Privacy Policy

Boxbuild Inc., operating under the brand "CodeCargo," ("Company", "we", or "us") respects your privacy and is committed to protecting it through our compliance with this policy.

This policy describes the types of information we may collect from you or that you may provide when you engage with, access, or use the Services (defined below) and our practices for collecting, using, maintaining, protecting, and disclosing that information. It also describes how we handle the source code, repository data, and related content that our customers entrust to us ("Customer Content") and how artificial intelligence features process that content.

This policy applies to information we collect:

On codecargo.com and other sites hosted by the Company ("Website");
Through your access to and use of our software (including cloud services and downloadable software) provided to you pursuant to one or more order forms ("Software"), including the CodeCargo platform, its agents, and integrations with GitHub and other source-control and CI/CD providers (collectively with the Website, the "Services").

It does not apply to information collected by any third party, including through any application or content that may link to or be accessible from or through the Website, or to the privacy practices of GitHub or any other third-party platform you connect to the Services.

Please read this policy carefully to understand our policies and practices regarding your information and how we will treat it. If you do not agree with our policies and practices, your choice is not to use the Services. By accessing or using the Services, you agree to this privacy policy. This policy may change from time to time (see Changes to Our Privacy Policy). Your continued use of the Services after we make changes is deemed to be acceptance of those changes, so please check the policy periodically for updates. The Services are hosted in the United States (see Where We Store Your Information and International Transfers).

Our Role: Controller and Processor

When you visit our Website, register for an account, or communicate with us, we act as the "controller" (or "business") of the personal information we collect, and this policy governs that processing.

When a customer organization connects its repositories, workflows, or other systems to the Services, we process Customer Content, including any personal information contained in it (for example, commit author names and email addresses, GitHub usernames, and names appearing in code comments or CI logs), solely on behalf of and under the instructions of that customer. In that context the customer is the controller and we are the "processor" (or "service provider"). Our processing of Customer Content is governed by our agreement with the customer, including our Data Processing Addendum ("DPA"), and by this policy to the extent it does not conflict with that agreement. If you have questions about how a customer uses the Services or wish to exercise rights regarding personal information contained in Customer Content, please contact that customer directly.

Users Under the Age of 18

Our Services are not intended for users under 18 years of age. No one under age 18 may provide any information through the Services. We do not knowingly collect personal information from users under 18. If you are under 18, do not use or provide any information through the Services or any of their features, register on the Website, or provide any information about yourself to us, including your name, address, telephone number, email address, or any screen name or user name you may use. If we learn we have collected or received personal information from a user under 18 without verification of parental consent, we will delete that information. If you believe we might have any information from or about a user under 18, please contact us using the contact information provided in this policy below.

Information We Collect About You and How We Collect It

We collect several types of information from and about users of the Services, including information:

By which you may be personally identified, such as name, email address, telephone number, IP address, employer and job title, GitHub or other source-control username and profile identifiers, any other identifier by which you may be contacted online or offline ("personal information");
That is about you but individually does not identify you, such as anonymized and de-identified data; and/or
About your internet connection, the equipment you use to access the Services, and usage details; and
Customer Content that a customer organization submits to the Services, described below.

We collect this information:

Directly from you when you provide it to us.
Automatically as you navigate through the Services. Information collected automatically may include usage details, IP addresses, and information collected through cookies, product analytics tools, and other tracking technologies.
From third parties, for example, our business partners and service providers, and from source-control and CI/CD platforms (such as GitHub) that you or your organization authorize us to access.

Information You Provide to Us

The information we collect on or through the Services may include:

Information that you provide by filling in forms through the Services. This includes information provided at the time of registering to use our Website or Software, subscribing to a service or to receive communications, or posting material to the Services. We may also ask you for information when you submit a request, or report a problem with the Services.
Records and copies of your correspondence (including email addresses and content), if you contact us.
Details of your organization's subscription and order history. We do not collect payment card information through the Services (see Payment Information).
Your responses to surveys that we might ask you to complete for research purposes.
Your search queries and prompts, instructions, and messages you submit to AI features within the Services.

Customer Content

When a customer organization connects its systems to the Services, we access and process the content necessary to deliver the features the customer has enabled. Depending on configuration, Customer Content may include:

Source code, configuration files, and repository contents;
Repository, organization, pull request, issue, and workflow metadata, including commit history and author identities;
CI/CD workflow definitions, run logs, and build artifacts;
Access tokens, installation credentials, and API keys the customer provides so the Services can act on its behalf;
Prompts, instructions, and other inputs submitted to AI features, and the outputs, proposed changes, and pull requests those features generate; and
Service catalog, compliance, and policy information the customer records in the Services.

