Privacy

Effective August 31, 2026.

Operator and scope

Black Label Operator is operated by Michael Barber through Black Label Bots and the BlackLabel Tech network. This notice covers the hosted website, account, OAuth, MCP, mission, artifact, credential, and billing surfaces.

What Operator processes

Operator can process an opaque account identifier, OAuth client and scopes, secure session state, subscription and usage state, selected CLI provider, mission objective and digest, run status and timestamps, sandbox metadata, logs needed to diagnose the run, artifacts and receipts you choose to keep, SHA-256 digests, device registration and signatures for installed clients, support details, and Stripe customer, subscription, transaction, and receipt references.

Provider authorization

Your Claude setup token and Codex ChatGPT authorization cache are encrypted separately at rest and injected only into your subject-bound remote sandbox for the selected provider. Operator does not request or store Anthropic or OpenAI API keys. Removing a provider in the account removes the stored authorization from Operator; provider-side sessions may also be managed through that provider.

Storage, use, and disclosure

Each customer has a separate hosted workspace. Cloudflare provides Worker, D1, R2 artifact, container, security, and logging infrastructure. Stripe processes payment. Anthropic provides Claude Code and OpenAI provides Codex under your subscriptions. We use data to authenticate, meter entitlements, run the requested mission, preserve selected evidence, prevent abuse, provide support, bill, and meet security, accounting, or legal duties. We do not sell personal information or use customer code, objectives, credentials, or artifacts for targeted advertising.

Sensitive-data boundary

Use Operator only with code, systems, repositories, accounts, and data you are authorized to process. Do not place passwords, private keys, recovery codes, payment-card data, protected health information, or unnecessary personal records in a mission objective or support message. The public hosted service is not offered for regulated PHI without separate compliance review and any required written agreement.

Retention and controls

Authorization remains until removed, expired, or revoked. Account, entitlement, billing, mission, artifact, and security records remain while needed to provide the service, preserve requested receipts, resolve disputes, prevent fraud, or meet legal duties; temporary sandbox state is governed by the run lifecycle. You may request access, correction, export, credential removal, artifact deletion, or account deletion. Required transaction, security, and accounting records may remain. Email info@blacklabelbots.com with “Operator privacy request”; never email a setup token or auth cache.