Privacy Policy

1. Who we are

This policy explains how Terrabox.ai Pty Ltd (ACN 699 975 981) (Terrabox) handles personal information, in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. It covers our website, the GPU console and API, and how we deal with customers, prospective customers and their people.

It does not cover the contents of customers' environments — the data, models and code customers run on Terrabox (Customer Data). Our customers control that data; we host it for them and do not access it except as our Terms of Service allow.

2. What we collect

When you create and use an account

• Your name, work email address, company, and the date you accepted our Terms.
• Your password — stored only as a salted scrypt hash, never in readable form.
• If you turn on two-factor sign-in, the authenticator secret, and hashes of your recovery codes.
• API keys you create — stored only as hashes — with when and from which IP address each was last used.
• SSH public keys and the names and emails of the people you authorise to access your environment.
• Sign-in and security events: times, IP addresses and browser user-agent.

When you pay

• Invoices, amounts and payment status. If you pay by card, Stripe collects your card details directly; we receive only the card brand, last four digits and expiry, and Stripe's reference numbers.

When you use the Services

• Operational metadata about your environment — GPU utilisation and memory use, GPU-hours, bookings, the container images you start — used to run, bill and secure the Services.

When you contact us or visit the website

• What you send us by email or the contact form, and standard web server logs (IP address, pages requested, time).

3. Cookies

The console uses a single cookie that keeps you signed in. It is essential, expires after 12 hours, and can't be read by scripts on the page. We don't use advertising or third-party tracking cookies in the console.

4. How we use it

• To create and secure your account, sign you in and keep it safe (including sending you security notices).
• To provide, meter and bill the Services, and to take payment.
• To provide support and tell you about maintenance and changes.
• To prevent fraud and abuse and enforce our Acceptable Use Policy.
• To meet legal, tax and regulatory obligations.
• With your consent, to send you news about Terrabox — you can opt out at any time.

We don't sell personal information, and we don't use Customer Data to train models.

5. Who we share it with

• Stripe — card payment processing.
• Our email provider — to send you verification, sign-in, security and billing emails.
• Equinix — our data centre provider in Sydney, for the people we register to access the facility. Equinix does not have access to Customer Data on our equipment.
• Our professional advisers — lawyers, accountants and auditors, under confidentiality.
• Law enforcement and regulators — where the law requires or permits it.
• A buyer of our business — if Terrabox is sold, under confidentiality.

6. Overseas disclosure

Customer Data stays in Sydney. Some account and billing information is handled by providers that operate outside Australia: Stripe (United States and other locations) processes card payments, and our email provider may process email outside Australia. We take reasonable steps to ensure these providers handle personal information consistently with the Australian Privacy Principles.

7. How we protect it

• Account data is held on Terrabox-controlled systems in Sydney.
• Passwords are hashed with scrypt; API keys, recovery codes and session tokens are stored only as hashes; two-factor sign-in is required for the console.
• Emails that contain one-time links are removed from our systems once sent.
• Access to administrative systems is restricted to Terrabox staff on our management network.

No system is perfectly secure. If a data breach is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

8. How long we keep it

• Account details: while your account is open, then up to 2 years.
• Invoices and payment records: 7 years, as Australian tax law requires.
• Security and sign-in logs: up to 2 years.
• Unconfirmed sign-ups are deleted after a few days.

9. Access, correction and complaints

You can ask for access to, or correction of, the personal information we hold about you by emailing privacy@terrabox.ai. We'll respond within 30 days. You can update most account details yourself in the console.

If you have a complaint about how we've handled your personal information, email us first and we'll respond within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

10. Changes to this policy

We'll post changes here and, for material changes, email account holders before they take effect.