PaiBox

Privacy Policy

Last Updated: September 1, 2026

Company: C-Star PaiBox Solutions Inc. d/b/a PaiBox

1. Scope and Who We Are

This Privacy Policy describes how C-Star PaiBox Solutions Inc. d/b/a PaiBox and our parent, subsidiary, and affiliate companies (collectively, ‘PaiBox,’ ‘we,’ ‘us,’ or ‘our’) collect, use, disclose, retain, and protect Personal Information in connection with the PaiBox mobile application, the browser-based application and website at www.paibox.com, and related websites, applications, communications, and services under our operation or control (collectively, the ‘Service’).

This Privacy Policy applies to account holders and other individuals whose information is processed through the Service, including property owners and managers, employees and authorized representatives, residents and tenants, vendors and service professionals, and individuals who participate in calls, messages, or work-order communications facilitated by PaiBox, whether or not they maintain a PaiBox account (collectively, ‘you’).

‘Personal Information’ means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with an individual or household. ‘Sensitive Personal Information’ means Personal Information treated as sensitive under applicable law. The content of a recording, transcript, message, or work order may include Sensitive Personal Information depending on what participants disclose.

1.1 Our Privacy Roles

PaiBox provides business-to-business workflow services. When we process work-order information solely on behalf of a property manager, owner, or other business customer (a ‘Customer’), that Customer generally determines the purposes and means of processing and PaiBox acts as its processor or service provider. The Customer’s privacy notice and agreement with PaiBox may also apply. When PaiBox determines the purposes and means of processing - for example, for account administration, security, legal compliance, corporate operations, and operation of the PaiBox Network - PaiBox acts as the controller or business, as those terms are used under applicable law.

If your request concerns Personal Information controlled by a Customer, we may refer or forward the request to that Customer and assist it in responding, as required by law and our agreement.

2. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to the Service, our data practices, or applicable law. We will post the updated version and revise the ‘Last Updated’ date. If a change materially affects how we use Personal Information, we will provide additional notice and obtain consent where required before the new practice begins.

3. Children

The Service is intended for business and property-operations use and is not directed to children under eighteen (18). We do not knowingly sell or share Personal Information from children. If you believe we have received Personal Information from a child in a manner not permitted by law, contact us at privacy@paibox.com.

4. Personal Information We Collect

Depending on your relationship with PaiBox and the features used, we may collect the following categories of Personal Information:

Identity, contact, and account information. Name, username, email address, phone number, postal or property address, employer or organization, role, account ID, authentication information, and communication preferences.
Work-order and operational content. Repair requests, property or asset information, photographs, documents, inspection reports, invoices, quotes, scope details, pricing, approvals, availability, scheduling, completion information, messages, notes, and other content submitted to or generated through the Service.
Voice communications and audio data. Raw call recording media, a participant’s voice or sound, call date and time, duration, participants or phone numbers, call and recording identifiers, consent records, and related technical metadata.
Transcripts and other communication content. Full call transcripts; SMS, in-app messages, and emails facilitated by the Service; and corrections or feedback relating to those communications.
AI-generated and derived information. Summaries, classifications, repair or scope descriptions, action items, recommendations, confidence or exception flags, and structured work-order lifecycle events generated from communications and other work-order inputs.
Commercial and transaction information. Payment status, transaction history, invoices, and tokenized or limited information received from a payment processor. PaiBox does not need to receive complete payment-card or bank-account credentials when a processor collects them directly.
Device, network, usage, and approximate location information. IP address, device and browser type, operating system, app version, log-in and security events, pages or features used, timestamps, crash and performance data, cookies and similar technologies, and approximate location inferred from an IP address or supplied for a work order.
Other information you choose to provide. Information included in free-form fields, calls, recordings, messages, documents, support requests, or other interactions. Please do not disclose payment-card numbers, Social Security numbers, medical information, or other Sensitive Personal Information unless it is necessary and the Service specifically requests it.

4.1 Sources of Personal Information

Directly from you when you create an account, submit a work order or other content, communicate, join a call, grant permission, contact support, or otherwise use the Service.
From Customers, property managers or owners, residents or tenants, vendors, service professionals, and other participants in a work order or communication.
From service providers, including communications, telephony, cloud hosting, security, analytics, payment, transcription, and AI processing providers.
Automatically from the Service, devices, browsers, cookies, logs, and integrated software development kits.
Generated or inferred through PaiBox’s AI and workflow systems from authorized inputs and activity in the Service.

