Privacy policy

This policy explains what personal data this website collects, why, who receives it and what you can do about it. It describes what the site does today, nothing more.

Who we are

insidethebox is a digital product agency based in Athens, Greece. We decide how the personal data described here is used, which makes us its controller under the EU General Data Protection Regulation (GDPR).

You can reach us at mail@insidethebox.dev.

When you browse

• To deliver pages and keep the site secure, our hosting provider processes your IP address and the technical details your browser sends with each request, such as browser type and the page asked for.
• Fonts, images and videos are served from our own domain, so browsing doesn't send your data to font or video services.
• No cookies are set unless you allow analytics. See Cookies and analytics.

When you send a message

The message form on the contact page asks for your name, email address, a topic and your message. We receive them as an email in our inbox, and send you one short confirmation email that we've received your message. It contains nothing you typed. We then reply in person.

When you request a quote

The quote form asks which services you are interested in, a few questions about each, your budget, timeline and project details, your name and email address and, if you choose, your company. We receive them as an email in our inbox, and send you one short confirmation email. It contains nothing you typed.

When you book a call

• To show free times, the site sends the date, time and time zone you pick to our server, which checks our Google Calendar. Your name and email aren't sent at this stage.
• When you book, we collect your name, email address, the topic, any notes and, if you choose, your company, along with the time you picked and your time zone, which your browser provides so we can show times in your local time.
• We create an event in our Google Calendar with a Google Meet link and add you as a guest. Google then emails you the calendar invitation. We also send you one short confirmation email, which contains nothing you typed, and we get an email about the booking.

When you apply for a seat in the AI course

• The form on the home page asks for your name, email address, how much you use AI today, the seat you'd like and, if you choose, your company or role.
• We receive your application as an email, and send you one short thank-you email. It contains nothing you typed.
• Your browser remembers which seat you applied for (see Cookies and analytics).
• Applying is an expression of interest only. It isn't a booking or a contract.

When you email us

If you write to mail@insidethebox.dev, we receive whatever your email contains.

How the forms are protected

• Email address check. When you send a form, our server checks that the address isn't a placeholder (such as name@company.com) or a disposable inbox, using a list kept in our own code. It then looks up the domain, the part after the @, in the public DNS to see whether it can receive email. No outside verification service is used and your full address isn't sent anywhere for this. Lookup results are kept in the server's memory for up to an hour. If an address is rejected, only its domain is written to our server log.
• Rate limits. To stop abuse, the server counts requests per IP address over 10-minute windows: five submissions per form and 30 availability checks. For every form it also counts confirmation emails per email address, at most two a day per form, so the forms can't be used to fill someone's inbox. These counts are kept only in the server's memory, are never written to a database or log, and are lost whenever the server restarts.
• Spam trap. Each form has a hidden field that people don't see. Submissions that fill it in are dropped and never sent.

Cookies and analytics

Necessary: always on

These are not cookies. They are small entries in your browser's local storage, and they are never sent to us.

• itb-consent remembers your cookie choices and when you made them, so we don't ask again on every page.
• itb:course-seat is saved only if you apply for a seat in the AI course. It holds the seat number, so the seat table still shows your request when you come back.

Both stay until you clear your browser's data for this site.

Analytics: only with your consent

We use Google Analytics 4 to understand, in aggregate, how the site is used. Until you allow it, no Google script loads and no Google cookie is set.

• If you allow analytics, your browser loads Google's script from googletagmanager.com. It sets first-party cookies named _ga and _ga_ followed by an ID, which by default last up to two years.
• Google Analytics records the pages you view, how you arrived, your device and browser type and your approximate location. Google says Google Analytics 4 doesn't log or store IP addresses.
• We also record two events of our own: when you click a download on a case study (the file name and link), and when a course application goes through (the seat number only). We never send your name, email address or anything you type into a form to Google Analytics.
• If you turn analytics off later, collection stops and the _ga cookies are deleted.

Marketing: only with your consent

No marketing or advertising tools run on this site today. The setting exists so that any we add later would only load with your consent, and we would update this policy first. For now, when analytics is on, your marketing choice is passed to Google Analytics as a consent signal (Google Consent Mode), telling it whether advertising storage is allowed.

Changing your choice

Use "Cookie settings" at the bottom of any page. You can also clear this site's cookies and storage in your browser settings.

Why we use your data

• Replying to messages and quote requests, arranging calls and handling course applications, including the confirmation emails and calendar invitation: to take the steps you ask for before a possible contract (Article 6(1)(b) GDPR), and our legitimate interest in answering people who contact us (Article 6(1)(f)).
• Email checks, rate limits, the spam trap and hosting logs: our legitimate interest in keeping the site, the forms and our inbox secure and free of abuse (Article 6(1)(f)).
• Analytics and marketing: your consent (Article 6(1)(a) GDPR and the e-privacy rules on cookies). You can withdraw it at any time; this doesn't affect what happened before.
• Necessary browser storage: strictly necessary to remember your choice or show the request you made, so it doesn't need consent.

We don't sell your data, use it for advertising or build profiles. Apart from the automatic checks above, which only decide whether a form can be sent, we make no automated decisions about you.

Who receives your data

• Google, through Google Workspace: form submissions and booking notices reach our Gmail inbox, and confirmation emails reach you, sent through the Gmail API, and booked calls are events in our Google Calendar with a Google Meet link. Google sends the calendar invitation to you.
• Google, through Google Analytics, only if you allow analytics.
• Vercel Inc., our hosting provider, which serves the site and runs the server code that handles the forms.

These providers process data on our behalf under their data processing terms. We share data with no one else, unless the law requires it.

International transfers

Google and Vercel may process data outside the European Economic Area, including in the United States. Where they do, the transfer relies on the safeguards in their data processing terms, such as the EU–U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses.

How long we keep it

• Messages, quote requests, course applications and emails to us: in our inbox for as long as we need them to reply and follow up, then we delete them.
• Booked calls (calendar events): in our Google Calendar for as long as we need them to follow up, then we delete them.
• Google Analytics data: for the retention period set in our Google Analytics account, at most 14 months. The cookies last up to two years unless you delete them or turn analytics off.
• Hosting logs: for the limited period our hosting plan keeps request and server logs.
• Rate-limit counts and email-domain lookups: in server memory only, for minutes up to an hour, and gone whenever the server restarts.
• Browser storage: until you clear it.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy
• have it corrected if it's wrong
• have it erased
• restrict how we use it
• object to our use of it, in particular where we rely on legitimate interests
• receive the data you gave us in a common, machine-readable format (portability)
• withdraw your consent at any time, through "Cookie settings" for analytics and marketing

To use any of these rights, email mail@insidethebox.dev. We reply within one month. We may ask you to confirm your identity first.

If you think we have handled your data wrongly, you can complain to the Hellenic Data Protection Authority at dpa.gr (opens in a new tab), or to the data protection authority where you live or work. We'd appreciate the chance to put it right first.

Changes

We update this policy when the site's data practices change, and revise the date on this page.

Contact

Questions about this policy or your data: mail@insidethebox.dev.