DeployerBox

DeployerBox is a service of NM Technology Inc. ("NM Technology", "we", "us"). This policy explains what personal information we collect when you visit deployerbox.com or use the DeployerBox platform, why we collect it, who we share it with and the choices you have.

In short:

We collect what we need to run your account, build your projects and deploy them where you tell us to.
You bring your own AI provider keys and your own cloud accounts. We use them only for the work you start.
We do not sell personal information, we do not show advertising, and we do not use Google user data to train AI models.

1. Who we areLink to this section

NM Technology Inc. operates DeployerBox at https://www.deployerbox.com and is the controller of the personal information described in this policy.

You can reach us about anything in this policy at support@deployerbox.com.

2. Information we collectLink to this section

Information you give usLink to this section

Account details. Your name, email address and password when you sign up. The password is stored only as a salted hash, never in readable form. You may also add a company name and billing address.
Payment details. Payments are handled by Stripe. We keep the Stripe customer and subscription identifiers, your plan and its status. We never receive or store full card numbers. The card brand and last four digits shown on your Billing page are read from Stripe when the page is opened.
Your content. The projects you create, the messages you exchange with the assistant, plans, files and images you upload or generate, the code written for your project, and the settings and secrets you save for a project.
AI provider keys. The API keys you add for the AI model providers you want to use.
Connected accounts. The access you grant to services such as GitHub or a cloud provider. See section 4.
Messages to us. Support tickets and what you send through the contact form.

Information collected automaticallyLink to this section

Cookies and browser storage. A small number of cookies keep you signed in and keep the service secure. See the Cookie Policy.
Operational records. A record of the work done for you: the tasks that ran, the AI model used, the number of tokens, the cost and any errors. We use these to show you your costs and to keep the service working.
Server logs. Like most websites, our servers record the IP address, time and page of each request, for security and troubleshooting.
Affiliate referrals. If you arrive through an affiliate link, we record the referral code, a one-way hash of your IP address (not the address itself), your browser type and the page you landed on, so that the right affiliate is credited and any discount is applied.

We do not use advertising trackers or third party analytics on DeployerBox.

3. How we use informationLink to this section

We use personal information to:

create and secure your account and sign you in;
build, test and deploy your projects, using the AI keys and connected accounts you provided;
take payment for subscriptions and send invoices;
answer support requests and send service messages, such as email verification and notices about your trial or subscription;
protect the service against abuse, fraud and security incidents;
understand where the platform fails and improve it (see section 7);
meet our legal obligations.

Where European or United Kingdom data protection law applies, we rely on these legal bases: performing our contract with you (running the service you signed up for), our legitimate interests (security, preventing abuse and improving the service), your consent (where we ask for it, for example when you connect an account), and compliance with the law.

4. Connected accounts and OAuthLink to this section

DeployerBox can create a code repository for your project and deploy your project to your own cloud account. To do that, you connect the account yourself.

For most services this uses OAuth: you are sent to the provider's own sign in page, the provider shows you exactly what DeployerBox is asking for, and you approve or refuse. We never see or store your password for that provider. Some services are connected with an access token or key that you create and paste in.

Service	How you connect	Access requested	What we use it for
GitHub	OAuth	Your profile, your repositories, and permission to delete a repository (`read:user`, `repo`, `delete_repo`)	Create the project's repository, push the code written for it, and delete the repository if you ask us to
Google Cloud and Firebase Hosting	Google OAuth, or a service account key you upload	`openid`, `email` and `https://www.googleapis.com/auth/cloud-platform`	See section 5
Microsoft Azure	OAuth	Sign in, your email and profile, and Azure Service Management on your behalf	Deploy your project to the Azure subscription you choose
Railway	OAuth	Sign in, your email and profile, and management of your workspace	Deploy your project to your Railway workspace
Supabase	OAuth	Management of the organisations you approve on Supabase's consent screen	Create and manage the database or project your deployment uses
Neon	An API key you create and paste	Management of the Neon account or organisation the key belongs to	Create the database project your deployment uses, and delete it when the deployment is removed
Netlify	OAuth	Management of your Netlify sites	Deploy your project to Netlify
Vercel	Access token you paste	What the token allows	Deploy your project to Vercel
Amazon Web Services	An IAM role, or access keys you provide	What the role or keys allow	Deploy your project to your AWS account
Render	API key you paste	What the key allows	Deploy your project to Render

For each connected account we store:

the access token, and a refresh token where the provider issues one, encrypted with AES-256-GCM;
a label for the account, such as your username or email address at that provider;
the list of workspaces, projects or subscriptions that provider reports for the account, so that you can choose where to deploy;
which of those you chose.

