Seenbox Privacy Policy
Effective October 27, 2026 · Last updated October 27, 2026
The short version. We collect what we need to deliver paid messages, pay creators and affiliates, and prevent fraud. We never see your full card or bank numbers. Creators never see buyers' email addresses. We do not sell personal data, show ads, or use third-party analytics or advertising cookies.
1. Who we are and who this covers
This policy explains how Seenbox ("Seenbox", "we", "us"), handles personal data on seenbox.ai and related services (the "Service"). It covers:
- Buyers: people who pay a creator for a reaction or reply (no account needed).
- Creators: people who sell reactions and replies from a Seenbox page.
- Affiliates: people who refer creators and earn commissions.
- Visitors: anyone who opens a Seenbox page.
- People who message us or a connected creator on social media: for example, a creator sending a verification code to @seenbox.ai on Instagram.
The Service is offered only to people 18 and over in the United States.
2. What we collect
Buyers
- Your message, the first name or alias you give, any category you pick, and the creator's reaction or reply.
- Your email address, to send your confirmation, status link, receipts and outcome. It stays with Seenbox; creators never see it.
- Order details: creator, message type, price, service fee, deadline, status, times, which kind of link brought you (for example a creator's bio or DM link), and the version of the Terms you accepted.
- Payment status from Stripe, and the card brand and last four digits for receipts and support. You enter your card on Stripe's page, not ours; we never receive the full number.
- Fraud-prevention signals (Section 3).
Creators
- Login email, handle, display name, photo, social handles, settings, prices and payout status.
- Proof that you control your social accounts: a code you send to our social account, a sign-in with that platform (we keep only your account ID, username and profile link), or a code in your profile.
- Boost proof: the post or story link, Instagram's notice that you tagged @seenbox.ai, a screenshot if you send one, and the number of visits through your post or story link. We do not save copies of story photos or videos.
- Messages you receive, your reactions and replies, reports you make, and your orders and earnings.
- Your Stripe account status (whether onboarding is complete and payouts are enabled). Stripe, not Seenbox, collects your identity documents, Social Security number and bank details; we never see or store them.
- Fraud-prevention signals (Section 3).
Affiliates
- Login email, referral code, the creators you referred and their progress toward qualification, commissions and payouts, Stripe account status, and fraud-prevention signals.
Visitors
- One visit record per browser per creator per day: the creator, the date and the kind of link that brought you. We work out the kind of link from the address you used and the referring site's domain; we never keep the full referring address, and never store your IP address for this.
- For referral links (seenbox.ai/r/...): the IP address block of the click, the referral code and the time.
Social media connections (only if you choose to connect)
- If a creator connects an Instagram professional account so Seenbox can send their auto-reply, we keep the account ID, username, an encrypted access token (deleted when they disconnect), and their auto-reply text and setting.
- When someone messages a connected creator, Instagram sends us the message so we can decide whether to send the auto-reply. We read it in memory and do not store the message text, attachments, or the sender's name, username or photo. We keep only: which creator received it, a salted hash of the sender's Instagram ID, whether we sent the auto-reply or why not (for example "creator follows this person"), and the time.
- If a creator connects YouTube so we can check their videos for boost links, we keep an encrypted refresh token until they disconnect.
Support
- What you send us by email, and our replies.
3. Fraud-prevention signals
We use a small set of signals only to detect self-referrals, shared accounts, self-purchases and spam. They are visible only to Seenbox administrators.
| Signal | What it is | What it is not |
|---|---|---|
| Payout account fingerprint | A code Stripe gives each payout bank account or debit card, identical across accounts that share it | Not your account or routing number |
| Card fingerprint | A code Stripe gives each card used to pay | Not your card number, expiry or security code |
| Email hash | Your normalized email turned into a keyed hash with a secret only Seenbox holds | Not readable as your email |
| Name hashes | Keyed hashes of the legal name (and name with date of birth, if Stripe returns it) on a payout account | We do not keep the name or birth date itself |
| Device ID cookie | A random first-party code in your browser | Not a device fingerprint, not used on other sites |
| IP address block | A shortened IP address that identifies a network (IPv4 /24, IPv6 /64) | We never store full IP addresses in our application |
A fraud match never decides anything about money on its own: it can hold an affiliate's commission for review by a person. It never changes a buyer's charge or a creator's earnings. Automatic rate limits may stop too many messages from one email, network or card; a stopped message is never charged.
4. Cookies
| Cookie | Who gets it | Purpose | Lasts |
|---|---|---|---|
| Login | Signed-in creators and affiliates | Keeps you signed in (strictly necessary) | Your session, or until you sign out |
| Device ID | Anyone who opens checkout or signs up | Fraud prevention only | 12 months |
| Visitor | Anyone who opens a creator's page | Counts each browser once per creator per day | 12 months |
| Link | Anyone arriving through a creator's or affiliate's link | Remembers which kind of link brought you, so a later order that day records it | 1 day |
All are first-party and not readable by page scripts. We use no advertising or third-party analytics cookies. Because we do not sell data or use targeted advertising, a Global Privacy Control or Do Not Track signal does not change what we collect; we honor it anyway as a request not to sell or share, which we already don't do.
