emploidai Marketplace

emploidai Marketplace

Box Datasource privacy policy

Policy content supplied in the product package by its publisher.

← Back to Box Datasource

Privacy Policy

This privacy policy outlines how the Dify Box Datasource Plugin handles your information when you use it to interact with your Box cloud storage.

Data Collection

The Dify Box Datasource Plugin requires the following information to function:

  1. Box OAuth Credentials: Your Box OAuth 2.0 client ID and client secret are required to authenticate with the Box API. These credentials are securely stored by Dify's credential management system and are used solely for making API requests to your Box account on your behalf.

  2. OAuth Tokens: During the OAuth flow, the plugin obtains and stores:

    • Access tokens for API authentication
    • Refresh tokens for automatic token renewal
    • Token expiration information

  3. User Information: The plugin retrieves basic user information from Box API:

    • User name
    • User email address
    • User ID (for API operations)

  4. File Operations Data: When you use the plugin to browse or download files:

    • File metadata (names, IDs, sizes, types)
    • Folder paths and structures
    • File content (only when explicitly downloading)

Data Processing

  • OAuth Credentials: Your Box OAuth credentials are used exclusively to authenticate API requests sent from the plugin to your Box account. They are not used for any other purpose.

  • File Operations: The plugin processes file data only when you explicitly request file browsing or downloading:

    • File browsing: Retrieves file and folder metadata from your Box account
    • File downloading: Downloads file content temporarily for processing
    • No file content is stored persistently by the plugin

  • Real-time Processing: All operations are performed in real-time. File content is processed on-demand and not cached or stored locally.

Third-party Services

This plugin interacts directly with the Box API and Box OAuth 2.0 services. Your use of Box is subject to Box's privacy policy and terms of service. The plugin acts as an intermediary, sending your requests and data to the Box API and returning Box's responses. No data is shared with any other third-party services.

Box API Scopes

This plugin requests the following Box API scopes:

  • root_readwrite: Required for reading and browsing files and folders in your Box account

Data Retention

The Dify Box Datasource Plugin itself does not store your file content persistently. The plugin follows these data retention practices:

  • OAuth Tokens: Stored securely in your Dify workspace and automatically refreshed when needed
  • File Content: Downloaded temporarily for processing and not retained after the operation completes
  • File Metadata: Retrieved in real-time and not cached or stored locally
  • User Information: Retrieved during OAuth flow for display purposes only

All file data resides within your Box account and is subject to Box's data retention policies. Logs generated by Dify during plugin execution might contain operational data but are handled according to Dify's platform policies.

Data Security

  • Encryption: All communication with Box API is encrypted using HTTPS
  • Token Security: OAuth tokens are stored securely in your Dify workspace
  • No Logging: File content and sensitive metadata are not logged
  • Access Control: The plugin only accesses files and folders that you explicitly request
  • Scope Limitation: The plugin requests only the minimum required API scopes

User Rights

Your rights regarding the data stored within Box (files, folders, etc.) are governed by your Box account settings and Box's policies. You can manage your data directly within Box. For data handled by the Dify platform (like stored OAuth credentials), please refer to Dify's privacy policy and user settings.

You have the right to:

  • Revoke access to your Box account at any time through Box Account settings
  • Delete your Box OAuth application credentials
  • Request information about how your data is being used
  • Control which Box API scopes are granted to the application
  • Stop using the plugin at any time, which will prevent further data access

File Access and Privacy

  • Selective Access: The plugin only accesses files and folders that you explicitly browse or download
  • No Background Scanning: The plugin does not scan or index your Box content automatically
  • Temporary Processing: File content is processed only when you request a download and is not stored after processing
  • Metadata Only: File browsing operations only retrieve metadata (names, sizes, types) without accessing file content

Compliance

This plugin is designed to comply with:

  • Box's API terms of service and privacy policy
  • Dify's platform privacy and security standards
  • OAuth 2.0 security best practices

Contact Information

If you have any questions or concerns about the privacy practices of this plugin, please contact the plugin author at hello@dify.ai

Changes to This Policy

This privacy policy may be updated from time to time. Users will be notified of any material changes through the plugin's update mechanism.

Last updated: 2025-08-28