We process Customer Content only to provide, secure, support, and improve the Services for that customer, as described in our agreement with the customer. We do not use Customer Content to train artificial-intelligence or machine-learning models (see Artificial Intelligence and Customer Content).

Information We Collect Through Automatic Data Collection Technologies

As you navigate through and interact with our Services, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including:

Details of your visits to our Services, including traffic data, approximate location derived from IP address, logs, and other communication data and the resources that you access and use on the Services.
Information about your computer and internet connection, including your IP address, operating system, and browser type.
Product usage events, such as the features you use, pages you view, and actions you take within the Software, so that we can understand how the Services are used and improve them.

The information we collect automatically may include personal information, or we may maintain it or associate it with personal information we collect in other ways or receive from third parties. It helps us to improve our Services and to deliver a better and more personalized service, including by enabling us to:

Estimate our audience size and usage patterns.
Store information about your preferences, allowing us to customize our Services according to your individual interests.
Recognize you when you return to our Services.
Detect, investigate, and prevent security incidents and abuse.

The technologies we use for this automatic data collection may include:

Cookies (or browser cookies). A cookie is a small file placed on the hard drive of your computer. We use strictly necessary cookies to keep you signed in and to secure your session, and analytics cookies as described below. You may refuse to accept browser cookies by activating the appropriate setting on your browser. However, if you select this setting you may be unable to access certain parts of our Services. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you direct your browser to our Services.
Web Beacons. Pages of our Website and our emails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit the Company, for example, to count users who have visited those pages or opened an email and for other related website statistics (for example, recording the popularity of certain website content and verifying system and server integrity).
Analytics and Consent. We use PostHog for product analytics and Google Analytics and Google Tag Manager on the Website. These tools are off by default and load only after you choose a consent level in our cookie banner. "Analytics" consent enables usage events and page views. "Marketing" consent additionally enables session replay, which records how you interact with pages so we can diagnose usability problems. You can change or withdraw your choice at any time through the cookie settings link, and we honor the Do Not Track and Global Privacy Control browser signals. These providers process this information on our behalf as service providers and are not permitted to use it for their own purposes.
Combining Data. We may tie non-personal information collected automatically to personal information about you that we collect from other sources or that you provide to us.

No Advertising or Sale of Personal Information

We do not serve third-party advertisements on the Services, do not use advertising networks or cross-site behavioral tracking, and do not sell or "share" (as defined under California law) personal information or Customer Content for advertising or any other purpose.

How We Use Your Information

We use information that we collect about you or that you provide to us, including any personal information:

To present our Services and their contents to you.
To provide you with information, products, or services that you request from us.
To operate the features a customer has enabled, including analyzing repositories and workflows, generating proposed changes, running agents and jobs, and enforcing the customer's configured policies and guardrails.
To operate AI features, including transmitting the necessary Customer Content and prompts to the model providers described in Artificial Intelligence and Customer Content.
To provide you with notices about your account, including expiration and renewal notices.
To carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collection.
To notify you about changes to the Services.
To allow you to participate in interactive features on the Services.
To monitor, secure, and troubleshoot the Services, including detecting and preventing fraud, abuse, and security incidents.
To maintain audit logs of actions taken in the Services, including actions taken by AI agents on a customer's behalf, so that customers can review and verify those actions.
To improve and develop the Services, using aggregated or de-identified usage information. We do not use Customer Content to train machine-learning models.
In any other way we may describe when you provide the information.
To fulfill any other purpose for which you provide it.
For internal business purposes.
For any other purpose with your consent.

We may also use your business contact information to contact you about our products and services that may be of interest to you. If you do not want us to use your information in this way, please contact us via the contact information provided in this policy, or use the unsubscribe link in any marketing email.

Artificial Intelligence and Customer Content

Certain features of the Services use large language models and other artificial-intelligence technologies ("AI Features") to analyze Customer Content, answer questions, and generate proposed changes, workflows, and pull requests. This section describes how Customer Content is handled when AI Features are used.