We use a connected account only to carry out actions you start in DeployerBox, and to check the state of your connection and deployments so that we can show it to you.

You can disconnect an account at any time in Settings > Connections. This deletes the stored tokens and account details from our systems. You can also withdraw the permission at the provider itself.

5. Google user dataLink to this section

This section describes how DeployerBox accesses, uses, stores and shares information received from Google APIs.

What we accessLink to this section

When you choose to connect Google Cloud, Google asks you to grant DeployerBox these permissions:

openid and email: the email address of the Google account you connected, so that we can show you which account is connected.
https://www.googleapis.com/auth/cloud-platform: to see and manage resources in your Google Cloud projects, so that DeployerBox can deploy your project there.

We do not request access to Gmail, Google Drive, Calendar, Contacts, Photos or any other Google service. Google access is used only for the Google Cloud connection. It is not used to sign you in to DeployerBox.

How we use itLink to this section

We use Google user data only to provide the deployment features you ask for in DeployerBox:

list your Google Cloud projects so that you can pick the one to deploy to;
switch on the Google Cloud services that the deployment needs in that project;
create, update and remove the resources for the deployment option you chose, for example Firebase Hosting, Cloud Run, Compute Engine, Cloud SQL, Cloud Storage, Artifact Registry, Cloud Build, Secret Manager, Cloud DNS, certificates, and the service accounts the deployed app runs as;
read deployment status and logs so that we can show you progress and errors;
remove those resources when you ask us to decommission a deployment.

We create and change resources only in the project you selected.

What we storeLink to this section

the email address of the connected Google account;
the identifiers, names and state of the Google Cloud projects that account can see, and which one you chose;
the OAuth access token and refresh token, or the service account key if you chose to upload one instead;
a record of the resources we created for you, such as their names, regions and addresses, so that we can update or remove them later.

How we protect itLink to this section

Tokens and keys are encrypted at rest with AES-256-GCM. They are decrypted only on our servers, in memory, at the moment a call to Google is made. They are never sent to your browser and are never shown again after they are saved. All traffic between you, DeployerBox and Google is encrypted in transit. Access to our systems is limited to the people who need it to operate the service.

We do not sell Google user data.
We do not use Google user data for advertising.
We do not send Google user data to AI model providers.
We do not transfer Google user data to anyone else, except to the infrastructure provider that hosts our systems (Amazon Web Services) under its confidentiality and security obligations, where the law requires us to disclose it, or as part of a merger or acquisition, in which case we will tell you first.
Our staff do not read Google user data unless you ask us for help and agree to it, it is needed to investigate a security incident or abuse, or the law requires it.

Limited UseLink to this section

DeployerBox's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not use Google user data to develop, improve or train generalised artificial intelligence or machine learning models.

Keeping and deleting itLink to this section

We keep Google user data for as long as your Google Cloud connection exists.

Disconnect in DeployerBox. Go to Settings > Connections and disconnect Google Cloud. The stored tokens, account email and project list are deleted from our systems.
Revoke at Google. You can remove DeployerBox's access at any time from your Google Account at myaccount.google.com/permissions.
Delete everything. Email support@deployerbox.com to have your DeployerBox account and the data in it deleted.

Disconnecting or revoking access does not remove resources that already exist in your Google Cloud project. Decommission the deployment in DeployerBox first, or delete the resources in the Google Cloud console. The record of resources we created is kept until the deployment is removed or your account is deleted, so that removal stays possible.

6. AI model providersLink to this section

DeployerBox does its work by calling AI models with your own API keys. To do the work you ask for, we send the relevant parts of your project to the provider whose model is used: your request, the conversation, the files and code the task needs, and any images involved.

