MeltboxPrivacy Policy
Effective date: 2026-07-20 · Version 3
Overview
Autogenic Labs LLC operates Meltbox ("Meltbox," "we," "us," or "our"), a workspace for AI agents available at meltbox.ai. This Privacy Policy explains what information we collect, how we use and share it, and the choices you have. Your use of the service is governed by our Terms of Service.
Information We Collect
Information you provide. Your email address, name, and password (stored only as a salted hash); payment information you enter to start or manage a subscription (processed by Stripe and not stored by us); the names and configuration of workspaces, projects, apps, and resources you create; and the credentials ("secrets") you choose to store in the secret broker, which are encrypted at rest.
Information collected automatically. Your IP address, device and browser information, and a session identifier, collected to operate and secure the service. We keep an audit log of significant actions in your workspaces (such as resource reveals and token use) for security and accountability. The tools described under Analytics and Advertising Technology below also collect usage information such as the pages you visit and the actions you take on them.
Information from your use of the product. Your account and subscription status, the briefs, documents, and apps in your workspaces, and feedback (selections and notes) you record on briefs.
How We Use Your Information
- provide, operate, secure, and maintain the service;
- broker your stored credentials to the agents and apps you authorize, without exposing them except through the reveal mechanism you control;
- process payments and manage your subscription;
- respond to your questions and provide support;
- measure, understand, and improve how our website and product perform;
- measure and attribute the effectiveness of our advertising, as described under Advertising and Measurement below;
- detect, prevent, and address security incidents, fraud, and abuse; and
- comply with applicable laws and enforce our agreements.
Analytics and Advertising Technology
We use a small set of analytics and advertising tools on our website and product:
- PostHog (United States) provides first-party product and website analytics and error monitoring, including page views, click events, session replays of product usage, and IP address, so we can understand how visitors find and use the service.
- Google Analytics 4 provides web analytics and supports advertising measurement.
- Meta Pixel sends page-view events to Meta to support advertising measurement, retargeting, and the creation of similar ("lookalike") audiences, and sets cookies used to attribute sign-ups to ads.
- TikTok Pixel sends page-view events to TikTok to support advertising measurement, retargeting, and the creation of similar audiences, and sets cookies used to attribute sign-ups to ads.
We honor the Global Privacy Control (GPC) signal and the legacy Do Not Track (DNT) header automatically; when either is present, no advertising or analytics tools load. You can also opt out at any time at Your Privacy Choices.
Advertising and Measurement
We advertise the service on platforms including Meta and TikTok, and we measure which ads lead to sign-ups so that we can spend responsibly.
When you create an account, we send a hashed (SHA-256) version of your email address to Meta (via the Meta Conversions API) and to TikTok (via the TikTok Events API), together with your IP address and browser information, so those platforms can measure and attribute the sign-up to an ad you may have seen. We may do the same with Google (via Google Ads Enhanced Conversions) when you activate a paid subscription. We share only hashed identifiers for this purpose, never plaintext, and only first-party data that you provided to us. We do not send these events for browsers that have opted out at Your Privacy Choices or that send the Global Privacy Control signal.
We do not use the contents of your workspaces, briefs, or stored secrets for advertising.
How We Share Your Information
We do not sell your personal information for money. Our use of analytics and advertising tools that share data with Google, Meta, or TikTok may be considered "sharing" for cross-context behavioral advertising under California law. You can opt out at Your Privacy Choices or by sending the Global Privacy Control signal from your browser, which we honor automatically. We share information with the service providers (subprocessors) that help us operate the service, only as needed for their function:
| Provider | Purpose |
|---|---|
| Cloudflare | Application hosting, storage (D1/KV), and content delivery |
| Stripe | Payment processing and subscription management |
| PostHog | Product analytics and error monitoring |
| Web analytics (Google Analytics 4) and advertising measurement | |
| Meta | Advertising measurement and attribution (hashed data only) |
| TikTok | Advertising measurement and attribution (hashed data only) |
| Anthropic, OpenAI, Google | AI model providers, where you use agent features that call them |
| Amazon Web Services, exe.dev | Repository hosting and working environments, on eligible plans |
We may also disclose information when required by law, regulation, subpoena, or court order, or to protect the rights, property, or safety of Meltbox, our users, or the public.
Your Stored Secrets
Credentials you store in the secret broker are encrypted at rest and are used on your behalf to make requests to the integrations you configure. We do not access the plaintext of your secrets except as necessary to broker the requests you or your authorized agents initiate. You control which agents and apps may use or reveal each secret, and you can revoke that access at any time.
Your Privacy Rights
Depending on where you live, you may have rights to access, correct, delete, or port your personal information, and to opt out of certain processing, including the sale or sharing of personal information and targeted advertising. To exercise any of these rights, email support@meltbox.ai. We will respond within the timeframe required by applicable law and will not discriminate against you for exercising your rights. You may opt out of advertising-related sharing at any time through Your Privacy Choices, including by sending the Global Privacy Control signal from your browser.
Data Retention
We retain personal information for as long as your account is active and as needed to provide the service, and afterward only as required to comply with legal obligations, resolve disputes, and enforce our agreements. You may delete workspaces and the objects within them, and request deletion of your account.
Data Security
We use reasonable administrative, technical, and physical safeguards designed to protect personal information, including encryption of stored secrets and scoped, revocable access tokens. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Children's Privacy
The service is intended for adults and is not directed to anyone under 18. We do not knowingly collect personal information from anyone under 18.
Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. Your continued use of the service after changes are posted constitutes acceptance of the revised policy.
Contact
Questions about this Privacy Policy: support@meltbox.ai.