Privacy Policy

Robot Networks Inc. ("Robot Networks", "we", "us") operates Boardwalk, an OpenAI-compatible inference service for open-weight models. This Privacy Policy explains how we handle personal information across boardwalk.cloud, the console at app.boardwalk.cloud, the API at api.boardwalk.cloud, and related services (together, the "Service").

We act as controller for account, billing, website, and business-operations data we use for our own purposes. When an organization uses the Service to process personal data in prompts, outputs, or model artifacts on its instructions, that organization is the controller and we act as its processor under our Data Processing Addendum.

1. Information we collect

Account and organization information. Email address, display name, profile image, authentication identifier and security status, organization name and slug, memberships, roles, invitations, and settings. Clerk handles authentication; we do not receive or store your password. We record the legal version you accept and its acceptance time, separately from optional browser analytics choices.

Billing information. Purchase amount, currency, transaction status, Stripe customer and transaction identifiers, saved-payment-method summary, credit balance, ledger entries, refunds, disputes, and auto-top-up settings and results. Stripe receives payment-card details directly; we do not store full card numbers or card security codes.

Inference and metering information. Prompts and generated outputs pass through our systems and the GPU machines serving the model to complete a request. Our application does not create a prompt or completion history in its metering or receipt database. We do not use prompts or outputs to train models. Requests reach those machines directly, never through a job queue. Engine memory and caches on those machines may hold request content while serving; the GPU providers we rent the machines from operate them, and their retention is separate from our application database. We store the request identifier, organization and API-key identifiers, model and exact serving revision, token and cache counts, prices, cost, timing, status, finish reason, and whether the response streamed. Requests rejected before reaching a worker produce a limited refusal record containing the model name, status, reason, parameter name where relevant, and timing, but not the prompt.

Model deployment information. Hugging Face repository, revision, manifest and model metadata, deployment choices, rights attestation, deploy checks, serving configuration, and operational state. We copy a deployed model's files into Boardwalk-controlled storage, from which the GPU machines serving it load them. For private repositories, we process the connected user's OAuth credential to make that copy, so no GPU machine needs the credential. OAuth tokens are kept in a dedicated secret store rather than our application database.

Device, network, and operational information. IP address, user agent, request path, timestamps, request and resource identifiers, error information, rate-limit events, security signals, service health, and performance metrics. We do not intentionally put prompt or completion text in operational logs.

Communications. Messages you send to support, security, or legal addresses; contact-form submissions, including contract-withdrawal notices and timestamps; and transactional messages and delivery information for account, invitation, billing, and service notices.

Analytics and cookies. Page views, interactions, device and browser information, approximate location derived from IP address, and pseudonymous identifiers. For signed-in users, analytics may include our user identifier, display name, and organization identifier, name, and slug. We do not send inference prompts, outputs, API keys, payment-card details, or email addresses to PostHog. See our Cookie Policy.

Server-side product events. We also record selected service outcomes, such as organization creation, model qualification, repository connections, and payments, with internal user or organization identifiers, timestamps, status, and limited numerical or categorical metadata. These events help us operate and improve the Service and may be processed by PostHog independently of browser cookies. Cookie preferences control optional browser collection; they do not disable billing, security, or these server-side events. You may object to processing based on legitimate interests using the contact below.

2. Where information comes from

We collect information from you; organization owners and administrators; your applications and devices; Clerk, Stripe, and Hugging Face when you connect or use those services; the model repositories you ask us to inspect; and automatically from use of the Service. We may also receive information from people who report abuse, infringement, or security issues.

3. How we use information

• Provide, operate, maintain, and secure the Service.
• Authenticate users and administer accounts, organizations, roles, and API keys.
• Route inference requests and return model output.
• Discover, validate, ingest, qualify, deploy, update, and retire models.
• Meter usage, maintain auditable receipts, process payments, and reconcile our ledger.
• Provide support and send transactional, security, billing, and service notices.
• Detect and prevent fraud, abuse, security incidents, and policy violations.
• Understand product use, improve the Service, and plan capacity.
• Comply with law, resolve disputes, and enforce our agreements.

We do not sell personal information, share it for cross-context behavioral advertising, or use prompt or completion content to train general-purpose models. We do not use account data for automated decisions that produce legal or similarly significant effects about you.

4. Legal bases for processing

Where European data-protection law applies, we rely on:

• Contract: to provide the Service, administer your account, meter use, and process purchases you request.
• Legitimate interests: to secure and improve the Service, prevent abuse, communicate with customers, and operate our business, after balancing those interests against your rights.
• Consent: for optional browser analytics where consent is required and for other processing for which we specifically ask permission. You may withdraw consent at any time.
• Legal obligation: for tax, accounting, sanctions, valid legal process, and other obligations that apply to us.

