Legal
Privacy Policy
Last updated: 11 November 2026
At Boxlist, we take your privacy seriously. This policy explains what data we collect, why we collect it, and how we protect it. Boxlist is operated by Watchclever Ltd, a company registered in England and Wales (company no. 11673178), which is the data controller for your personal data. We comply with the UK GDPR and EU GDPR.
1. Information We Collect
We collect information you provide directly to us when you create an account, take the taste test, rate content, or contact us. This includes: your name and email address, taste test responses and content ratings, watchlist and library data, and optional profile information. We also automatically collect certain technical information when you use our service, including IP address, browser type, device identifiers, and usage data through cookies and similar technologies.
2. How We Use Your Information
We use the information we collect to: provide, maintain, and improve our services; generate personalised TV, film, and book recommendations tailored to your taste profile; send you transactional emails (account confirmations, password resets) and, with your consent, weekly digest emails; analyse usage patterns to improve recommendation accuracy; and comply with legal obligations. We do not sell your personal data to third parties.
3. Recommendation Activity
When you are signed in, we record which titles with a taste match we showed you, where on the site (for example which row), the match level shown, and whether you opened them. We keep one record per user, per title, per day, with simple counts, and delete each record automatically after 180 days. We use it only to improve your recommendations and to measure how well our matches work. It is not shared with anyone, not sold, and not used for advertising. We record nothing for visitors who are not signed in, and it stores nothing on your device. Our lawful basis is legitimate interest: checking that the matches we show are accurate is central to the service you signed up for, and the records are limited to what we need for that. You can object at any time, with no effect on your account: turn off "Use my activity to improve my recommendations" in Account settings, under Privacy choices. Recording stops straight away, and we delete the records we have already kept about you. The setting is saved to your account, so it applies on every device where you sign in. If your browser sends a Global Privacy Control signal, we treat it as an objection and record nothing. You can also object, or ask us to delete these records, by emailing privacy@boxlist.com.
4. Data Sharing
We do not sell, trade, or rent your personal information to third parties. We may share your data with trusted service providers who assist in operating our platform (such as cloud hosting and email delivery services), strictly under confidentiality agreements. We may disclose information if required by law or to protect the rights and safety of Boxlist and its users. Aggregated, anonymised data (never personally identifiable) may be shared for analytical or research purposes. If you choose to share your taste card, anyone with the link can see the name you chose for it, your taste type and your taste characteristics as they were when you shared. Share links are not listed by search engines, and they stop working if you delete your account or after 12 months. Images of your card already posted on other sites or apps may stay there. Connected AI assistants. If you choose to connect an AI assistant (for example Claude, ChatGPT, Meta Muse or Cursor) to your Boxlist account, we send that assistant, at your request, read-only information from your saved Taste Fingerprint™: your Taste Type, how your taste leans on our taste dimensions, the themes and genres you love and avoid, up to 10 of your favourite titles, and picks ranked for your taste (each with its title, match level and a short reason). To leave out titles you have already seen, we check your ratings and favourites on our side; the assistant only receives the resulting picks. We never send your email address, name or other account details, your individual ratings, your lists, or anything about other users, and the assistant cannot change anything in your account. The assistant's provider (for example Anthropic, OpenAI, Meta or Anysphere, the maker of Cursor) handles that information under its own privacy policy and terms. You can remove an assistant's access at any time in Account settings, under "AI assistants with access"; access stops within a minute. We keep a record of each connection (the assistant's name and website, when you connected it, and when it last used its access) until you remove access or delete your account. Our lawful basis is performance of a contract: sending this information is the service you asked for when you connected the assistant.
5. Data Retention
We retain your personal data for as long as your account is active or as needed to provide our services. If you delete your account, we will delete or anonymise your personal data within 30 days, except where we are required to retain it for legal or compliance purposes. Taste profile data derived from your ratings may be retained in anonymised form to improve our recommendation algorithms.
6. Your Rights (GDPR)
If you are located in the European Economic Area or the United Kingdom, you have the following rights under GDPR: Right of access — you may request a copy of the personal data we hold about you. Right to rectification — you may correct any inaccurate or incomplete data. Right to erasure — you may request deletion of your personal data. Right to restriction — you may request that we limit processing of your data. Right to data portability — you may receive your data in a structured, machine-readable format. Right to object — you may object to processing based on legitimate interests, including the recommendation activity in section 3, which you can turn off yourself in Account settings. To exercise any of these rights, contact us at privacy@boxlist.com.
8. Security
We implement industry-standard security measures to protect your personal data, including encryption in transit (TLS), encrypted storage for sensitive fields, and regular security audits. However, no method of transmission over the internet is 100% secure. We encourage you to use a strong, unique password and to contact us immediately if you suspect unauthorised access to your account.
9. Children
Boxlist is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will delete it promptly. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at privacy@boxlist.com.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and, where appropriate, by email. We encourage you to review this page periodically. Your continued use of Boxlist after changes are posted constitutes your acceptance of the updated policy.
11. Contact Us
If you have any questions about this Privacy Policy or our data practices, please contact us at: Watchclever Ltd (trading as Boxlist) Company no. 11673178, registered in England and Wales Registered office: International House, 12 Constance Street, London E16 2DQ, United Kingdom Email: privacy@boxlist.com Website: boxlist.com