Information you provide to us

• Contact information. Name, email address, mailing address, and phone number.
• Account credentials. Username and password, if you create an Arculus account.
• Payment information. Processed by our payment processor or by Kickstarter. Arculus does not store full payment card numbers.
• Order and shipping details. Reward tier, shipping address, and order history.
• Communications. Messages you send through email, support channels, or social media, including the content of those messages.
• Survey and feedback responses. Anything you share when we ask for product feedback.

Device, camera, and sensor data

Boxx is a physical security device with a camera and motion sensors. Setting up and using Boxx may involve us collecting:

• Video clips and still images captured when Boxx detects motion or a delivery event
• Motion detection events and their timestamps
• Device diagnostics: firmware version, power status, Wi-Fi signal strength, and error logs
• The network information needed to connect Boxx to your home Wi-Fi

You control when Boxx records, and you can review, download, or delete captured footage through the app, subject to the retention periods in Section 5.

Information collected automatically

• IP address, browser type, device type, and operating system
• Pages visited, time spent, and referring or exit pages
• App usage data and crash logs
• Cookies and similar technologies (see Section 9)

Information from third parties

• Kickstarter. Pledge amount, reward tier, and backer information for campaign fulfillment.
• Payment processors. Confirmation that a payment was completed.
• Marketing and analytics partners. Aggregated or de-identified insights about how people find and use our Services.
• Public sources. Where permitted by law.

• Provide, operate, and maintain the Services
• Process orders, pledges, and shipments
• Detect deliveries and send you real-time alerts
• Communicate with you about your order, account, or support requests
• Send product updates, backer updates, and marketing communications, with an opt-out available at any time
• Improve the Services and develop new features
• Detect, investigate, and prevent fraud, abuse, and security incidents
• Comply with legal obligations

Where the GDPR or a similar law requires a legal basis for processing, we rely on one or more of the following:

• Contract. Processing needed to provide the Services you requested.
• Consent. For optional communications and certain cookies. You can withdraw consent at any time.
• Legitimate interests. To secure, maintain, and improve the Services, balanced against your rights.
• Legal obligation. Where processing is required to comply with the law.

• Video and image clips. Retained for [Insert Retention Period, e.g., 30 days] unless you save them or the law requires a longer period.
• Account information. Retained while your account is active and for a reasonable period after, to resolve disputes and enforce our agreements.
• Backer and order records. Retained as required for tax, accounting, and warranty purposes.

We delete or de-identify personal information once it is no longer needed for these purposes, unless a longer retention period is required by law.

We do not sell your personal information. We may share it with:

• Service providers, who help us operate the Services, including hosting, cloud storage, payment processing, email delivery, analytics, and customer support.
• Kickstarter, to fulfill your pledge and reward.
• Shipping and logistics partners, to deliver your order.
• Professional advisors, such as legal, accounting, and insurance firms.
• Law enforcement or regulators, where required by law or necessary to protect rights, property, or safety.
• A successor entity, in the event of a merger, acquisition, financing, or sale of assets.

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, and regular security review of our systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Arculus is based in the United States. If you access the Services from outside the United States, your information will be transferred to and processed in the United States and potentially other countries, which may have data protection laws different from those of your home country. Where required, we use appropriate safeguards for these transfers, such as standard contractual clauses.

We and our service providers use cookies and similar technologies to operate the Services, remember your preferences, and measure performance. You can control cookies through your browser settings; disabling them may affect how the Services function. We do not currently respond to browser "Do Not Track" signals. [Insert detail on cookie categories and any consent banner used, if applicable.]

All users

• Access, correct, or update your information through your account settings
• Request deletion of your account and associated data
• Opt out of marketing emails using the unsubscribe link in any email
• Contact us at any time using the details in Section 13

California residents

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the CPRA, gives you the right to:

• Know what personal information we collect, use, and disclose
• Request deletion of your personal information
• Correct inaccurate personal information
• Opt out of the sale or sharing of personal information (Arculus does not sell personal information)
• Limit the use of sensitive personal information
• Not be discriminated against for exercising these rights

To exercise these rights, contact us using the details in Section 13. We may need to verify your identity before completing your request.

EEA, UK, and similar jurisdictions

If the GDPR or a similar law applies to you, you have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Request erasure of your information
• Restrict or object to certain processing
• Request portability of your information
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with your local data protection authority

The Services are not directed to children under 13 (or the applicable minimum age in your jurisdiction), and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will take steps to delete it.

The Services may link to third-party websites and platforms, including Kickstarter and social media. We are not responsible for the privacy practices of those third parties. Review their privacy policies before providing any information.

We may update this Privacy Statement from time to time. We will post the updated version here with a new "Last Updated" date and, where required by law, provide additional notice.

If you have questions about this Privacy Statement or want to exercise your privacy rights, contact us at:

Arculus
PO Box 1726 Rancho Cucamonga, CA 91729]
social@arculusboxx.com