Privacy Policy

Last updated: June 21, 2026

Robot Networks Inc. ("Robot Networks", "we", "us") operates the Boardwalk platform, a control plane for building and running agent workflows. This Privacy Policy explains what personal information we collect, why we collect it, who we share it with, and the rights you have. It applies to boardwalk.sh, the Boardwalk web app and APIs, the @boardwalk-labs/workflow SDK, and the boardwalkCLI (together, the "Service").

For most personal data we process about you as an account holder, we are the controller. When an organization customer uses the Service to process personal data inside its workflows, run inputs, or artifacts, that customer is the controller and we act as a processor under our Data Processing Addendum.

1. Information we collect

Account information you provide. Email address, display name, organization name and role, and authentication identifiers. Sign-in and identity are handled by Clerk; we do not store passwords. If you pay for a plan, we also collect billing contact and tax information; your payment-card details are handled by Stripe and never touch our servers.

Customer Content. The workflow programs you deploy, run inputs and outputs, run logs and events, artifacts, agent transcripts (the prompts and completions exchanged with language models during a run), workspace contents, and the secrets you store. We hold this on your behalf to operate the Service. Secrets are encrypted and are never exposed to language models (see Section 6a).

Operational logs. Request logs, error traces, audit events, run telemetry, and performance metrics used for debugging, security, billing, and reliability. These may include IP address, user agent, account and organization identifiers, request paths, and timestamps.

Cookies and similar storage. See our Cookie Policy. We use privacy-friendly product analytics (PostHog), set only with consent where consent is required, and no advertising trackers.

2. How we use your information

We use the information we collect to:

• Provide, maintain, secure, and improve the Service.
• Authenticate you and manage your account and organization.
• Execute the workflow runs you trigger and route their model calls.
• Meter usage and process payments, and send invoices and tax documents.
• Send transactional and service notifications (run notifications you opt into, security alerts, billing notices, important product changes).
• Respond to support requests and other communications you initiate.
• Detect, investigate, and prevent abuse, fraud, and security incidents.
• Comply with law and enforce our agreements.

We do not use Customer Content to train general-purpose foundation models, and we do not sell personal information. Managed-inference requests are routed to third-party model providers as described below; their handling of those requests is governed by the applicable provider terms and contracts.

3. Legal bases (EU/EEA/UK/Switzerland)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Performance of a contract: to deliver the Service you signed up for.
• Legitimate interests: to keep the Service secure, prevent abuse, and improve features (we balance this against your rights).
• Consent: where consent is required, for any purpose that depends on it. You can withdraw consent at any time.
• Legal obligation: to comply with tax, accounting, and law-enforcement requirements.

4. Subprocessors and other recipients

We do not sell your personal information.We don't share it for cross-context behavioral advertising, and we don't run advertising trackers on Boardwalk. We honor the Global Privacy Control (GPC) browser signal as a legally binding opt-out request under applicable U.S. state privacy laws.

We share information with the categories of recipients below only as needed to operate the Service, process payments, secure the platform, comply with law, or follow your configuration. Where a recipient processes Customer Personal Data for us, we require a written agreement with appropriate confidentiality, security, and data-protection terms.

• Amazon Web Services (United States): primary infrastructure, including compute (Fargate, Lambda), object storage (S3), content delivery (CloudFront), email delivery (SES), queues and scheduling (SQS, EventBridge), and secret storage and encryption (Secrets Manager, KMS). Receives the data needed to run the Service.
• PlanetScale (United States): managed Postgres database holding control-plane records (organizations, members, workflows, run metadata, usage events).
• Clerk (United States): authentication and identity. Receives your email, name, and authentication metadata.
• Stripe (United States): payment processing and subscription billing. Receives billing contact, payment-card details (handled directly by Stripe), and amounts charged.
• Vercel (United States): hosts the boardwalk.sh and app.boardwalk.sh frontends. Receives request logs and IP address.
• OpenRouter (United States): routes prompts, tool inputs and outputs, and completions for agent() calls that use our managed inference lane, and may route those requests to the model provider selected for the call. Not engaged when your workflow uses a model provider you bring yourself. Secret values are redacted before any model call (Section 6a).
• Tavily (United States): web-search provider for the web_search tool. Receives the search queries your workflow's agent issues, only when a workflow uses web search.
• PostHog (United States): product analytics for the marketing site and web app. Receives online identifiers, account and organization identifiers for signed-in users when configured, IP address, approximate location derived from IP address, browser and device metadata, and page-interaction and product-usage events. We do not enable session recordings, and analytics never captures run inputs, prompts, or outputs.

