Effective date: 2026-08-04. Controller: [FRUTEBOX LEGAL ENTITY], [ADDRESS], [KBO/BCE]. Data-protection contact / DPO: [info@frutebox.com].
Plain-language summary
Your conversations are stored zero-access — encrypted, and Frutebox staff cannot read their content in the ordinary course of running the Services. There are two disclosed exceptions and no others: an automatic preservation that fires on active serious crime, and a break-glass procedure that requires an authority's request plus legal sign-off plus notifying you (see *Lawful access and preservation*). We do not train AI models on your content. You choose the region where your data is processed and stored, and business customers can keep data on their own storage. Sensitive material is redacted before your request reaches a compute node — on Frutebox’s side, not on your device. We process limited account and usage metadata to run and bill the Services.
What we process
- Account data: name, email, authentication data, and — for paid use — billing identifiers (card data handled by Stripe, not stored by us).
- Usage metadata: consumption, credit balance, device/app version, error diagnostics, and security logs — without conversation content.
- Your Content: prompts, documents, code, images and generated outputs — held encrypted (not readable by staff, subject to the two disclosed exceptions above) and processed transiently to produce results.
- Connector data: data accessed from a system you authorise (e.g. CRM, email), used only to perform your request.
Connected sources: Google Drive, Microsoft OneDrive and GitHub
You can connect a Google Drive folder, a Microsoft OneDrive folder or a GitHub repository so the assistant can answer from your own documents and code. Connecting is optional, and nothing is read until you connect something.
What we access, and nothing more. We request read-only permission, always — write access is a separate, deliberate step you take later if you want it, never part of connecting.
- Google Drive — the
drive.filescope, which grants access only to the files and folders you pick in the Google Picker. It does not allow us to see the rest of your Drive, and we do not requestdrive.readonly. - Microsoft OneDrive —
Files.Read,offline_accessandUser.Read. Microsoft's delegated read permission is drive-wide at the token level, so we root every request at the folder you picked and never read outside it.offline_accessis what lets a connection keep working without asking you to sign in again every hour. - GitHub — repository contents, read-only, through a GitHub App whose permissions you grant per repository, so you choose exactly which repositories Frutebox can see.
Why we access it. Only to answer that user's own requests — searching your connected files for the question you asked and citing what it used. Nothing else.
Where it goes and how long it stays. Files you connect are parsed into short passages, and those passages are stored encrypted at rest, together with a numeric index used to find relevant ones. File paths are encrypted too, because a folder tree is itself information about you. Everything is stored in the region you chose for your account and is processed under the same terms as the rest of your content. It stays until you remove it: detaching a source or disconnecting a provider deletes that source's stored passages. If a provider tells us your permission has been withdrawn and it is not restored, we delete the stored passages after 30 days.
What we never do with it. We do not sell it. We do not share it except with the processors already listed in this policy. We do not use it for advertising. We do not use it to train AI models — ours or anyone else's.
How to disconnect, and how to revoke. You can detach a single source or disconnect a whole provider from the Sources panel inside Frutebox; either one deletes the stored passages for what you removed. Disconnecting in Frutebox does not by itself withdraw the permission you granted at the provider, so to revoke our access completely, also remove Frutebox at the provider:
- Google — Third-party apps & services in your Google Account.
- Microsoft — App access in your Microsoft account, or your work tenant's admin.
- GitHub — Settings → Applications → Installed GitHub Apps.
Frutebox's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Legal bases (GDPR Art. 6)
Provide and secure the Services (performance of contract); billing (contract / legal obligation); safety and unlawful-use screening and mandatory reporting (legal obligation / legitimate interests); reliability and abuse prevention (legitimate interests); communications you opt into (consent).
No training
We do not use Your Content to train foundation models.
Automated content screening
Before network processing, an automated classifier screens content in a trusted zone for unlawful use; compliant prompts are never stored — only violations are logged for enforcement and legally-required reporting. No human reads compliant content.
Lawful access and preservation
These are the only two circumstances in which your content can be read, and both are deliberate, narrow and logged.
- Automatic preservation on active serious crime. Where our automated screening sees active signs of serious criminal or terroristic activity — trafficking, weapons or explosives, child sexual abuse material, terrorism — the affected conversations are frozen from deletion and the case is raised, so that evidence cannot be destroyed. This is scoped to the offending conversations and fully audit-logged. It is not triggered by edgy, hypothetical or legally-grey use. You are not notified when this happens: notifying someone would defeat the purpose of it. Your employer is never a party to it.
- Break-glass, on an authority's request. A lawful request from an authority can, with legal sign-off and a recorded authority request, open a specific account's content. The key cannot be assembled by any single person at Frutebox, and for bank and government customers it cannot be assembled without the customer's own share — meaning we cannot be a covert route into their data. You (or your organisation) are notified when this path is used, and every use is recorded in an audit ledger.
We state these because a claim of absolute unreadability would be false, and we would rather be exact than reassuring. [COUNSEL: wording of both paragraphs, the non-notification basis for the first, and the notification timing for the second.]
Processing locations & transfers
You choose the region of processing/storage. Some processing occurs on a distributed network of third-party nodes which receive only encrypted, redacted workloads and cannot read your content. Not every node runs inside a hardware-isolated enclave (a "trusted execution environment"); where one does not, your content is still encrypted in transit, redacted before it leaves our trusted zone, and unreadable to the node operator — and enterprise customers can require enclave-only processing for a group. Where data is transferred outside the EEA we rely on [adequacy decisions / Standard Contractual Clauses].
Support access is global. Your data is stored in the region you chose and is not moved out of it, but our support staff are not regional: a member of staff working in another country may access your account from outside your region in order to help you. What they can reach is your account and billing metadata — never your conversations or files, which no support role can open (the only two ways content is ever read are the disclosed exceptions above). Every such access is recorded — who, which account, when, which ticket, and what was viewed — in a tamper-evident log, and the record is available to you on request. We say this plainly because "your data stays in your region" and "support can reach your account from anywhere" are both true, and stating only the first would be misleading. [COUNSEL: whether intra-group remote access to account metadata is a Chapter V transfer here, and whether SCCs are required for it.]
Retention
Account data: for the life of the account + [period]. Usage metadata: [period]. Content: retained until you delete it or close your account. When you delete a conversation, workspace, or your account, it disappears from view immediately and can be restored by you for 30 days (sign back in to undo an account deletion); after that window it is permanently and irreversibly erased. The 30-day window exists so accidental deletions are recoverable and so we can meet legal preservation obligations; content under a lawful preservation hold is retained until the hold ends. Violation logs retained as required.
Your rights
Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent — in-app (data export and account deletion) or via [info@frutebox.com]. You may lodge a complaint with the [Belgian Data Protection Authority]. California residents have CCPA/CPRA rights; we do not sell personal information.
Children
The Services are for users 18+ in this phase; we do not knowingly process children's data.