Purpose
Playbox AI is committed to protecting information assets against unauthorized access, disclosure, alteration, and destruction. This policy establishes the framework for identifying risks, applying appropriate controls, and continuously improving our security posture.
Scope
This policy applies to:
- The public marketing site at playbox.website.
- Operational systems used to deliver Playbox AI product features (including hosted applications).
- Personnel and contractors with access to Playbox systems or customer data.
- Third-party service providers that process data on our behalf.
Information security objectives
- Protect customer, user, and business information in line with legal and contractual obligations.
- Maintain service availability and resilience against disruption.
- Ensure security responsibilities are clear and communicated across the organization.
- Review and improve controls as threats, technology, and business requirements evolve.
Roles and responsibilities
Management is responsible for approving this policy and allocating resources for security measures. Operational teams implement technical and organizational controls. All users with system access must follow security procedures, report suspected incidents promptly, and complete security awareness as required.
Risk management
We identify information security risks, assess likelihood and impact, and treat risks through a combination of technical controls, process changes, and accepted residual risk documented by management. Risk reviews are performed periodically and after significant changes to systems or services.
Key control areas
Controls are aligned with ISO/IEC 27001 Annex A themes, including:
- Access control — least-privilege access, authentication, and periodic access reviews.
- Asset management — inventory of systems and data, ownership, and acceptable use.
- Cryptography — encryption in transit (TLS) and encryption at rest where applicable.
- Operations security — logging, monitoring, vulnerability management, and secure configuration.
- Supplier relationships — due diligence and contractual security requirements for vendors.
- Incident management — detection, response, containment, and post-incident review.
- Business continuity — backups and recovery procedures for critical services.
- Compliance — adherence to applicable laws, regulations, and internal policies.
Data classification and handling
Information is handled according to sensitivity. Personal data is processed in accordance with our Privacy Policy. User-submitted content (such as images and prompts) is processed only as needed to provide the service and is protected with appropriate access restrictions.
Incident reporting
Suspected security incidents, data breaches, or policy violations must be reported without delay to [email protected]. We investigate reports, take corrective action, and notify affected parties or regulators when required by law.
Training and awareness
Personnel with access to production systems or sensitive data receive security guidance appropriate to their role, including password hygiene, phishing awareness, and secure handling of customer information.
Policy review
This policy is reviewed at least annually and updated when there are material changes to our services, regulatory environment, or risk landscape. The “Last updated” date reflects the most recent revision.
Certification status
This page describes our information security policy and control framework. Unless we publish a separate statement with a valid certificate number and scope, Playbox AI should not be described as ISO/IEC 27001 certified. For certification or audit inquiries, contact [email protected].
Related documents
Privacy Policy · Terms of Service · Parenting & safer experiences