4.2 Voice Recording, Transcription, AI Summary, and Workflow Events

When a voice feature is enabled, PaiBox may record and transmit the call audio to our systems and authorized service providers. We use the audio to create a full transcript and an AI-generated summary, identify work-order facts and actions, and create or update structured lifecycle events. Depending on Customer configuration and permissions, the Service may use the resulting information to update or advance the related workflow, such as recording scope details, requesting or comparing information, coordinating scheduling, documenting completion, or routing an exception for review.

Before recording begins, PaiBox will provide a prominent disclosure and seek affirmative consent as required. The app will provide a clear visual and/or audible indication while recording is active. Participants who do not consent should not continue in the recorded channel and may use an available alternative method of communication.

AI-generated transcripts and summaries can be incomplete or inaccurate. Authorized users should review material information before relying on it for a consequential action and may submit corrections through the Service or by contacting the applicable Customer or PaiBox.

PaiBox does not use call audio to create a voiceprint, authenticate a person by voice, or uniquely identify an individual through voice biometrics. If that practice changes, PaiBox will provide separate notice and obtain any consent required by law before beginning that processing.

4.3 Cookies and Similar Technologies

We may use required cookies and similar technologies to authenticate users, maintain sessions, secure the Service, remember preferences, and provide requested features. We may also use performance and analytics technologies to understand usage and improve reliability. Where required, non-essential cookies are used only after consent. Browser controls may allow you to block cookies, but some Service features may not function correctly.

5. How We Use Personal Information

Provide, operate, maintain, support, and secure the Service and Customer work-order workflows.
Create and manage accounts; authenticate access; and enforce Customer permissions and policies.
Facilitate calls, messages, scheduling, vendor coordination, quotes, approvals, payments, and other work-order communications.
Record and transcribe calls with required consent; generate AI summaries and structured lifecycle events; and update or advance authorized work-order steps.
Provide customer-specific recommendations, configurations, analytics, matching, and automation for the benefit of that Customer.
Detect errors, abuse, fraud, security incidents, and policy violations; troubleshoot the Service; and maintain audit and consent records.
Communicate service notices, support responses, product updates, and marketing communications in accordance with your choices and applicable law.
Comply with law, legal process, contracts, tax and accounting obligations, and protect the rights, safety, and property of PaiBox, Customers, users, and others.
Develop and improve PaiBox-specific repair-domain and workflow capabilities only as described in Section 6 below.

6. Artificial Intelligence and Data-Use Boundaries

PaiBox uses artificial-intelligence and machine-learning technologies to provide repair classification, skillset matching, summarization, recommendations, communication assistance, anomaly detection, workflow automation, and execution intelligence. The following limitations apply.

6.1 Customer Data and Customer Proprietary Operational Information

‘Customer Data’ means content and information submitted to, transmitted through, or generated through a Customer’s use of the Service, including inputs and outputs. ‘Customer Proprietary Operational Information’ means Customer Data that reflects or embodies customer-specific business practices, strategies, policies, preferences, vendor relationships or selection methods, negotiated pricing or commercial terms, approval thresholds, escalation strategies, customer-specific vendor performance, portfolio-level operating metrics, or other customer-specific operational know-how or competitive information.

PaiBox uses Customer Data and Customer Proprietary Operational Information to provide, maintain, secure, support, and improve the Service for that Customer, as otherwise authorized by the Customer, or as required by law. PaiBox does not disclose Customer Proprietary Operational Information to other PaiBox customers or use it to train or improve models, algorithms, recommendations, or intelligence for the benefit of other customers. This restriction applies even if the information has been aggregated, de-identified, anonymized, or otherwise transformed.

6.2 Generalized Domain and Execution Data

In operating the Service, PaiBox may generate generalized repair-domain and workflow signals that do not contain or embody Customer Proprietary Operational Information (‘Generalized Domain and Execution Data’). Examples include generalized repair symptoms and classifications, asset-to-skillset mappings, repair diagnoses and resolution categories, workflow states and transitions, generalized execution events, system-generated outcome labels, and generalized success or failure outcomes.

PaiBox may use Generalized Domain and Execution Data to develop, train, test, evaluate, validate, and improve PaiBox-specific repair classification, matching, workflow intelligence, execution models, algorithms, and automation. Generalized Domain and Execution Data will not include or encode a Customer’s identity; property or resident identity; private Customer-vendor relationships; negotiated pricing or commercial terms; customer-specific vendor performance; customer-specific policies or preferences; or Customer Proprietary Operational Information.