A current list is maintained at /legal/subprocessors and incorporated into our Data Processing Addendum. We give at least 30 days' notice before we add or replace a subprocessor that processes Customer Content on behalf of organization customers, and customers can object as described in the DPA.

When your workflow connects a model provider you bring yourself (a bring-your-own-key provider), traffic for those calls goes directly from the run to the endpoint you configured; that provider acts under its own terms and is not a Boardwalk subprocessor.

Managed-inference model availability can change as providers and routing options change. If your organization requires a fixed approved list of model providers or sub-processors, you should use bring-your-own-key providers or an Order Form that identifies the approved managed-inference providers for your account.

We may also disclose information when required by law, valid legal process, or to protect the safety, rights, or property of Robot Networks, our users, or others, or in connection with a merger, acquisition, or sale of assets (subject to confidentiality).

5. Where your data is stored

The Service is hosted on AWS in the United States, with our database on PlanetScale in the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S. and other countries where we or our subprocessors operate. For transfers from the EU, EEA, UK, or Switzerland to the U.S., we rely on the Standard Contractual Clauses (with the UK Addendum and Swiss amendments where applicable). A copy is available on request from privacy@boardwalk.sh.

6. Data retention

We keep your account profile, organization configuration, and workflows for as long as your account is active. Run history and artifacts are retained for limited windows (runs for 90 days by default, configurable per organization; artifacts for the lifetime set when they are created) and are then deleted automatically; where deletion controls are available, you can also delete them earlier yourself. You can delete your account or organization from your account settings, or contact us at privacy@boardwalk.sh; we then permanently delete your account and Customer Content from primary production systems within 30 days. Specific retention windows for logs, artifacts, and backups are described in our Data Retention Policy.

6a. How Boardwalk handles run data

Because Boardwalk runs your code and calls language models on your behalf, a few data-handling properties are worth calling out:

• Secrets never reach the model. Secrets live only in your deterministic workflow code. The agent() hook redacts known secret values from everything sent to a language model, including the prompt, tool arguments and results, and the transcript. Because secrets are never placed in model context, prompt injection cannot cause a model to reveal them.
• Runners hold no platform credentials. A run receives a short-lived, run-scoped token and reaches secrets, artifacts, and inference through a brokered control API. The broad platform credentials are never present on the machine executing your workflow.
• Inference is routed, not served. We do not operate model GPUs or store model weights. Managed-inference traffic is routed to a third-party provider; traffic for providers you bring yourself goes directly to your configured endpoint.
• Hosted runs are network-constrained. On our hosted infrastructure, workers run in locked-down network segments and reach the internet only through a controlled egress path. Self-hosted runs use your own network and are governed by your own controls.
• No training on your content. We do not use your Customer Content to train Boardwalk-owned or general-purpose foundation models. For managed inference, prompts, tool data, and completions are sent to third-party routing and model providers only to process the requested model call, subject to the applicable provider terms and any enterprise agreement or Order Form you have with us.

7. Cookies

We use cookies and browser storage for:

• Authentication and session management: required for the Service to function (set by Clerk and our hosting provider).
• Theme and interface preferences: required for a usable experience.
• Product analytics (PostHog): optional, set only with your consent where consent is required, and cookieless until you opt in.

