BerryBoxWho handles your data
Strawberry Labs LLC, based in Sharjah, United Arab Emirates, operates BerryBox CI. Contact admin@strawberrylabs.net for privacy questions or requests. For account administration, payments and security, we determine how the necessary personal data is used. For repository content processed on a customer’s behalf, the customer controls what is submitted.
What we collect
When you sign in with GitHub, we receive account identifiers, your name, login, avatar and available email information. We store team membership, roles, invitations, authorized GitHub installations and repository access. If another enabled sign-in provider is used, we receive the account information needed to authenticate you.
CI records include repository and workflow names, branches, commit and job identifiers, actors, timestamps, outcomes, runner settings, usage and charges. Your job processes the code, dependencies and secrets your workflow supplies. Log queries retrieve available output from GitHub. Support messages and security or audit events can include personal data. Infrastructure providers may process IP addresses, request metadata and diagnostics needed to operate the service.
Stripe processes payment details. We keep Stripe customer, payment and subscription references, payment status and our credit ledger. Card entry happens in Stripe’s hosted pages; BerryBox does not store your full card number.
Why we use it
We use this information to authenticate accounts, manage teams, run authorized jobs, show results, calculate usage, process payments, provide support, prevent abuse and maintain security. Depending on the information and applicable law, processing is necessary to provide the service you request, meet legal obligations, protect legitimate operational interests or act on your consent. We do not sell personal data or use repository content for advertising.
Providers and processing locations
The launch service uses Amazon Web Services for the backend, runner machines, email through SES and encrypted backups; Cloudflare for the website, dashboard, docs and protected API routing; GitHub for sign-in, repository integration, workflow coordination, logs and Actions cache; and Stripe for payments. These providers receive information needed for their role and apply their own service and privacy terms.
Data may be processed outside the UAE. The initial runner configuration uses the United States, and other enabled AWS regions may be used for capacity. Cloudflare, GitHub, Stripe and their infrastructure can process data internationally. BerryBox does not offer a guarantee that all data stays in one country. We also disclose information when necessary to meet a legal obligation, protect the service or respond to a valid request from an authority.
Storage, retention and security
Each job has a separate disposable runner machine and root disk, which are terminated after the job; cleanup may take time during a provider outage. We retain account and operational records while needed to provide the service, handle support or disputes, secure the platform and meet legal recordkeeping duties. Payment and audit records may need to remain after an account closes. GitHub logs, artifacts and Actions cache follow GitHub’s retention settings.
Access controls, scoped credentials, encryption of stored integration credentials and encrypted database backups help protect data. No system can guarantee absolute security. Backup copies expire through the configured backup rotation rather than being edited immediately after an individual deletion request. Do not put secrets in log output or send them in support email.
Cookies and local tools
The dashboard uses essential session and sign-in cookies, including HttpOnly cookies for authentication. Disabling them prevents sign-in. Local CLI login stores a credential file on your machine; logout removes that local copy, while revoking a key disables its use. Your chosen AI agent may receive CI results and log excerpts returned through MCP. Review the agent provider’s own data settings before granting access.
Your choices and rights
You can revoke agent keys, disconnect GitHub access, cancel subscription renewal and control team access from the dashboard, subject to your team role. To request access, correction, export or deletion of personal data, or to raise an objection or withdraw consent where relevant, email admin@strawberrylabs.net. We verify your identity and review requests under applicable law. Some records must be retained for legal, payment, security or dispute purposes; we will explain relevant limits.
If you use BerryBox through an employer or another team, that team also controls access to its job and membership records. Contact its administrator about data it submits. You may raise privacy concerns with the competent data-protection authority where applicable.
Policy updates
We update this page when our practices change and communicate material changes through the service or your account contact. The date above identifies this version. Questions can be sent to admin@strawberrylabs.net.