require zero retention, with no fallback to any model outside that set. With that default in place, the model provider neither collects nor retains your prompts. An instance owner can turn the restriction off to use models outside that set; if they do, the retention terms of the provider chosen apply to each request. The current mechanism is described at stori.bot/trust.
5. Connected systems
Connecting a system is your decision, made through that system's own consent screen or by supplying an API key you control. You are responsible for having the right to connect it and to process the data it holds.
Each connection is granted per operation. Reading is the default. A write is a separate grant, named for what it does, and every write can be disabled across your whole instance with one switch.
When you disconnect a system, we revoke its credential immediately and stop reading from it. Data we had already retrieved from that system, including cached reads and the source excerpts held for lineage, is kept for up to 12 months so that the lineage of what you drafted in that period still resolves, then deleted. You can ask us to delete it sooner, and we will do so within 30 days. Where the provider of a connected system requires deletion on a shorter timetable, we meet that timetable. Documents you have already sent remain as the versions you created.
Where a connected system's provider imposes its own requirements on how its data may be used, those requirements apply in addition to this policy. In particular, StoriBot's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
6. AI assistants connecting to StoriBot
StoriBot can be connected to an AI assistant so you can create and work on a Stori from inside that assistant. When you do:
- you authorise the assistant against your own StoriBot account, and it can do only what you can do
- StoriBot receives the tool requests the assistant sends and any text or files you send through it, and returns results to the assistant
- what the assistant does with those results, and with your conversation around them, is governed by the assistant provider's own terms and privacy policy, not this one
- we do not receive your conversation with the assistant beyond what is sent to StoriBot
- you disconnect StoriBot from within the assistant itself; you can also ask us to revoke an assistant's authorisation from our side, and we will do so within one business day
7. The managed service and human access
Some customers engage us to operate their StoriBot instance and draft on their behalf. In that case our staff work inside the customer's instance, read the connected data the customer has scoped, and produce drafts for the customer's review. Staff access is limited to the people assigned to that customer, bound by confidentiality obligations, recorded in the instance's audit trail, and governed by the managed service agreement with that customer.
Outside the managed service, our staff do not access your content or connected data except to resolve a support request you have raised, to investigate a security incident, or where the law requires it.
8. Where data is stored
Storage, processing and the audit trail run on Amazon Web Services in the Sydney region (ap-southeast-2). Data is encrypted in transit and at rest.
Three things leave that region: model inference (section 4), which goes to the provider you chose; requests made through an AI assistant (section 6), which pass through that assistant's provider; and certain AWS services that operate globally by design.
9. Who we share information with
We share personal information only with providers who process it on our behalf to run the Service, and only what they need:
- Amazon Web Services — hosting, storage and identity
- OpenRouter and the model providers you select — AI inference
- Google — sign-in
- Mixpanel and Google Analytics — usage analytics on the website and in the app
- Stripe — payment processing, where a plan is paid
- HubSpot — booking and contact forms on our website
A current list of sub-processors, with control status and monitoring evidence, is published on our Trust Centre, linked from stori.bot/trust.
We may also disclose personal information where required by law or a valid legal process, or to protect the rights, safety or security of the Service and its users.
10. Retention and deletion
We keep your account information and content for as long as your account is active. You can delete individual Storis, files and connections at any time.
To delete your account, contact privacy@stori.bot. We delete your account information, content, connected data and credentials within 30 days of a verified request, which includes any connected-system data still within the 12-month period in section 5. Copies in backups and logs expire on a rolling basis and are not restored except to recover the Service.
We retain information for longer only where the law requires it, where it is needed to resolve a dispute or enforce our agreements, or where you have asked us to.
11. Your rights
You can ask us to:
- tell you what personal information we hold about you
- correct it
- delete it
- give you a copy in a portable form
- restrict or stop a particular use of it
Contact privacy@stori.bot. We respond within 30 days and will verify your identity before acting. If you are unhappy with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
If you are in the EEA or the UK. In addition to the above, you have the rights set out in the GDPR and the UK GDPR, including the right to object to processing based on legitimate interests and the right to lodge a complaint with your local supervisory authority. Where we process your information as a controller, our lawful bases are performance of our contract with you, our legitimate interests in operating and securing the Service, and your consent where you have given it. Transfers outside the EEA and the UK are made under standard contractual clauses or an equivalent safeguard.
If you are a customer's user. Where your employer or another organisation is the StoriBot customer, they control the information in their instance. Direct requests about that information to them; we will assist them in responding.
12. Security
We protect information with encryption in transit and at rest, credential encryption scoped per instance, per-operation grants on every connection, an instance-level switch that disables every write, and an audit trail. Our ISO 27001:2022 certification is in progress; current control status is published on our Trust Centre.
If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme, and any other regulator we are required to notify.
13. Cookies
The website and the app use cookies and similar technologies that are necessary to sign you in and keep the Service working, and analytics cookies to understand how they are used. You can block analytics cookies in your browser without affecting the Service.
14. Children
The Service is for business use and is not directed at anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.
15. Changes to this policy
When we change this policy we will update the effective date at the top. If a change materially affects how we handle your information, we will tell you by email or in the app before it takes effect. Earlier versions are available on request.
16. Contact
Boxed 88 Pty Ltd (ABN 91 652 388 835) West Perth, Western Australia privacy@stori.bot