The providers currently supported are OpenAI, Anthropic, Google (Gemini), DeepSeek, Mistral and xAI. Each call is made under your own account with that provider, and that provider's terms and privacy policy apply to what it receives. You decide which providers to add.

Your keys are encrypted at rest with AES-256-GCM, are shown only in masked form after you save them, and can be deleted by you at any time in Settings.

7. How we improve DeployerBoxLink to this section

To find recurring problems and fix them, we may review conversations between you and the assistant, and we keep a short record of a project when it is finished or deleted: what was asked for, the plan, which steps passed or failed, and what they cost. This record contains no source code and no credentials, and it is not linked to your name or email address.

Parts of a conversation may be analysed with the help of an AI model from Anthropic, OpenAI or Google, under our own account with that provider. What we keep from this analysis are short general lessons, each a problem and its fix, which are added to the platform's built in instructions so that later projects avoid the same mistake.

Connection tokens, API keys and passwords are never part of this. We do not train AI models on your content.

We share personal information only with:

Service providers that run DeployerBox for us: Amazon Web Services (hosting, file storage and email delivery) and Stripe (payments).
The AI model providers you choose, as described in section 6, and the providers named in section 7.
The services you connect, such as GitHub and your cloud provider, when we act there on your instruction.
Affiliates, who can see the first name and last initial of a customer they referred and the plan that customer is on, but never the email address or any content.
Authorities or other parties where the law requires it, or where it is needed to protect the rights, safety or property of our users or of NM Technology.
A successor, if NM Technology is involved in a merger, acquisition or sale of assets. We will tell you before your information becomes subject to a different privacy policy.

We do not sell personal information and we do not share it for advertising.

9. Where information is storedLink to this section

DeployerBox runs on Amazon Web Services in the European Union (Ireland). NM Technology Inc. and the providers named in this policy may process information in the United States and other countries. Where the law requires it, these transfers rely on appropriate safeguards, such as the standard contractual clauses our providers offer.

Your code lives in your own GitHub repository, and your deployed application runs in your own cloud account, in the region you choose.

10. How long we keep informationLink to this section

Account information: for as long as your account is open. When you ask us to delete your account, we delete or anonymise your personal information within 30 days, except what we must keep by law, such as invoices.
Projects: until you delete them. Deleting a project removes its workspace, its database, its preview and its conversations from our systems. The repository in your GitHub account and the resources in your cloud account are removed only if you choose that when deleting.
Trial accounts: if a free trial ends without a subscription, the projects created during the trial are deleted five days later. We email you before that happens.
Connected accounts and AI keys: until you disconnect or delete them, or your account is deleted.
Project records and lessons described in section 7: these may be kept after a project is deleted. They are not linked to your name or email address.
Billing and affiliate records: for as long as tax, accounting and anti-fraud rules require.

Copies held in routine backups are removed as those backups expire.

11. SecurityLink to this section

We protect information with measures that include:

AES-256-GCM encryption at rest for connection tokens, cloud credentials and AI provider keys;
passwords stored only as salted hashes;
encryption in transit for all traffic;
a separate, isolated workspace for each project;
access to production systems limited to the people who need it.

No system is perfectly secure. If we learn of a breach that affects your personal information, we will tell you and the relevant authorities as the law requires.

12. Your choices and rightsLink to this section

In DeployerBox you can, at any time:

view and correct your account details in Settings;
disconnect any connected account and delete any AI provider key;
delete a project and choose whether its repository and cloud resources are removed with it;
cancel your subscription.

Depending on where you live, you may also have the right to:

get a copy of the personal information we hold about you;
have it corrected or deleted;
restrict or object to how we use it, including its use to improve the service;
receive it in a portable format;
withdraw a consent you gave;
complain to your data protection authority.

If you live in California, you have the right to know what personal information we collect, to have it deleted or corrected, and not to be treated differently for using these rights. We do not sell or share personal information as those terms are defined in California law.

To use any of these rights, email support@deployerbox.com from the address on your account. We answer within 30 days.

See also our Terms of Service and Cookie Policy.

Privacy Policy