MakeBox ReplyPrivacy
Scope and contact
This policy covers the MakeBox Reply extension and its account service operated by Cyfra LLC. Contact support@makebox.ai for privacy questions, corrections or account removal. The general MakeBox marketing website has its own website privacy policy.
Account and service records
We store account email, password hashes for email sign-in, hashed sessions/device tokens, saved business profiles and prices, subscription/customer identifiers, billing state and AI action counts. Google sign-in uses the existing Supabase authentication service. Stripe processes card payments; MakeBox Reply does not store full card numbers.
Selected text and AI processing
Only after you request an AI action and consent to processing do selected text, relevant business instructions, prices and any refinement go to our US server and OpenAI. Processing currently uses a server-side Codex CLI account. OpenAI account and plan policies apply; we do not promise API-specific retention or disabled training by default. Do not submit information you are not entitled to share.
Website access and local data
The optional website permission lets the selection menu appear on supported websites. The extension does not upload full pages or browsing history in the background. Password fields are excluded. The source tab/page context used for manual insertion, a device token, settings and current drafts may be stored locally in Chrome. Disconnect removes the device connection. Clear individual snippet positions or extension storage to remove remaining local state on that device. Other connected devices are separate.
Quick inserts
Up to 10 saved links, usernames or reusable text snippets are stored locally in this Chrome profile. They are not synced to Supabase and are not automatically sent for AI processing. Copy/Insert writes only the selected snippet and does not read existing clipboard contents. Password and API-key storage is not supported; use a password manager. Disconnecting the account keeps these local snippets; clear positions or extension data to remove them.
Retention
Selected input and generated drafts remain in process memory while a request runs and for up to 15 minutes for delivery. They are not saved as message history in the application database. Temporary CLI request files are removed after processing. Profiles stay until deleted or account removal is requested; usage and billing records are retained for service and billing operations. Backups may retain records until they rotate. Provider retention follows its own account and plan policies.
Service providers and purpose
Supabase handles authentication and application storage, Stripe handles billing, and OpenAI handles requested AI generation. We use account and usage records to operate the service and enforce plan quotas. We do not sell selected messages or business rules.
Your choices
You can edit/delete business profiles, choose whether to run an AI action, remove website access in Chrome, disconnect a device and request account removal through support. Uninstalling the extension does not cancel an active paid subscription; cancel it through Manage billing.
Drafts and changes
Review AI output before using it. The extension does not send your messages. We may update this policy as the service changes and publish the revised version with its update date.