Privacy Policy

Last updated: April 2026  ·  Applies to: msgbox.nbplugins.com

This Privacy Policy explains how MsgBox ("we", "us", "our") collects, uses, stores, and protects personal information when you use our service. We are committed to protecting your privacy and complying with the Israeli Protection of Privacy Law 5741-1981 and the EU General Data Protection Regulation (GDPR).

1. Who We Are

MsgBox is an AI-powered chat widget platform operated by NBPlugins, based in Israel. We act as a data processor on behalf of website owners (our customers), and as a data controller for our customers' own account data.

For questions about this policy: support@nbplugins.com

2. Data We Collect

2.1 Site Owner Account Data

Data	Purpose	Retention
Email address	Login, password reset, service notifications	Until account deletion
Website domain	Widget configuration and verification	Until account deletion
Business information (name, description, hours)	AI chatbot context	Until account deletion
IP address (login)	Security, fraud prevention, IP lock	90 days
Last login timestamp	Security monitoring	Until account deletion

2.2 Widget / Visitor Data (processed on behalf of site owners)

Data	Purpose	Retention
Chat messages (encrypted)	AI response generation, conversation history	90 days by default
Visitor IP address	Rate limiting, security, order lookup	90 days
Browser language	Auto-translation of widget interface	Not stored independently
Session ID	Conversation continuity	90 days
Contact form submissions (name, phone, email)	Lead delivery to site owner	90 days

3. How We Use Your Data

• To provide, maintain, and improve the MsgBox service
• To generate AI responses to your website visitors' questions
• To send account-related emails (login credentials, service updates)
• To deliver push notifications to site owners when leads arrive
• To prevent abuse, fraud, and ensure platform security
• To comply with legal obligations

We do not use your data or your visitors' data for advertising, profiling, or selling to third parties.

4. Legal Basis for Processing (GDPR)

Processing Activity	Legal Basis
Account management	Contract performance (Art. 6(1)(b))
Service delivery (AI responses)	Contract performance (Art. 6(1)(b))
Security & fraud prevention	Legitimate interest (Art. 6(1)(f))
Legal compliance	Legal obligation (Art. 6(1)(c))

5. Third-Party Services

We share data with the following sub-processors to deliver our service:

Service	Purpose	Location
DeepInfra	Primary AI response generation	United States
Google (Gemini API)	Fallback AI response generation	United States
OpenAI	Widget UI translation only	United States
MailerSend	Transactional email delivery	EU / United States
Firebase (Google)	Push notifications to site owners	United States

Each of these providers has their own privacy policy and data processing terms. International transfers to the US are covered by Standard Contractual Clauses (SCCs) where applicable.

6. Data Security

• All data transmitted via HTTPS (TLS 1.2+)
• Chat messages encrypted at rest with AES-256-CBC, unique key per site
• Passwords hashed using bcrypt
• Admin access restricted by IP whitelist
• Multi-layer rate limiting to prevent abuse
• Remember-me tokens stored as SHA-256 hashes (never plaintext)

7. Data Retention

• Account data: Retained while your account is active
• Chat conversations: 90 days by default
• IP rate limit logs: 7 days
• Login attempt logs: 30 days
• Upon account deletion: All your data is permanently deleted within 30 days

8. Your Rights

Under GDPR and Israeli privacy law, you have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure — request deletion of your data ("right to be forgotten")
• Portability — receive your data in a machine-readable format
• Object — object to certain types of processing
• Restriction — request we restrict processing of your data

To exercise any of these rights, email us at support@nbplugins.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Israeli Privacy Protection Authority or your local supervisory authority.

9. Cookies

See our Cookie Policy for full details. In brief: we use only essential session and login cookies — no tracking or advertising cookies.

10. Children's Privacy

MsgBox is not intended for use by persons under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

11. Changes to This Policy

We may update this policy periodically. We will notify you of significant changes by email or through the dashboard. The "last updated" date at the top of this page reflects the most recent revision.