This Privacy Policy explains how SLIDINGBOX LLC ("Slidingbox," "we," or "us") handles information when you use Slidingbox.ai and its API endpoints.
1. Data-minimizing design
Slidingbox is designed to receive data encrypted by the client. Encryption happens on the client. We do not receive your plaintext or encryption keys and cannot decrypt the ciphertext submitted to the Service. The Service does not require user accounts.
2. Scope
The Service is a machine-to-machine developer utility offered to businesses and the automated systems they operate. It is not directed to consumers or to anyone under 18, and we do not knowingly collect personal information from children. For the limited personal information described below, SLIDINGBOX LLC is the controller. Where you submit encrypted data belonging to your own users, you are the controller and we act as your processor; see section 12.
3. Information we process
- Ciphertext, initialization vectors, and item pointers: used to provide temporary storage and one-time retrieval. They are deleted when retrieved or when their time-to-live expires. We cannot read them.
- Connection and security data: IP addresses may be processed transiently for rate limiting, abuse prevention, and Service security. An IP address is personal data in some jurisdictions.
- Operational logs: may include a request ID, route, response status, duration, error code, and a short truncated pointer prefix. We do not log ciphertext, initialization vectors, encryption keys, or payment signatures.
- Free-tier data: an API-key identifier and its remaining lifetime quota are retained to authenticate the key and enforce its usage allowance.
- Payment data: payment verification and settlement metadata, including a verified payer wallet identifier, needed to complete and rate-limit a paid request, and to screen for sanctions and fraud. A public wallet address is treated as a pseudonymous identifier and may be personal data. We do not collect card or bank-account credentials. Our payment providers and the public Base network may process or display USDC transaction data independently of Slidingbox; transactions written to a public blockchain are permanent and outside our control, and we cannot edit or erase them.
- Communications: if you email us, we receive the address and content you provide so we can respond.
4. How we use information and our legal bases
We use the limited information above to provide requested API operations, secure and maintain the Service, prevent abuse, settle payments, respond to support requests, and comply with legal obligations. We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use it for automated decision-making that produces legal or similarly significant effects.
Where the EU or UK GDPR applies, we rely on: performance of a contract, to deliver the API operation you requested and to settle payment for it; our legitimate interests, to secure the Service, enforce rate limits, prevent abuse and fraud, and respond to support requests; and compliance with a legal obligation, to meet record-keeping, sanctions-screening, and lawful-request duties.
5. Service providers and subprocessors
We use a small number of infrastructure and payment providers, listed with their roles and locations on our Subprocessors page. These providers process information under their own terms and privacy notices. We do not authorize them to use it for their own purposes beyond providing their service to us.
6. International transfers
We operate from the United States, and our providers process data in the United States and at globally distributed edge locations. Where we transfer personal data out of the European Economic Area, the United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum where applicable, or another lawful transfer mechanism. Data written to a public blockchain is replicated globally by design and cannot be confined to a region.
7. Retention
Encrypted items are retained only until one-time retrieval or expiry. Ordinary rate-limit IP state is retained for approximately one minute, while abuse-prevention state may remain for approximately five minutes. Free-tier quota records remain for the life of the key or until operational deletion. Operational and security logs are retained for up to 30 days. Payment and sanctions-screening records are retained for up to five years to meet financial record-keeping and anti-money-laundering expectations. Support correspondence is retained for up to 24 months.
8. Cookies and tracking
The Slidingbox application does not set advertising trackers or analytics cookies. Infrastructure providers may process standard connection data under their own terms. If the application begins using cookies or tracking technologies, this policy will be updated and any consent required by law will be obtained first.
9. Your rights
Depending on where you live, you may have rights to request access to, correction of, deletion of, restriction of, or portability of your personal information, and to object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time without affecting prior processing.
Send privacy requests to support@slidingbox.ai. We aim to respond within 30 days and will tell you if we need longer. We do not charge a fee for a first request, and we do not discriminate against anyone for exercising these rights. Because we do not hold encryption keys and do not maintain user accounts, we may be unable to identify or recover a particular encrypted item, and we may be unable to verify a request without information you alone can supply. If you are in the EEA, UK, or Switzerland, you may also lodge a complaint with your local data protection supervisory authority.
10. U.S. state privacy rights
If you are a resident of California, Colorado, Connecticut, Virginia, or another state with a comprehensive privacy law, you have the rights described in section 9, and you may use an authorized agent to submit a request. In the 12 months before the effective date above, the categories of personal information we collected were identifiers, limited to IP addresses, API-key identifiers, public wallet addresses, and email addresses you send us, and internet or network activity, limited to the operational log fields listed in section 3. We collected them from you or from your requests, used them for the purposes in section 4, and disclosed them for business purposes only to the providers listed on our Subprocessors page. We did not sell personal information or share it for cross-context behavioral advertising, and we do not knowingly do so for anyone under 16.
11. Security and breach notification
Our security posture is described on our Security page. If we become aware of a personal data breach affecting information we hold, we will notify affected controllers and, where required, individuals and regulators, without undue delay and within the timeframes applicable law requires.
12. Business customers and data processing
Where you use the Service to relay data about your own users, you are the controller and we are your processor for the ciphertext you submit. Because that content is encrypted before it reaches us, our processing is limited to storing and returning opaque bytes. Our Data Processing Agreement, which incorporates the Standard Contractual Clauses and the UK Addendum, applies automatically to that processing; a countersigned copy is available on request from support@slidingbox.ai.
13. Changes and contact
We may update this policy by posting a revised version with a new effective date. Contact us at support@slidingbox.ai or by mail at our business mailing address: 30 N Gould St Ste R, Sheridan, WY 82801.