6.3 Customer-Specific Intelligence

PaiBox may use Customer Data and Customer Proprietary Operational Information to provide and improve models, configurations, recommendations, workflows, matching, analytics, and automation solely for that Customer. Customer-specific intelligence is logically segregated from PaiBox-wide models and intelligence and is not used to improve services for other customers without the Customer’s express authorization.

6.4 Private Vendor Relationships and PaiBox Network Data

A vendor introduced by a Customer remains private to that Customer’s organization and will not be made discoverable to other customers solely because of that introduction. A vendor may separately enroll in the PaiBox Network. Network participation does not change the confidentiality of customer-specific relationships, pricing, communications, transaction history, or performance information.

PaiBox may use data generated through transactions performed through the PaiBox Network (‘Network Data’) to operate, measure, secure, and improve the network, including vendor qualification, availability, matching, supply coverage, network-level performance, reputation, and execution intelligence. Network Data does not include information generated solely through a vendor’s separate private relationship with a Customer. Customer-specific pricing, private vendor performance, communications, policies, preferences, and Customer Proprietary Operational Information are not incorporated into Network Data without the Customer’s express authorization.

6.5 Third-Party AI Models and Training

PaiBox may process Customer Data using third-party AI or speech-processing services solely as necessary to provide the Service and subject to contractual, security, privacy, and data-processing protections. PaiBox does not use Customer Data or Customer Proprietary Operational Information to train third-party general-purpose or foundation AI models and does not authorize those providers to use the information for such training.

Raw recordings, full transcripts, private pricing, and private Customer-vendor relationship information are not PaiBox-wide training datasets.

7. How We Disclose Personal Information

Customers and authorized work-order participants. We disclose information to the Customer and to authorized owners, managers, employees, residents, tenants, vendors, service professionals, or other participants as necessary to perform and document the work order and consistent with permissions.
Service providers. We use providers for communications and telephony, cloud hosting and storage, transcription, AI processing, security, analytics, customer support, email/SMS delivery, and payments. They may process Personal Information only to perform services for PaiBox and under contractual restrictions appropriate to their role.
PaiBox affiliates. We may disclose information within our corporate group for the purposes described in this Privacy Policy, subject to the same applicable restrictions.
Business transactions. Information may be transferred in connection with a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, subject to applicable law.
Legal, safety, and rights protection. We may disclose information when required by law or legal process, or when reasonably necessary to investigate fraud or security issues, enforce agreements, or protect rights, property, or safety.
With authorization. We may disclose information for another purpose that is clearly disclosed and authorized.

PaiBox does not sell Personal Information for money and does not share Personal Information for cross-context behavioral advertising, as those terms are defined by applicable U.S. state privacy laws.

8. Retention and Deletion

We retain Personal Information only for as long as reasonably necessary and proportionate for the disclosed purpose, subject to Customer instructions, applicable contracts, legal obligations, disputes, security needs, and valid legal holds.

Data type	Retention standard
Raw voice recording media	Automatically deleted within 24 hours after AI processing is successfully completed. If processing does not complete, retained only for the shortest period reasonably necessary to retry, diagnose, and securely complete or terminate processing, then deleted, unless law requires otherwise.
Full call transcript	Automatically deleted 30 days after creation, unless earlier deletion is required or a valid legal or contractual exception applies.
AI summary and structured lifecycle events	Retained as part of the applicable work-order record for the period selected or agreed by the Customer and as reasonably necessary to provide and document the Service, maintain an audit trail, comply with law, and establish or defend claims.
Consent and non-content call metadata	Retained as reasonably necessary to document consent, security, billing, system integrity, and the work-order audit trail. Deletion of raw recording media does not necessarily delete limited non-content metadata.
Account and other Customer Data	Retained while the account or Customer relationship is active and thereafter according to Customer instructions, the applicable agreement, legal obligations, security needs, and claim-limitation periods.

Deletion from active systems may not immediately remove encrypted backup copies. Backup copies are isolated from ordinary use, expire under our backup cycle, and are not restored except for disaster recovery or security purposes. If a backup is restored, applicable deletion instructions are re-applied.

9. Recording Consent, Choices, and Corrections

Recording will begin only after the required disclosure and consent process. If you do not consent, do not continue in the recorded channel and use an available alternative communication method. You may revoke consent for future recording, but revocation does not affect processing already lawfully completed. Stopping a recording may prevent PaiBox from providing the voice-enabled feature.

