Privacy Policy

This policy explains what personal data Elsebox collects, why, who helps us process it, and the rights you have. It applies to elsebox.dev, the Elsebox dashboard, the Mac app, the Elsebox MCP servers and the machines we run for you.

1. Who is responsible

The controller of your personal data is Elsebox. For anything about your data, including requests to use your rights, write to help@elsebox.dev.

Elsebox is built on the Estage Genesis platform. Your account, machine records, usage and keys are stored in a database in Frankfurt, Germany. Each machine and its disk run on Amazon Web Services in the region you choose for it: Frankfurt (Germany) or N. Virginia (USA). The website itself, and the emails we send, are served from the United States.

2. What we collect and why

We get this data from you, from your AI agents and apps acting for you, and from Google and Polar if you use them. You don’t have to give it to us, but without an email address we can’t create your account.

“Contract” means we need the data to provide the Service you signed up for. “Legitimate interest” means we use it for a reasonable purpose of ours that does not override your interests, and you can object to it at any time.

3. Watching a machine, and your AI agents

• When you watch a machine in the browser or the Mac app, its picture, sound, and your mouse and keyboard travel directly between your device and the machine, encrypted. They don’t pass through our servers and we don’t record them. Only setting up the connection goes through our website, and the machine’s own access key never reaches your browser.
• When you connect an AI agent, what it reads from a machine (screenshots, command output, files it fetches) goes to the agent and to the AI company behind it, such as Anthropic or OpenAI, under your agreement with them. Elsebox doesn’t send your machines’ data to any AI company itself.

4. Who we share data with

These companies process personal data for us, under contracts that only allow them to use it to provide their services to us:

We also share data when you ask us to, or when the law requires it:

• Authorities, when a valid legal request requires it. We check such requests and push back on ones that are too broad.
• A buyer of Elsebox, if the business is sold or merged. We will tell you before your data becomes subject to a different privacy policy.

We don’t sell personal data, and we don’t share it for advertising.

5. Transfers outside your country

Some of our providers are in the United States, and the website and our emails are served from there. If you pick N. Virginia for a machine, that machine and its files are in the United States too. When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland, we use safeguards that data protection law recognizes, such as the European Commission’s Standard Contractual Clauses included in our providers’ data processing terms. For people in Russia, Kazakhstan and other CIS countries, the transfer is needed to provide the Service you signed up for, and you agree to it when you create your account.

6. How long we keep data

The table in section 2 shows how long we keep each kind of data. When you delete a machine, its disk is deleted at once and can’t be recovered. When you ask us to delete your account, we delete your machines and your data within 30 days, except records we must keep by law.

7. Security

• All traffic to Elsebox and to your machines is encrypted.
• Every machine has its own access key and its own security certificate, which our apps check before they send the key.
• API keys and tokens are stored only as one-way hashes.
• Access to data inside Elsebox is limited to what each part of the system needs.

No system is perfectly secure. If a breach puts your data at risk, we will tell you and, where the law requires it, the authorities.

8. Your rights

Wherever you live, you can ask us for a copy of your data, to correct it, or to delete it, by writing to help@elsebox.dev from the email address of your account. We answer within 30 days and may ask you to confirm it is you. You can delete machines, keys and connected apps yourself in the dashboard.

European Economic Area, United Kingdom and Switzerland

You have the right to access your data, to correct it, to have it erased, to restrict its processing, to receive it in a portable format, and to object to processing based on legitimate interest. Where we rely on your consent, you can withdraw it at any time. You can also complain to the data protection authority where you live or work.

United States

• In the last 12 months we collected identifiers (such as your email and IP address), commercial information (your plan and purchases) and internet activity (logs), for the purposes in section 2.
• We don’t sell or share personal information for cross-context behavioral advertising.
• Residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states with privacy laws can ask to know, correct and delete their personal information. We won’t treat you differently for using these rights. You can use an authorized agent. If we refuse a request, you can appeal by replying to our answer.
• We don’t track you across other websites, so Do Not Track and Global Privacy Control signals don’t change anything here.

Russia, Kazakhstan and other CIS countries

We process your data to perform our agreement with you and with your consent. By signing in after reading this policy, you consent to the processing of your personal data on the terms set out here, including its transfer to and storage in Germany and the United States. Your consent lasts until you delete your account or withdraw it.

• We collect, record, organize, accumulate, store, update and change, retrieve, use, transfer (provide and give access to), anonymize, block, delete and destroy personal data.
• Processing is automated.
• You can get information about how your data is processed, ask us to update, block or destroy it if it is incomplete, out of date, inaccurate or no longer needed for its purpose, and withdraw your consent, by writing to help@elsebox.dev.
• Without your consent the Service can’t work, so if you withdraw it we close your account and delete your data within 30 days, except data we must keep by law.
• You can complain to the authority that protects personal data in your country, or go to court.

9. Children

Elsebox is for adults. We don’t knowingly collect data from anyone under 18. If you believe a child has given us personal data, write to us and we will delete it.

10. Cookies and local storage

The site sets no cookies for advertising or analytics. It keeps a few things in your browser’s local storage so it works:

11. Changes

If we change this policy in a way that matters, we will email you at least 14 days before the change takes effect. The date at the top shows the latest version. The Terms of Service explain the rest of our agreement.