We do not set advertising or fingerprinting cookies. Full detail, including how to change your analytics choice, is in our Cookie Policy.

8. Security

We use encryption in transit (TLS) and at rest. Secrets are stored in AWS Secrets Manager under per-organization KMS encryption and are brokered to runs without ever being exposed to language models. Production access is restricted to authorized personnel, gated by multi-factor authentication, and audit-logged. Authentication is handled by Clerk; we do not store passwords. We operate a vulnerability-disclosure program; see our Security Disclosure Policy. No system is perfectly secure; if we ever suffer a breach affecting your information, we will notify you and the appropriate authorities as required by law.

9. Children

The Service is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has given us personal information, contact privacy@boardwalk.sh and we will delete it.

10. Your rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal information; to object to certain processing; or to withdraw consent.

EU/EEA/UK/Switzerland (GDPR / UK GDPR / FADP). You have rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with your local supervisory authority. The legal bases we rely on are listed in Section 3.

California (CCPA/CPRA).You have rights to know, delete, correct, and to opt out of sale or sharing. As stated in Section 4, we don't sell personal information and we don't share it for cross-context behavioral advertising. You also have the right not to be discriminated against for exercising your rights.

Other U.S. states. Residents of states with comprehensive privacy laws (including Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and others) have similar rights of access, correction, deletion, portability, and opt-out.

To exercise these rights, email privacy@boardwalk.sh. We will respond within the timelines required by applicable law. We may need to verify your identity before acting on a request. You can also designate an authorized agent to make a request on your behalf.

11. Additional U.S. state privacy disclosures

The disclosures below summarize our personal-information practices for U.S. state privacy laws, including California. We do not sell personal information or share it for cross-context behavioral advertising, and we do not knowingly sell or share personal information of people under 16.

• Identifiers and account data. Collected from you, your organization, and authentication providers. Used for account administration, authentication, support, billing, security, and legal compliance. Disclosed to service providers such as Clerk, Stripe, AWS, PlanetScale, Vercel, and PostHog as needed.
• Commercial and billing information. Collected from you and Stripe. Used for subscriptions, invoicing, tax, accounting, and fraud prevention. Disclosed to Stripe and infrastructure providers as needed.
• Internet or network activity. Collected automatically when you use the Service. Includes IP address, user agent, request metadata, audit events, run telemetry, and product-usage events. Used for security, debugging, reliability, analytics, abuse prevention, and product improvement. Disclosed to infrastructure, security, analytics, and support providers as needed.
• Customer Content. Collected from you and your workflows. Includes workflow programs, inputs, outputs, logs, artifacts, transcripts, workspace contents, and secrets. Used to operate, secure, troubleshoot, and improve the Service for you. Disclosed to infrastructure providers and, when configured by you, inference, search, and integration providers needed to run your workflows.
• Sensitive personal information. We may process account credentials, secrets, precise operational data you submit, or other sensitive information if you or your workflows provide it. We use sensitive personal information only to provide the Service, secure accounts and data, prevent fraud and abuse, comply with law, or as otherwise permitted by applicable law. We do not use it to infer characteristics about you.
• Retention. Retention periods are described in Section 6 and in our Data Retention Policy. We retain each category for as long as reasonably necessary for the purposes described there, unless a longer period is required for legal, tax, accounting, security, or dispute-resolution reasons.
• Automated decision-making. Boardwalk provides tools that customers use to build and run workflows. We do not use automated decision-making about account holders that produces legal or similarly significant effects, unless disclosed in a separate product or order-specific notice.

12. Changes to this policy

We may update this Privacy Policy from time to time. For material changes, we will notify users by email or in-product notice and update the "Last updated" date above. Past versions are available on request.

13. Contact

For privacy questions or to exercise your rights, contact us at privacy@boardwalk.sh. You can also write to Robot Networks Inc., Attn: Privacy, c/o Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, United States.