This policy explains how Boxline ("Boxline", "we") handles personal data when you use our website, console, API and cloud sessions.

For your account, billing and our own security, we decide how data is used (we are the controller). For the content your sessions process, such as the pages they load and the files they make, we act on your instructions (we are your processor), and you decide what is collected.

1What we collect

Account data: your email address, project names and plan. Passwords are stored only as salted scrypt hashes, and API keys only as SHA-256 hashes (the full key is shown to you once).
Usage and billing data: sessions, their duration and cost, proxy data volume, AI model usage and cost, your organization's plan, credit, spending limits and payments. Payments are handled by Paddle, our merchant of record: Paddle collects your payment details and billing address under its own privacy notice, and we never receive or store full card details. From Paddle we receive your name, email address, country, the plan you bought, payment status, and invoice and refund records.
Organization and team data: the organizations and projects you belong to, your role, and invitations you send or receive. The owners and admins of an organization see its members' names, email addresses and roles.
Security data: IP addresses and request details, used to apply rate limits, detect abuse and investigate incidents.
Credentials you save: website passwords with their usernames and 2FA keys (or the address we ask for codes, with its signing secret), and secrets such as API keys or tokens; 2FA codes and sign-in links you send us are kept at most 10 minutes. Each value is encrypted at rest, never shown again after saving, and used only as your settings allow (typed by the AI on the credential's sites, or given to your sessions' shells when you allow it).
Session content: what your sessions load and do. That includes pages visited, screenshots and replay frames (when recording is on), console and network logs, shell commands and their output, files in the session's workspace, browser profiles (cookies and local storage), and the tasks, steps and results of AI agent runs.
Communications: messages you send us, such as support requests.

Our website and console use no advertising or analytics trackers. The console uses one sign-in cookie, which it needs to keep you logged in.

2How we use it

To provide the Service: run your sessions, store your data, and show you usage and costs.
To keep the Service safe: prevent and investigate abuse and security incidents, and enforce our Acceptable Use Policy. We monitor metadata such as sites visited and request volumes, and look at session content only for investigations, incidents or lawful requests.
To bill you, and to send service messages about your account.
To support you when you ask us.
To improve reliability using aggregated measurements, not your session content.

We do not sell or rent personal data, we do not use it for advertising, and we do not use your session content to train AI models. We use sessions to build agent trajectory datasets only while your project takes part in the Trajectories program, described below; you can turn it off at any time.

4Trajectories program (optional)

While your project takes part in the Trajectories program, we use its sessions to build datasets of agent trajectories that we license to developers of AI models. It is on by default for new projects. The first time you use the console we explain it and ask you to keep it on or turn it off, and only sessions started after that notice are eligible. You can turn it off at any time in Settings. See our Terms of Service for the full terms.

Before any session data is used, it goes through these steps:

Secrets are removed: passwords, API keys, access tokens, cookies, session identifiers and the contents of browser profiles. Sessions that use browser profiles are excluded.
Personal data is removed or masked in text, page content, addresses (URLs), shell output, file contents and screenshots: names, email addresses, phone numbers, postal addresses, account and customer numbers, payment card and bank details, government identifiers, precise locations, IP addresses, and faces and other personal details in images.
Pages behind a login and personal inboxes, messages and documents are excluded or masked.
Each dataset is reviewed before delivery. Data we cannot clean with confidence is discarded.

Recipients must agree in writing not to re-identify anyone, to keep the data secure, and to use it only to develop and evaluate AI models. We keep a record of which sessions went into which dataset, so we can act on opt-outs and requests. When you turn it off, we stop collecting and delete your eligible data that has not yet been delivered; data already delivered cannot be recalled, but it was cleaned as described above before delivery.

5AI apps you connect to Boxline

You can connect an AI app, such as ChatGPT or Claude, to your Boxline account. You choose Connect in the app, sign in to Boxline, pick a project and allow it. The app can then use sessions, files, page fetching, search, screenshots, data extraction and crawls in that project. It cannot use API keys, billing, members or saved credentials. This section covers the data involved. The rest of this policy applies to it as well.

What we receive: the requests the app sends to Boxline's tools on your behalf, such as web addresses to open, search queries, text to type, commands to run, and files to read or write. When you connect, we also receive your sign-in with your Boxline account email address, and the project you choose.
Why: to run those requests and return their results, and to sign you in and keep the connection secure.
Who receives it: no one new. A request from a connected app is handled like the same request made with an API key, so the service providers listed above apply in the same way. The results go back to the app you connected. If the app asks for your email address and name when you connect, it receives them only if you allow the connection.
How long we keep it: what the app does in a session is kept like other session data, for your plan's retention days after the session stops. The tokens we give the app, and our record of the connection (the app, the project, when it was made and last used), are kept until the tokens expire or are revoked, and are then deleted in our regular clean-up. We store only hashes of the tokens.
How to disconnect: in the Boxline console, open Account from the user menu, then Connected apps, and choose Revoke next to the app. The app's access ends within a minute. You can also email privacy@boxline.dev.

6International transfers

We store and process data in the United States. When we transfer personal data from the European Economic Area, the UK or Switzerland, we use the European Commission's standard contractual clauses and, for the United Kingdom, the UK International Data Transfer Addendum to them.

7How long we keep it

Account data: while your account is open, and 30 days after you close it.
What a stopped session saved (its browser state and the files in its workspace), its recordings, logs, events and the AI agent's step screenshots: 7 days after the session stops on the Free plan, 30 days on Hobby and Startup, and 90 days on Scale (or as your contract says). Then the session is deleted and all of this goes. You can resume a stopped session before then, and you can delete a session yourself at any time, which deletes all of this at once. The session's own record (its times and usage) stays for billing.
Checkpoints (copies we save while a session runs so it can recover): replaced by what the session saves when it stops, and deleted with the session.
Browser profiles: until you delete them or close your account.
Credentials: until you delete them or close your account.
Security logs: 90 days, longer when needed for an investigation.
Billing records: as long as tax and accounting law requires.

8How we protect it

Every session runs in its own isolated sandbox (gVisor) that is never shared or reused. Data is encrypted in transit (TLS) and at rest. Passwords and API keys are stored only as hashes, and passwords for your own proxies are encrypted. Access to production systems is limited to people who need it. No system is perfectly secure; we will tell you without undue delay if a breach affects your data.

9Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict how we use it, and to withdraw consent. Residents of California have the right to know, delete and correct personal data, and not to be discriminated against for using these rights; we do not sell or share personal data for advertising.

To use these rights, email privacy@boxline.dev. We may need to confirm your identity. If your data is in a Boxline customer's session content, contact that customer; we will help them respond. You may also complain to your local data protection authority.

10Children

Boxline is not for children. We do not knowingly collect personal data from anyone under 18.

11Changes

We will post changes here and update the date above. For material changes we will also tell you by email or in the console.

12Contact

Boxline, 1111B S Governors Ave, Suite 43066, Dover, DE 19904, United States. Email privacy@boxline.dev.