5. How we use personal data
- To run the Service: place, charge and release holds, deliver messages, send reminders and outcomes.
- To pay creators and affiliates and keep financial and tax records.
- To verify creators' social accounts and boost posts.
- To send a connected creator's auto-reply.
- To show creators which kinds of links bring buyers.
- To keep the Service safe: content filtering (our own word list and rate limits), reports, moderation and fraud prevention.
- To answer support, refund and dispute requests.
- To meet legal duties, including reporting child sexual exploitation to the National Center for Missing & Exploited Children.
We send buyers only emails about their orders. Creators and affiliates may get product news, with an unsubscribe link in every message.
6. Who receives personal data
| Recipient | What | Why |
|---|---|---|
| Stripe | Payment and payout data; Stripe collects card, identity and bank details directly under its own privacy policy | Payments, payouts and tax forms |
| Email provider | Email addresses and email content | Sending our emails |
| Hosting, database and security providers (including Cloudflare) | Data we store and site traffic, including full IP addresses in transit | Running and protecting the Service |
| Social platforms (Instagram, X, LinkedIn, TikTok, YouTube) | Only the requests needed for sign-in, verification, boost checks and auto-replies you choose to use | Those features; each platform's own policy applies |
| Creators | A buyer's message, name or alias, and category. Never the buyer's email | So they can react or reply |
| Affiliates | For each creator they referred: setup progress, qualified or not, first-sale date, sales total and their own commissions. Never messages, buyer details or fraud signals | Running the affiliate program |
| The public | A creator's page: name, photo, handle, social handles, verified badge, prices, deadline, and a Partner badge if earned | So buyers can find creators |
| Authorities | What the law requires | Legal duties and child-safety reports |
| A successor | Data under this policy | If Seenbox is merged, sold or reorganized |
We do not sell personal data and do not share it for targeted advertising.
7. How long we keep it
| Data | Kept for |
|---|---|
| Messages, reactions and replies | 12 months after the order closes, then deleted (longer only while a report, refund or dispute is open, or where the law requires) |
| Order, payment, commission and payout records | 7 years, for tax and accounting |
| Fraud signals and review results | 24 months after the account closes or the referral ends, or longer while a review or dispute is open |
| Referral click records | 90 days |
| Page-visit records | 24 months |
| Support emails, reports and moderation records | 3 years |
| Verification and boost proof | 12 months |
| Social access tokens | Until you disconnect or the token expires; then deleted at once |
| Auto-reply decisions | 90 days |
| Social message event IDs (no content) | 7 days |
| Closed accounts | Profile deleted within 30 days; records above kept for their periods |
Our providers keep their own logs (for example, security logs with IP addresses) under their own retention settings.
8. Security
Access to data is restricted by database rules: creators see only their own orders, affiliates only their own referrals, and only administrators see fraud data. Administrator access requires multi-factor sign-in. Secrets and access tokens are kept encrypted on the server. No system is perfectly secure; if a breach affects your data, we will notify you as the law requires.
9. Your rights
Wherever you live in the United States, you can ask us to:
- confirm whether we process your personal data, and give you a copy in a portable format;
- correct inaccurate data;
- delete your data;
- stop any sale, targeted advertising or profiling (we do none of these).
Write to hello@seenbox.ai. Buyers have no account, so write from the email you used to pay; we may confirm by sending a link to that address. You may use an authorized agent. We respond within 45 days (extendable once by 45 days where reasonably necessary, with notice). We will not treat you differently for using these rights.
We may keep some data after a deletion request where we must: financial records, data tied to an open order, review or dispute, and fraud signals while needed to prevent fraud. We will tell you what we kept and why.
Appeals. If we decline your request, you can appeal by replying to our decision within 45 days. We will answer within 60 days. If you are still unsatisfied, you may contact your state attorney general.
10. Deleting social media data
Creators can disconnect a social account in their settings or in the platform's own settings. We delete the access token at once and the connection's records within 30 days. Anyone who messaged @seenbox.ai or a connected creator can ask us to delete what we hold by writing to hello@seenbox.ai with their username and the creator's. We hold no message text. When Meta tells us someone removed Seenbox or asked for deletion, we delete the data and provide a confirmation code to check its status.
11. Children
The Service is not for anyone under 18, and we do not knowingly collect data from anyone under 13. If you believe a minor has given us personal data, contact us and we will delete it.
12. Location
Seenbox operates in and stores data in the United States, and the Service is offered only to people in the United States.
13. Changes
We will post changes here with a new date. For significant changes, we will email creators and affiliates at least 30 days before they take effect.
14. Contact
Seenbox · hello@seenbox.ai