The types of personal data we may collect and use
We may collect and process the following personal data from or about you or your devices from various sources, as described below. Where applicable, we indicate whether and why you must provide us with your personal data, as well as the consequences of failing to do so. If you do not provide your personal data when requested, you may not be able to use the full extent of the Service if that personal data is necessary to provide you with the Service or if we are legally required to collect it.(a) Personal Data You Provide to Us
- Account data - We collect the data you provide to create, update, or manage your account, including, for example, your name, email address, organization name, workspace name, team members’ names and email addresses, and invite history.
- Authentication and integration data - When you sign up for or connect to the Service through a third-party identity provider or integration (such as GitHub or Google), and when you use the Service, we collect authentication and integration credentials, including OAuth tokens, session tokens, and API keys.
- Service data - We collect the personal data you provide when you use the Service.
- Contact data - We may collect your personal data when you inquire about us, the Service, or when you otherwise interact with us. This data may include your name, email address, and any data you choose to provide to us.
- Communications data - If you contact us directly, we may receive personal data about you, such as your name, email address, the contents of a message or attachments that you may send to us.
- Payment information. If you make a payment to us, your payment-related information, such as credit card or other financial information, is collected by our third-party payment processor on our behalf.
(b) Personal Data We Collect When You Use the Service
- Location data - We may collect and infer your general location information, including, for example, by collecting and using your internet protocol (“IP”) address.
- Device data - We may receive information about your device and software, including IP address, device type, device identifiers, web browser type and version, and operating system version.
- Usage data - We automatically receive information about your interactions with the Service, including the features you use, the actions you take, and the dates and times of your visits. This includes timestamped records of actions taken within the Service, such as logins, scan or evaluation triggers, team invitations, Agents added, and Agents configured for tracing, as well as product analytics such as feature usage and session duration. This activity is associated with your account and organization.
- Agent data – The Service allows you to onboard artificial intelligence agents (“Agents”). When you onboard Agents, we will receive information about your Agents, including Agent names, subcomponents, frameworks, models, model context protocol server tools, and IP addresses from the traces with the Agents.
- Switch telemetry data – We may collect anonymous telemetry, including which features you use and how often, errors and crashes, and your app version and operating system. You can enable or disable this setting at any time in your Switch settings.
(c) Personal Data We Receive from Other Sources
- Information from Third-Party Services and Integrations - If you choose to link the Service to a third-party account, including an identity provider, an application programming interface (“API”), or a large language model (“LLM”) provider, we may receive information about you, including your use of the third-party account. If you wish to limit the information available to us, you should visit the privacy settings of your third-party accounts to learn about your options.
Using your personal data, the legal bases, and purposes
We use the personal data we collect:- To provide, maintain, improve, debug, administer, and enhance the Service;
- To understand your preferences and analyze how you use the Service and develop new products, services, features, and functionality;
- To train, develop, and improve the artificial intelligence, machine learning, and models that we use to support the Service;
- To communicate with you, provide you with relevant updates and other information, provide information that you request, respond to comments and questions, and otherwise provide customer support;
- To evaluate how you navigate and use the Service in order to customize your experience, recommend relevant features or plans, and send you relevant sales and promotional communications regarding products or services that may be of interest to you;
- For marketing and advertising purposes, such as developing and providing promotional and advertising materials that may be relevant, valuable or otherwise of interest to you;
- To generate anonymized or aggregated data containing only de-identified, non-personal data that we may use for any lawful purposes;
- To facilitate the connection of third-party services or applications, including authentication tokens, APIs, and LLMs;
- To find and prevent fraud and abuse, resolve disputes, or respond to trust and safety issues that may arise;
- For compliance purposes, including enforcing our contracts or other legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency; and
- For other purposes for which we provide specific notice at the time the information is collected.
- Contractual Necessity - You may enter into a contract with us and some processing will be necessary for the performance of that contract or will be done at your request prior to entering into that contract. The provision of certain personal data may be necessary to provide our Service.
- Compliance with Legal Obligation - Processing may be necessary to discharge a relevant legal or regulatory obligation. For example, we may process your personal data to comply with tax and accounting obligations.
- Legitimate Interests - We may process your personal data where we or a third party have a legitimate interest in processing your personal data. The processing will, in all cases, be necessary for the legitimate business interests of SandboxAQ, such as (i) carrying out the ordinary or reasonable business activities of SandboxAQ; (ii) conducting internal analytics; and (iii) ensuring the security of information systems. We only rely on our or a third party’s legitimate interests to process your personal data when these interests are not overridden by your rights and interests.
- Consent - We may also process data where you have provided consent. You have the right to withhold consent or withdraw it at any time in the future.
How we may disclose your personal data
- Partners and Affiliates - We may disclose any information we receive to our current or future affiliates for any of the purposes described in this Privacy Policy.
- Vendors and Service Providers - We may disclose any information we receive to vendors and service providers retained in connection with the Service.
- AI Service Providers - We may disclose information we receive to vendors that provide artificial intelligence services in order to provide you with the Service.
- LLMs - Our Service allows you to, upon your direction, disclose information to third-party LLMs, such as Anthropic. You understand and agree that the use of your information by any third-party LLMs will be governed by the privacy policies of these third-party LLMs. We encourage you to review their privacy policies.
-
As Required By Law and Similar Disclosures - We may access, preserve, and disclose your information if we believe doing so is required or appropriate to:
- Comply with law enforcement requests and legal process, such as a court order or subpoena;
- Respond to your requests;
- Protect your, our, or others’ rights, property, or safety;
- Protect against legal liability; or
- Investigate fraud or other unlawful activity.
- For the avoidance of doubt, the disclosure of your information may occur if you post any objectionable content on or through with the Service.
- Merger, Sale, or Other Asset Transfers - We may transfer your personal data to service providers, advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company or we sell, liquidate, or transfer all or a portion of our assets.
- Consent - We may also disclose your information with your permission.