Model provider. AI Features are delivered using the Claude family of models (Claude Haiku, Claude Sonnet, and Claude Opus) operated by Anthropic, PBC, accessed through the Anthropic API and processed in the United States. Customers may instead configure the Services to use their own model-provider accounts and API keys, in which case that provider's terms with the customer govern the provider's processing.
No training on Customer Content. We do not use Customer Content, prompts, or AI outputs to train, retrain, or fine-tune any machine-learning model. Anthropic processes Customer Content under its Commercial Terms of Service, which provide that Anthropic may not train models on customer content submitted through its commercial services.
What is sent. Only the Customer Content needed to fulfil a given request is sent to a model provider, such as the relevant files, workflow definitions, and the customer's instructions. Customers control which repositories and tools AI Features may access.
Retention by the provider. Under Anthropic's published retention policy, inputs and outputs sent through the Anthropic API are automatically deleted from Anthropic's systems within 30 days, except that content flagged as violating Anthropic's Usage Policy may be retained for up to two years and related safety classification scores for up to seven years.
Logging. We record the prompts, tool calls, outputs, and actions taken by AI Features so that customers can audit what was done on their behalf and so that we can investigate errors and abuse. These records are Customer Content and are retained as described in Data Retention and Deletion.
Human review. Our personnel do not review Customer Content or AI interactions except to provide support at the customer's request, to investigate security incidents or abuse, or as required by law, and only under access controls described in Data Security.
Accuracy. AI-generated output may contain errors. The Services are designed so that AI-generated changes are reviewed and approved by the customer before they take effect; customers remain responsible for reviewing output before relying on it.

Disclosure of Your Information

We may disclose aggregated information about our users, and information that does not identify any individual, without restriction. We may disclose personal information that we collect or you provide as described in this privacy policy:

To our subsidiaries and affiliates.
To contractors, service providers, and other third parties we use to support our business and deliver the Services ("subprocessors"), including cloud hosting, model providers, product analytics, email delivery, and customer-support tools. Subprocessors are bound by written contracts that restrict their use of personal information and Customer Content to the services they provide to us. Our current subprocessors that process Customer Content, each located in the United States, are Amazon Web Services (hosting, storage, databases, and backups), Synadia Communications (messaging infrastructure), Cloudflare (DNS, content delivery, and network security), Vercel (web application hosting), Anthropic (AI model API), LangChain (AI orchestration and tracing), PostHog (product analytics), and Google (business productivity suite used for customer-support communications). The list is set out in Exhibit A to our DPA, and we give customers at least 30 days' written notice before adding or replacing a subprocessor.
To GitHub and other source-control or CI/CD platforms, when you or your organization instruct the Services to take actions on those platforms (for example, opening a pull request or updating a workflow file).
To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us about our Service users is among the assets transferred.
For any other purpose disclosed by us when you provide the information.
With your consent.
To comply with any court order, law, or legal process, including to respond to any government or regulatory request. Where permitted, we will notify the affected customer of any such request before disclosing Customer Content and will disclose only what is legally required.
To enforce or apply our General Software and Service Terms and other agreements, including for billing and collection purposes.
If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of CodeCargo, our customers, or others.

We do not sell personal information or Customer Content, and we do not disclose personal information to third parties for their own marketing purposes.

Choices About How We Use and Disclose Your Information

We strive to provide you with choices regarding the personal information you provide to us. We have created mechanisms to provide you with the following control over your information:

Tracking Technologies. You can set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. If you disable or refuse cookies, please note that some parts of the Services may then be inaccessible or not function properly.
Promotional Offers from the Company. If you do not wish to have your information used by the Company to promote our own products or services, you can opt-out by using the unsubscribe link in any marketing email or by sending us an email stating your request to the contact information provided in this policy below. This opt out does not apply to transactional or service communications, such as security notices, account notices, and notices about the Services.
AI Features. Customer administrators can enable or disable AI Features, choose the model provider, restrict which repositories and tools AI Features may access, and require approval before AI-generated changes take effect.
Global Privacy Control. Because we do not sell or share personal information, no opt-out preference signal is required; we honor Global Privacy Control signals as an opt-out of any such activity should it ever occur.

Payment Information

We do not collect, process, or store payment card numbers or bank account details through the Services. Customers purchase the Services under order forms and are billed by invoice. We use Intuit/Quickbooks as a third-party payment processor. Credit card or banking details are entered directly with Intuit and are subject to its privacy policy; we receive only confirmation of payment and the last four digits of the card. We retain billing records, such as invoices and payment confirmations, for as long as required by tax and accounting laws.

Data Retention and Deletion

We retain personal information and Customer Content only for as long as necessary for the purposes described in this policy, unless a longer period is required by law. In general:

Customer Content is retained for the term of the customer's subscription. Disposal begins within 90 days after the subscription ends, at which point the account and its associated data are removed, or returned first if the customer so directs in writing, except for copies we must keep under applicable law. On written request we provide a customer a copy of, or access to, the personal information we hold for it within 30 days.
Repository contents fetched to perform a job are processed in isolated, ephemeral environments and are not retained after the job completes, other than the results and audit records the customer has chosen to keep.
AI interaction and audit logs are Customer Content and are retained for the term of the subscription and disposed of on the same schedule.
Security and access logs are retained for one year.
Account and business-contact information is retained while the account is active and thereafter only as needed for our legal, contractual, and financial records.
Product analytics and Website usage information is retained for 24 months.
Customer invoices are retained for five years, and other billing, contract, and legal-compliance records for seven years or as required by applicable law.

