Provider: KXCOMM s.r.o., Kojetínská 3368 76701 Kroměříž, Czech Republic (Reg. No. 46900837). Contact: info@wbx.cz
Account data (name, email, team), billing details needed for invoices, and usage records (sandbox start and end times, resources). If you sign in with Google or GitHub, we receive your account ID, name and verified email address from them and store only the account ID and email to recognise you; we never get your password there.
We do not inspect the contents of your sandboxes. A sandbox's disk and memory are deleted when the sandbox ends. For background jobs and batches we keep the inputs you submit, the job's output log and the result files you asked to save, so that you can read them after the job ends; they are deleted 7 days after the job finishes. Environment variables of jobs are stored encrypted.
When you connect ChatGPT, Claude or another assistant to WBX Sandbox (MCP), we receive only what the assistant sends to our tools: the commands, code and files it asks us to run or store, and the identifiers of your sandboxes and jobs. We do not receive your conversation, your assistant's memory or chat history, and we do not use the data we receive to build profiles or to train models. Each connection appears in the portal under API keys, where you can disconnect it at any time.
We use your data to provide the service (running your sandboxes and jobs), to bill you and issue invoices, to answer support requests, and to keep the platform secure (preventing abuse and attacks). We do not sell your data.
Only the providers we need to run the service: payment providers (Stripe, GoPay) for payments, Google or GitHub if you choose to sign in with them, and the e-mail service we use to send account e-mails. We share data with authorities only where the law requires it.
We count page views on this website and in the portal with our own measurement – no cookies, no third-party scripts. For each page view we store the page address, the referring website, campaign tags from the link (for example utm_source), the device type, browser, operating system, browser language, your IP address and the country it belongs to (looked up in a local copy of the DB-IP database – your IP address is not sent anywhere). Visitors are counted with a short fingerprint of the IP address and browser that changes every day. We use this to understand where our visitors come from and to detect abuse (legitimate interest). IP addresses are deleted after 90 days, the remaining page view records after 400 days. When you sign up, the first source of your visit (for example the website you came from) is stored with your team.
All data is processed on our own servers located in the EU. Payment card data is handled only by our payment providers (Stripe, GoPay).
Account data while your account exists, invoices for the period required by tax law, usage logs for up to 24 months.
You can request access, correction or deletion of your personal data by emailing us. You may also lodge a complaint with the Czech Office for Personal Data Protection (ÚOOÚ).
Last updated November 10, 2026.