5. How we disclose information

We disclose information only as needed in the following circumstances:

• Service providers. Infrastructure, GPU compute, database, identity, payments, frontend hosting, email, and analytics providers process information for us. Our current Subprocessor List identifies them and their roles.
• Customer-directed services. When you connect Hugging Face or ask us to retrieve a repository, information is exchanged with Hugging Face under your account and its terms. Public-model source and serving metadata is visible to users of the Service.
• Your organization. Organization owners, administrators, and members can see information according to their role, including members, models, usage, billing, and audit events.
• Legal and safety. We may disclose information to comply with law or valid legal process; protect rights, safety, and security; investigate abuse; or establish, exercise, or defend legal claims.
• Business transfers. We may disclose information in connection with a financing, merger, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality and continued protection.

6. International processing

The Service is operated primarily in the United States. If you use it from another country, information may be transferred to and processed in the United States and other locations where our providers operate. Where required, we use recognized transfer mechanisms such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and Swiss adaptations. Organization customers can review the details in our DPA.

7. Retention and deletion

We keep information only for as long as needed for the purposes above, subject to accounting, security, dispute, and legal requirements. In particular, gateway refusal records are kept for 30 days, organization audit events for approximately 13 months, and production operational logs for up to 90 days. Metering, receipt, ledger, payment, refund, and dispute records are retained as financial and audit records.

You can export your account profile and memberships or delete your account in the console. Account deletion disconnects your Hugging Face account and removes its OAuth credential, removes memberships, revokes keys you created, deletes your profile image, queues deletion of the Clerk identity with retries if the provider is unavailable, and replaces identifying fields in our database with tombstone values. Records needed for an organization's audit trail, billing, receipts, security, or legal obligations may retain your internal user identifier and historical event metadata. Removing profile fields does not make these records anonymous. An organization owner can delete an organization; doing so revokes its keys, retires its models, forfeits remaining credits subject to mandatory refunds, and retains the records needed for financial integrity and historical receipts. See ourData Retention Policy for the complete schedule.

8. Security

We use administrative, technical, and organizational safeguards designed for the nature of the information we process, including encrypted transport, managed encryption at rest, access controls, credential hashing or secret storage, tenant-scoped authorization, audit logging, monitoring, backups, and incident response. No service is perfectly secure. Please report vulnerabilities under our Security Disclosure Policy.

9. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, or receive a portable copy of personal information; object to or restrict processing; withdraw consent; opt out of certain disclosures or profiling; and appeal a denied request. You may also have the right to lodge a complaint with a local regulator. We will not discriminate against you for exercising a privacy right.

California residents may request to know, correct, or delete personal information and may opt out of sale or sharing. We do not sell personal information or share it for cross-context behavioral advertising, and therefore do not offer a separate "Do Not Sell or Share" link. We treat a Global Privacy Control signal as an optional browser analytics opt-out, including when a prior browser choice was acceptance. Residents of other U.S. states may have similar rights under applicable law.

Exercise a right by using the console's export and deletion controls or emailing legal@boardwalk.cloud. We may need to verify your identity and authority. An authorized agent may submit a request where applicable law permits. If we deny a request, you may appeal by replying with "Privacy Appeal" in the subject line.

10. U.S. state privacy disclosures

In the preceding 12 months, we collected the categories described in Section 1: identifiers and account data; commercial and billing information; internet or electronic activity; approximate location; professional or organization information; Customer Content; and inferences limited to service-security and product-use patterns. We collected them from the sources in Section 2, used them for the purposes in Section 3, and disclosed them to the recipient categories in Section 5. We did not sell or share these categories for cross-context behavioral advertising.

The Service may process sensitive personal information if you place it in a prompt or model artifact. We use such information only to provide and secure the Service, comply with law, and for other purposes permitted without a right to limit under applicable law. Do not submit specially regulated data, including protected health information subject to HIPAA, payment-card account data, government identification numbers, biometric identifiers, or children's personal data, unless a separate written agreement expressly supports it and all required safeguards are in place.

11. Children

The Service is intended for adults and is not directed to children. We do not knowingly permit anyone under 18 to hold a Boardwalk account. Customers must not submit children's personal data without the separate agreement and safeguards described above. If you believe a child's information has been submitted contrary to these rules, contact us and we will take appropriate steps to delete it.

12. Changes to this policy

We may update this policy as the Service and law change. We will post the revised version here and update the date above. If a change materially affects how we use information, we will provide additional notice by email, in-product notice, or another reasonable method. A downloadable version is linked from the console acceptance notice; other past versions are available on request.

13. Contact

For privacy questions or requests, email legal@boardwalk.cloud. You may also write to Robot Networks Inc., Attn: Privacy, c/o Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, United States.