You or the applicable Customer may request access to, correction of, or deletion of retained Personal Information, including an inaccurate transcript or AI summary, subject to applicable law and valid exceptions. Because full transcripts are automatically deleted after 30 days, a later request may relate only to the retained summary and work-order record.

10. Email and SMS Communications

We may send transactional or service communications necessary to operate the Service, such as account, security, work-order, scheduling, and project notifications. Where required, we send marketing email or SMS only with the appropriate consent. Marketing consent is not a condition of purchasing or using the Service. You may unsubscribe from marketing email through the link in the message and may opt out of marketing SMS by replying STOP. We may still send non-marketing service messages permitted by law.

11. Security

We maintain administrative, technical, organizational, and physical safeguards designed to protect Personal Information, including access controls, encryption in transit, logging, and data-retention controls appropriate to the nature of the information. We require authorized providers to apply safeguards appropriate to their role. No transmission or storage method is completely secure, and we cannot guarantee absolute security.

Access to raw recordings, transcripts, summaries, and work-order content is limited to authorized personnel, Customers, participants, and service providers with a need to access the information for the purposes described in this Privacy Policy.

12. International Transfers

PaiBox is based in the United States, and Personal Information may be processed in the United States and other countries where PaiBox or our service providers operate. Those countries may have different data-protection laws. Where required, we use an approved transfer mechanism, such as an adequacy decision, Standard Contractual Clauses and applicable addenda, or another lawful safeguard, and apply supplementary measures as appropriate.

13. EEA, United Kingdom, and Switzerland

If applicable data-protection law in the European Economic Area, United Kingdom, or Switzerland governs our processing as a controller, our lawful bases may include performance of a contract, steps requested before entering a contract, compliance with legal obligations, legitimate interests that are not overridden by your rights, and consent. For recording and uses that require consent, you may withdraw consent for future processing. Customer-directed processing is performed under the Customer’s instructions and applicable data-processing terms.

Our legitimate interests may include operating and securing the Service, preventing fraud and abuse, supporting work-order execution, improving reliability, and maintaining records necessary for claims and compliance. We separate deployment of AI to provide the Service from development or training purposes and identify an appropriate lawful basis for each processing purpose.

Subject to applicable law, you may have rights to access, correct, delete, restrict, or object to processing; withdraw consent; and receive or transfer certain Personal Information. You may also complain to the supervisory authority in your country. Contact privacy@paibox.com to exercise a right. If PaiBox processes the information for a Customer, please contact the Customer directly or we may refer the request to it.

14. U.S. State Privacy Rights

Depending on your state of residence and whether the applicable law covers PaiBox’s processing, you may have rights to know or access Personal Information; obtain a portable copy; correct inaccuracies; request deletion; opt out of sale, targeted advertising, or certain profiling; limit certain uses of Sensitive Personal Information; appeal a denial; and receive equal service and pricing when exercising privacy rights.

To submit a request, email privacy@paibox.com or write to PaiBox’s Privacy Officer at 1250 Broadway, 36th Floor, New York, NY 10001, United States. Please describe the request and your relationship to PaiBox. We may take reasonable steps to verify identity and authority. Authorized agents may submit requests as permitted by law. We will respond within the time required by applicable law and provide an appeal method when required.

In the preceding twelve months, PaiBox may have disclosed identifiers and contact information; commercial and work-order information; internet or network activity; audio/electronic communication content; user-provided content; and inferences or derived workflow information to service providers and authorized work-order participants for the business purposes described in this Privacy Policy. PaiBox has not sold Personal Information or shared it for cross-context behavioral advertising.

PaiBox does not use raw recordings, transcripts, or AI summaries to make solely automated decisions that produce legal or similarly significant effects concerning eligibility for housing, employment, credit, insurance, education, or healthcare. If we introduce a covered use, we will provide any notices, access, opt-out, appeal, or human-review rights required by law before that use begins.

15. Account and Data Deletion

Where the Service permits account creation, you may request account deletion through the in-app deletion function, the external deletion-request page identified in the app-store listing, or privacy@paibox.com. Deleting an account does not necessarily delete Customer-controlled work-order records or information that PaiBox or the Customer must retain for legal, security, billing, dispute, or other valid purposes. When a deletion request applies to provider-held copies, PaiBox will instruct the applicable service provider to delete the information as required.

16. Contact Us

If you have questions or requests concerning this Privacy Policy or our privacy practices, contact:

PaiBox Privacy Officer
C-Star PaiBox Solutions Inc.
1250 Broadway, 36th Floor
New York, NY 10001
United States of America
Email: privacy@paibox.com