Privacy Policy — MCR Box

This policy covers mcrbox.com, beta.mcrbox.com, accounts, Self-Hosted licensing, and Hosted Cloud. It replaces the old iOS-only notice that said we collected no personal data. The Terms of Service describe the products themselves.

1. Who we are

MCR Box operates the Services described in the Terms. Questions: privacy@mcrbox.com or support@mcrbox.com.

2. Information we collect

2.1 You give us

Account details: name, work email, organization, password (handled by our licensing identity provider — we do not store your raw password on the site).
Billing details you submit to Stripe (card and tax fields). We receive tokens, customer IDs, and invoice state, not full card numbers.
License and cloud choices: keys you generate, instance names, regions, types, storage, IP holds, security-group rules, spend limits, and support messages.
Contact and newsletter forms.

2.2 We collect automatically

Session cookies and similar tokens needed to keep you signed in and to enforce CSRF protection.
Server logs (IP address, user agent, URL, approximate time) for security and debugging.
Download events (artifact and platform) via our existing download tracker so we know which builds are used.
Hosted Cloud telemetry we need to bill and operate: instance state, hours, sampled outbound volume, health of our control plane. This is not a recording of your program output.

2.3 Others send us

Stripe: payment success, failures, tax IDs you entered.
Google, if you use SSO: the email and profile fields Google releases to the app you authorize.
Licensing API: license status, seat counts, admin flags, trial windows.

3. How we use information

We use it to:

create and secure accounts, sessions, and team access;
issue and enforce licenses and Hosted Cloud;
bill, collect tax where required, and prevent fraud;
send transactional mail (trial, instance ready, spend alerts);
respond to support and legal requests;
measure downloads and keep the site reliable;
improve the Services in aggregate.

We do not sell personal information. We do not use your live video as an advertising product.

4. Customer video and Hosted Cloud

Self-Hosted: your signals stay on your machines unless you send them to us. Hosted Cloud: video, audio, and graphics you process live on the instance. We do not ingest those streams into the marketing site. Operators may see instance metadata and, during an incident you escalate, enough of the guest to debug. You decide destinations (CDNs, social platforms); those parties have their own policies.

5. Processors and transfers

We use infrastructure and vendors in the United States and other regions we list for Hosted Cloud (for example AWS), Stripe for payments, email delivery, and the licensing system. Data may be processed in those locations. Community AMIs and download files are stored on object storage we name on the downloads page.

6. Cookies

Essential cookies run the session. We do not run a separate advertising pixel on the marketing pages. You can block cookies in the browser; the account portal will not stay signed in without them.

7. Retention

Account and billing records are kept while the account is open and for a limited period afterward as needed for invoices, tax, and dispute. Hosted Cloud disks are deleted when you terminate the instance; operational snapshots, if any, expire on a short cycle. Usage rows used for billing may be retained longer. You can ask support@mcrbox.com to close an account and delete data we are not required to keep.

8. Sharing

We share personal information only:

with processors who must follow our instructions;
if you use SSO or a destination platform, with that provider;
if required by law, court order, or to prevent serious harm;
in a merger or sale of the business, under continuity of this policy or notice to you.

9. Security

We use HTTPS, origin authentication, hashed session cookies, and least-privilege cloud roles. No method is perfectly secure. You must protect license keys and instance credentials.

10. Children

The Services are not directed at children under 13. If we learn we have collected personal information from a child under 13, we will delete it.

11. Your choices

You can update profile and billing data in the account, revoke keys, and delete instances. Depending on where you live (including the EEA, UK, and certain U.S. states), you may have rights to access, correct, delete, or export personal information, or to object to certain processing. Email privacy@mcrbox.com. We may need to verify the request. You may complain to a supervisory authority.

12. Changes

We will post changes on this page and update the date above. Material changes may also be emailed to the account address.

13. Contact

Privacy: privacy@mcrbox.com. Legal: legal@mcrbox.com.