Privacy Statement
How Gainbox handles personal data — on this website, in our platform, and in our dealings with customers and partners.
1. Who we are
Gainbox Inc. is a Delaware corporation. In this statement, “Gainbox”, “we”, and “us” mean Gainbox Inc.
For any question about this statement, or about personal data we hold, write to [email protected].
2. Two different roles
Gainbox handles personal data in two distinct capacities, and it matters which one applies to you.
As a controller. For visitors to this website, people who hold a Gainbox account, and business contacts we deal with directly, we decide what data is collected and why. That processing is described in this statement.
As a processor. When a customer connects their CRM to the Gainbox platform, we process the records in that CRM strictly on the customer's instructions, for the purpose of validating, enriching, and scoring them. We do not decide what goes into a customer's CRM and we do not use that data for our own purposes. That processing is governed by our Data Processing Addendum with the customer, not by this statement. If your data sits in a Gainbox customer's CRM, that customer is the controller and your request should go to them; we will help them respond.
One point of substance about the platform: Gainbox validates and enriches company records — organisation names, domains, firmographic and technographic attributes drawn from third-party and public business sources. We do not store CRM contact records, so the great majority of what the platform processes is not personal data at all.
3. What we collect, and why
Website visitors
We run our own analytics on our own servers using Matomo. No third-party advertising, tracking, or social pixels run on this site, and no analytics data is shared with an outside analytics provider. Our analytics does not set cookies, and IP addresses are anonymised before they are stored. Matomo records the pages you view, approximate location derived from a truncated IP address, referrer, and device and browser type, so that we can understand which pages are useful.
People who contact us
If you email us or fill in a form, we keep your name, email address, and the content of your message so we can reply and keep a record of the exchange.
Account holders and platform users
To give you access to the platform we hold your name, work email address, the customer organisation you belong to, authentication data, and a log of your activity in the product for security and support purposes.
Prospective customers and partners
We hold ordinary business contact details — name, role, employer, work email, phone — for people at companies we are in touch with or would like to be.
4. Legal bases (GDPR)
| Purpose | Legal basis |
|---|---|
| Providing the platform and supporting account holders | Performance of a contract, Art. 6(1)(b) |
| Website analytics, security monitoring, service improvement | Legitimate interests, Art. 6(1)(f) — running and protecting our service |
| Business-to-business communication with prospects and partners | Legitimate interests, Art. 6(1)(f), and consent where local law requires it |
| Accounting, tax, and statutory records | Legal obligation, Art. 6(1)(c) |
| Processing customer CRM records in the platform | On the customer's instructions as processor, Art. 28 |
5. Where data is stored
The Gainbox platform and all customer data run on dedicated servers operated by Hetzner Online GmbH in Germany. Data is encrypted at rest with AES-256, every backup is encrypted before it leaves the server, and TLS is enforced on all connections — unencrypted database connections are rejected.
Because Gainbox Inc. is a United States company, our personnel in the United States may access data held in Germany in the course of operating and supporting the service. Where that involves personal data from the European Economic Area or the United Kingdom, the transfer is made under the European Commission's Standard Contractual Clauses, together with the technical measures described above.
6. Who else is involved
We keep the list of outside providers deliberately short. Each is bound by a written agreement covering confidentiality and data protection.
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Server hosting and infrastructure | Germany |
| Cloudflare, Inc. | Content delivery, web application firewall, access control | Global network |
| Microsoft (Microsoft 365) | Business email and collaboration | European Union / United States |
| Accounting and banking providers | Invoicing, payments, statutory records | United States |
We do not sell personal data, and we do not share it for cross-context behavioural advertising. We may disclose data where the law requires it, or to establish or defend legal claims.
7. How long we keep it
- Website analytics — 24 months, after which records are deleted
- Correspondence — for as long as needed to handle the matter, and then for our ordinary business records
- Account data — for the life of the customer relationship, then deleted or anonymised except where records must be retained by law
- Customer platform data — as instructed by the customer under the Data Processing Addendum
- Backups — encrypted backups roll off automatically between 14 days and 6 months depending on the tier, so deleted data may persist in backups for that period before it is overwritten
8. Security
We maintain encryption at rest and in transit, multi-factor authentication on email and on all administrative and server access, IP allowlisting for administrative access, a web application firewall in front of the public service, default-deny firewalls at the host and virtual-machine level, version-controlled infrastructure configuration, a documented patching process, encrypted offsite backups with tested restores, and a written incident response plan that we test. Our people complete security awareness training annually.
No system is perfectly secure, but if a breach affects your personal data we will notify the people and authorities the law requires, without undue delay.
9. Your rights
If you are in the European Economic Area or the United Kingdom, you have the right to ask for a copy of your personal data; to have it corrected or erased; to restrict or object to how we use it, including any use based on legitimate interests; to receive it in a portable format; and to withdraw consent where our use rests on consent. Exercising these rights costs nothing and will not be held against you.
Write to [email protected] and we will respond within one month. You may also complain to the data protection authority in the country where you live or work. If you are in the United States, you may contact your state attorney general.
If you are a California resident, you may request the categories and specific pieces of personal information we have collected about you, ask us to delete or correct it, and ask us to limit the use of sensitive personal information. We do not sell or share personal information as those terms are defined by California law.
10. Children
Gainbox is a business tool. It is not directed at children, and we do not knowingly collect personal data from anyone under 16.
11. Changes
If we change this statement we will update the date at the top, and for significant changes we will tell account holders directly.
Questions about this statement, or about personal data we hold? Write to [email protected]. You can also read about our security and compliance practices.