You may request deletion of your personal information at any time using the contact information below. Customers can delete Customer Content through the Services or by contacting us.

Where We Store Your Information and International Transfers

The Services are hosted on Amazon Web Services in the United States (US East, Ohio region). Customer Content and personal information are stored and processed in the United States, and all of our subprocessors are located in the United States. For customers that require it, the Services can also be deployed on the customer's own infrastructure, in which case the customer controls where Customer Content is stored and who can access it.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, your personal information will be transferred to the United States. We rely on the European Commission's Standard Contractual Clauses (Module Two, controller to processor) and the UK International Data Transfer Addendum, each incorporated into our DPA, as the lawful mechanism for those transfers. For customers not established in the European Union, the Irish Data Protection Commission is the competent supervisory authority under those clauses. We process personal information on the following legal bases: performance of a contract with you or your organization; our legitimate interests in operating, securing, and improving the Services and communicating with business customers; compliance with legal obligations; and your consent where required.

Your Privacy Rights

Depending on where you are located, you may have the following rights regarding personal information for which we are the controller: to access the personal information we hold about you; to correct inaccurate information; to request deletion; to receive a copy in a portable format; to object to or restrict certain processing; to withdraw consent where processing is based on consent; and to lodge a complaint with a supervisory authority. To exercise these rights, contact us as described below. We will verify your identity before acting on a request and will respond within the time required by applicable law. We will not discriminate against you for exercising any of these rights.

Where personal information is contained in Customer Content, we will refer your request to the relevant customer and assist that customer in responding, in accordance with our DPA.

Residents of California and other U.S. states. If you are a resident of California, Colorado, Connecticut, Virginia, Texas, Oregon, or another state with a comprehensive privacy law, you have the rights described above with respect to your personal information, subject to the exceptions in those laws. In the preceding 12 months we have collected the categories of personal information described in Information We Collect About You and How We Collect It, for the purposes described in How We Use Your Information, and have disclosed them to the categories of recipients described in Disclosure of Your Information. We do not sell personal information, do not share it for cross-context behavioral advertising, do not use or disclose sensitive personal information for purposes requiring a right to limit, and do not engage in profiling that produces legal or similarly significant effects. You may designate an authorized agent to make a request on your behalf. If we deny your request, you may appeal by replying to our decision. California residents may also request information about disclosures for third-party direct marketing under California Civil Code Section 1798.83; we make no such disclosures.

Data Security

We have implemented administrative, technical, and physical measures designed to secure your personal information and Customer Content from accidental loss and from unauthorized access, use, alteration, and disclosure. These include encryption of data in transit (TLS 1.2 or higher) and at rest (AES-256); unique logins, multi-factor authentication, and role-based permissions; least-privilege and periodically reviewed access for our personnel; isolated and ephemeral execution environments for jobs that handle repository contents; encrypted storage of access tokens and credentials with encryption keys managed separately from the data; network firewalls, intrusion detection, and security monitoring; regular security testing and patching; secure development practices including automated scanning and code review; tested backup and recovery plans; mandatory privacy and security training and confidentiality agreements for all staff; and a documented incident response program. A fuller description is set out in Annex II of our DPA, and our compliance documentation is available to customers on request..

However, the safety and security of your information also depends on you. Where we have given you (or where you have chosen) a password for access to certain parts of our Services, you are responsible for keeping this password confidential. We ask you not to share your password with anyone. Customers are responsible for managing the access rights of their own users and for the security of the credentials and tokens they provide to the Services.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting personal information or Customer Content, we will notify affected customers without undue delay and in any event within the period required by applicable law and our agreement with the customer, and will provide information reasonably needed for the customer to meet its own notification obligations.

Changes to Our Privacy Policy

It is our policy to post any changes we make to our privacy policy on this page and to update the "Last modified" date above. If we make material changes to how we treat our users' personal information or Customer Content, we will notify you by email to the address associated with your account and to customer administrators at least 30 days before the changes take effect, in addition to a notice on the Website. You are responsible for ensuring we have an up-to-date active and deliverable email address for you, and for periodically visiting our Website and this privacy policy to check for any changes.

Contact Information

To ask questions, comment about this privacy policy and our privacy practices, to exercise your privacy rights, or to notify us that you would like your data deleted, please contact us at: privacy@codecargo.com or by mail at Boxbuild Inc., 4802 Enfield Road Bethesda, MD USA.

Document Center

Documents