Privacy Policy | Terrabox.ai

1. Who we are

This policy explains how Terrabox.ai Pty Ltd (ACN 699 975 981) (Terrabox) handles personal information, in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. It covers our website, our AI agent and infrastructure services, the apps and consoles we give customers, and how we deal with customers, prospective customers and their people.

Separately, customers give us documents and data to process, and run data, models and code on Terrabox (Customer Data). Customer Data can contain personal information, for example names and contact details in supplier quotes or emails. We handle Customer Data only to provide the Services to that customer, as our Terms of Service and the customer's Order allow, and we tell customers which AI model providers it may be sent to (sections 5 and 6).

2. What we collect

When we give you an account (on a console or an agent app)

Your name, work email address, company, and the date you accepted our Terms.
Your password, stored only as a salted hash, never in readable form.
Where offered and turned on, two-factor sign-in: the authenticator secret, and hashes of your recovery codes.
API keys you create (stored only as hashes), with when and from which IP address each was last used.
SSH public keys and the names and emails of the people you authorise to access your environment.
Sign-in and security events: times, IP addresses and browser user-agent.

When you pay

Invoices, amounts and payment status. If you pay by card, Stripe collects your card details directly; we receive only the card brand, last four digits and expiry, and Stripe's reference numbers.

When you use an agent

The name you enter, and the decisions you make in the agent's app (for example accepting or skipping a price, or confirming a quantity), with the time. This is kept as an append-only log so the customer has an audit trail of who decided what.
Records of the agent's model calls: when, for what purpose, how many tokens and what they cost.

When you use our infrastructure

Operational metadata, such as GPU utilisation and memory use, usage, the container images you start, and management-controller logs (including power and console actions on a dedicated node), used to run, bill and secure the Services.

When you contact us or visit the website

What you send us by email or the contact form, and standard web server logs (IP address, pages requested, time).

3. Cookies

Our marketing website doesn't set cookies. Signed-in consoles and agent apps use an essential cookie that keeps you signed in and can't be used to track you elsewhere. We don't use advertising or third-party tracking cookies.

4. How we use it

To create and secure your account, sign you in and keep it safe (including sending you security notices).
To provide, meter and bill the Services, and to take payment.
To build, test, run and improve the agents we provide to the customer you work for.
To provide support and tell you about maintenance and changes.
To prevent fraud and abuse and enforce our Acceptable Use Policy.
To meet legal, tax and regulatory obligations.
With your consent, to send you news about Terrabox — you can opt out at any time.

We don't sell personal information. We don't use Customer Data to train models or build agents for anyone other than the customer it belongs to.

5. Who we share it with

Stripe — card payment processing.
AI model providers: where an agent uses a third-party model, the documents and text the agent sends it, which may include personal information in Customer Data. The customer's Order names the providers, and we tell the customer before adding one.
Our email provider — to send you verification, sign-in, security and billing emails.
Equinix — our data centre provider in Sydney, for the people we register to access the facility. Equinix does not have access to Customer Data on our equipment.
Our professional advisers — lawyers, accountants and auditors, under confidentiality.
Law enforcement and regulators — where the law requires or permits it.
A buyer of our business — if Terrabox is sold, under confidentiality.

6. Overseas disclosure

Customer Data held on infrastructure Terrabox operates stays in Sydney.

Where an agent uses a third-party AI model provider, the Customer Data the agent sends to that model is processed where the provider operates, which may be outside Australia. We tell the customer which providers an agent uses, and where they process data, before any Customer Data is sent. A customer can instead have an agent run on open-source models hosted on our own infrastructure, so that its Customer Data does not leave Australia.

Some account and billing information is handled by providers that operate outside Australia: Stripe (United States and other locations) processes card payments, and our email provider may process email outside Australia. We take reasonable steps to ensure these providers handle personal information consistently with the Australian Privacy Principles.

7. How we protect it

Account data for our consoles is held on Terrabox-controlled systems.
Passwords are hashed with scrypt; API keys, recovery codes and session tokens are stored only as hashes; two-factor sign-in is required for the console.
Agent decision logs are append-only, and model answers are stored on systems we control.
Emails that contain one-time links are removed from our systems once sent.
Access to administrative systems is restricted to Terrabox staff on our management network.

No system is perfectly secure. If a data breach is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

8. How long we keep it

Account details: while your account is open, then up to 2 years.
Invoices and payment records: 7 years, as Australian tax law requires.
Security and sign-in logs: up to 2 years.
Agent decision logs and Customer Data: for the life of the customer's Order, then returned or deleted as our Terms of Service say.
Unconfirmed sign-ups are deleted after a few days.

9. Access, correction and complaints

You can ask for access to, or correction of, the personal information we hold about you by emailing privacy@terrabox.ai. We'll respond within 30 days. You can update most account details yourself in the app or console you use.

If you have a complaint about how we've handled your personal information, email us first and we'll respond within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

10. Changes to this policy

We'll post changes here and, for material changes, email account holders before they take effect.