Skip to main content
BoxNear← Back to app

Data Subject Access Requests

Version 1.1Effective: July 14, 2026Last updated: July 14, 2026

This document describes how BoxNear handles requests from users to access, correct, export, or delete their personal information. It applies to every BoxNear account holder.

1. Your rights

You have the right to:

  • Access the personal information BoxNear holds about you.
  • Portability: receive a machine-readable (JSON) copy of that information.
  • Rectification: correct inaccurate or incomplete information.
  • Erasure: request deletion of your personal information, subject to legal retention obligations.
  • Restriction / objection: ask BoxNear to stop certain uses of your information.

2. How to submit a request

Signed-in users may submit access, correction, and deletion requests from the Account → Privacy & Your Data screen in the app. If you cannot access your account, email support@boxnear.com from the address associated with your account, or from another address that we can reasonably associate with you together with information sufficient to confirm your identity.

3. Identity verification

Requests submitted from a signed-in BoxNear session are treated as identity-verified by the session. Requests submitted by email may require additional verification, such as confirming the email address on file, providing a recent order or reservation ID, or answering security questions. We will not fulfill a request until we are reasonably satisfied that the requester is the account owner.

4. Response time

Standard response time is 30 days from the date the request is submitted and verified. If a request is unusually complex or requires extended review, we may extend this by an additional 30 days and will notify you. Any dispute in progress, pending payout, or open investigation may delay processing of a deletion request until the dispute is resolved.

5. What an export contains

An export bundles the personal information tied to your account into a single JSON file, including: profile record; owned or joined stores; listings; reservations; reviews you authored; payment records; payout records; notifications; support tickets and messages; store follows and store memberships; smart-scanner usage records; verification document metadata (documents themselves remain in a secure private bucket and are not included in the export); and prior DSAR requests. Downloadable via a signed URL that expires in 7 days.

6. What a correction can change

You may correct: your display name (full_name), phone number, city, and profile photo. Fields that cannot be corrected via DSAR because they are either not personal information or are governed by another process include: seller trust score and success rate (computed from transaction history), review ratings (correctable only via the review workflow with the counterparty), Stripe Connect KYC identity (managed by Stripe), and financial records.

7. What deletion does

Deletion executed by BoxNear performs the following actions:

  • Cancels your open reservations (pending or confirmed but not yet completed).
  • Blanks the comment body of reviews you authored while preserving the numeric rating and the reservation link (required to maintain other sellers' rating histories).
  • Marks your listings as removed and freezes stores you own.
  • Overwrites your profile name with "Former user" and nullifies phone, city, address, and avatar. The user_id row is retained so that historical financial records that reference it remain intact.
  • Deletes your in-app notifications and store follows.
  • Deletes your Supabase Auth user record; you will no longer be able to sign in.

8. What deletion does NOT do — retention exceptions

The following categories are retained after deletion because they are subject to legal, financial, or fraud-prevention retention requirements. See the full Data Retention Policy for details.

  • Payments, refunds, payouts, and administrative audit log — retained 7 years for tax and financial reporting.
  • Verification documents — retained for the KYC record-keeping window required by Stripe Connect.
  • Fraud signals tied to your prior activity — retained 365 days.
  • Rating numbers on reviews you authored — retained so that other sellers' aggregate ratings are not distorted by retroactive removal.
  • Records under active legal hold, subpoena, or open dispute — retained until the hold is lifted.

9. Fees

BoxNear does not charge a fee for the first DSAR of each type in any 12-month period. Manifestly excessive or repetitive requests may be refused or charged a reasonable administrative fee, subject to applicable law.

10. When a request may be refused

BoxNear may refuse a request when: (a) identity cannot be reasonably verified; (b) the request is manifestly unfounded or excessive; (c) the request would compromise the privacy or safety of other users; (d) the request would require disclosure of information covered by legal privilege; or (e) applicable law otherwise permits refusal. If a request is refused, we will explain why.

11. Complaints

If you are not satisfied with how we handle your request, you may contact support@boxnear.com. You may also have the right to complain to a data protection authority in your jurisdiction.

12. Contact

DSAR contact: support@boxnear.com.