Privacy Notice

Azin Tech Operating Company B.V., trading as “Boxd”

This notice explains how Boxd collects and uses your personal data. It applies to visitors to our website and to customers who register for and use the Boxd platform. It does not cover Customer Content: the data our customers choose to store, process or transmit inside a Virtual Machine. We have no routine access to Customer Content; where we process personal data within Customer Content on a customer’s behalf, that processing is governed by our Data Processing Agreement, not this notice.

If you have questions, contact us at privacy@boxd.sh.

1. Who We Are

Boxd is a trading name of Azin Tech Operating Company B.V. (KvK 99718340, VAT NL869104743B01), registered office at Westerstraat 246-2, 1015 MT Amsterdam, the Netherlands. We are the data controller for the personal data described in this notice.

2. Who This Notice Applies To

• Website visitors: anyone who browses our website.
• Customers: individuals or organisations that register for and use the Boxd platform.

Where a customer’s own end users interact with a Virtual Machine that customer hosts, that customer (and not Boxd) is responsible for any privacy notice covering those end users.

3. What Data We Collect

• Account and registration data: name, e-mail address and, where provided, organisation name.
• Billing and payment data: billing name and address, and Stripe customer/transaction references. We do not see or store full card details: our payment processor, Stripe, handles that.
• Support communications: the content of messages you send our support team, and any attachments.
• Technical and security data, collected automatically: IP addresses, connection and traffic patterns, and usage metrics, used for billing and to detect and prevent abuse.
• OAuth sign-in data: profile data from GitHub or Google when you sign in via OAuth (user ID, username, avatar, e-mail address).
• SSH keys registered to your account.
• Machine and subdomain names you assign to a Virtual Machine.
• Integration credentials for third-party tools you connect at organisation level (for example GitHub, Linear or Slack).
• Virtual Machine lifecycle and usage events (created, started, stopped, destroyed), used for billing and operations.
• Website data: standard analytics and cookie data, see Section 9.

We do not access, collect or use the content of your Virtual Machine as a matter of course.

4. Why We Process Your Data and Our Legal Basis

• To create and manage your account and deliver the Services. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• To calculate and collect fees. Legal basis: performance of a contract.
• To respond to support requests. Legal basis: performance of a contract and legitimate interests.
• To detect and prevent abuse (for example cryptocurrency mining, denial-of-service attacks, unauthorised scraping, or illegal content) and to protect the Services and third parties. Legal basis: legitimate interests and, where applicable, legal obligation.
• To comply with tax, accounting and other statutory obligations. Legal basis: legal obligation.
• To send product updates or newsletters, only with your consent. Legal basis: consent.

5. Third-Party AI Tools

We pre-install third-party coding agents (for example Claude Code or Codex) in Virtual Machines. These run under your own account with that provider. We are not a party to that processing, we do not receive that data, and we do not use your data to train or improve any AI model.

6. Who We Share Your Data With

• Stripe: payment processing and billing (Stripe Payments Europe Ltd, Ireland; certain processing under the EU-U.S. Data Privacy Framework).
• Latitude.sh LLC (Delaware, United States): bare-metal server infrastructure for our European Union and United States clusters.
• GitHub and Google: for OAuth sign-in only.
• Competent authorities: law enforcement, courts or regulators, where required by law, including mandatory reporting of suspected illegal content such as child sexual abuse material.

We do not sell personal data, and we do not share it with third parties for their own marketing purposes.

7. International Transfers

If you choose our European Union Cluster, your Virtual Machine’s infrastructure stays within the EU/EEA, though some account and billing data may still be processed outside the EU/EEA by the providers listed above (for example, Stripe processes billing data in the United States). If you choose our United States Cluster, or are otherwise located outside the EU/EEA, your data may be transferred to and processed in the United States. Where we transfer data outside the EEA, we rely on the EU-U.S. Data Privacy Framework (Stripe) or Standard Contractual Clauses (Latitude.sh).

8. How Long We Keep Your Data

• Account and billing data: for as long as you use the Services, plus seven (7) years, to satisfy Dutch statutory bookkeeping obligations.
• Support communications: twenty-four (24) months.
• Technical and security data: twelve (12) months, after which it is deleted or anonymised.

9. Cookies

We use only strictly necessary login and session cookies on the Boxd console. We do not place analytics, marketing or advertising cookies, and we do not run a cookie banner. If that changes, we will add one before we do.

10. Children’s Privacy

Our Services are not directed at, and we do not knowingly collect personal data from, anyone under the age of 18. If we become aware that we have collected personal data from someone under that age, we will delete it and, where required, notify the competent supervisory authority.

11. Your Rights

Subject to the conditions and exceptions in applicable law, you have the right to: access your personal data; request rectification of inaccurate or incomplete data; request erasure of your data; request restriction of processing; object to processing based on legitimate interests; request data portability; and withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, contact us at privacy@boxd.sh. We will respond within one month.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), or the supervisory authority of your own country of residence.

12. Changes to This Notice

We may update this notice from time to time, for example to reflect changes to our Services or applicable law. We will communicate material changes by e-mail and/or by posting a notice on our website, together with an updated “last updated” date.

13. Contact Us

Email: privacy@boxd.sh

Post: Azin Tech Operating Company B.V. (trading as “Boxd”), Westerstraat 246-2, 1015 MT Amsterdam, the Netherlands