Hackthebox
- The documents do not say whether your data trains AI.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared with partners and affiliates; you can opt out.
- The documents do not say who can read your content.
They keep account and usage data for years, use ads cookies.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Name, ID, job and social profiles, payments, IP, cookies, chats, and sometimes audio, video, or biometric data.
Read the exact line
Privacy policy
“Audio or video data, textual data (chat transcripts, emails) or metadata (call duration, timestamps), biometric data collected during interactions through our communication platforms.”
Training
They use your data to run the service, market, tailor offers, and show ads, including with targeting cookies.
Read the exact line
Privacy policy
“Targeting cookies, such as social media cookies, may be set through our website by our advertising service providers, third-party advertisers, ad networks, or data exchange partners.”
Sharing
Staff, affiliates, resellers, your employer, processors, investors, and authorities may get your data.
Read the exact line
Privacy policy
“The natural or legal person paying for the Services (e.g. your Employer) or organising the Services you participate (e.g., CTF event Organiser)”
Kept
Service data can be kept five years after a contract ends; billing data up to ten years.
Read the exact line
Privacy policy
“Where providing Services, we retain the relevant data for a period of five (5) years upon contract termination.”
Controls
You can email privacy@hackthebox.com for access, deletion, or to stop marketing, and use cookie settings.
Read the exact line
Privacy policy
“You may exercise the above rights directly by contacting the privacy Contact at: privacy@hackthebox.com.”
Fine print
Business subscriptions auto-renew, fees are mostly non-refundable.
Read the exact line
Terms of service
“THE PARTIES HERETO EXPRESSLY WAIVE THE RIGHT TO TRIAL BY JURY AND ANY RIGHT TO PARTICIPATE IN PROCEEDINGS.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Ask to access or delete your data
Email privacy@hackthebox.com
Opt out of marketing emails
Contact privacy@hackthebox.com or use the commercial opt-out they describe
Change cookie choices
Cookie Settings link in the site footer / cookie banner
Give 30 days’ written notice to stop auto-renewal
Notice under the business Terms of Service, Section 8.1
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
They can keep your service-related personal data for five years after the contract ends.
Read the exact line
Privacy policy
“Where providing Services, we retain the relevant data for a period of five (5) years upon contract termination.”
For example, if you cancel today, they may still hold your account and usage records until five years later.
If you are on the business terms, you cannot sue in court with a jury or join a .
Read the exact line
Terms of service
“THE PARTIES HERETO EXPRESSLY WAIVE THE RIGHT TO TRIAL BY JURY AND ANY RIGHT TO PARTICIPATE IN PROCEEDINGS.”
For example, if many companies were overcharged, you could not join them in one lawsuit.
Paid subscription fees are generally not given back.
Read the exact line
Terms of service
“Subscriber shall pay each invoice within thirty (30) days of the date of the invoice, without any deduction or set-off.”
For example, if you stop using the labs mid-year, you still pay for the rest of the term.
Third-party ad companies can place cookies to track you for ads on other sites.
Read the exact line
Privacy policy
“Targeting cookies, such as social media cookies, may be set through our website by our advertising service providers, third-party advertisers, ad networks, or data exchange partners.”
For example, visiting the site could later show you Hack The Box ads on social media.
Calls and chats with them may include audio, video, transcripts, and biometric data.
Read the exact line
Privacy policy
“Audio or video data, textual data (chat transcripts, emails) or metadata (call duration, timestamps), biometric data collected during interactions through our communication platforms.”
For example, a Zoom support call could be stored as video plus related biometric data.
If you break the IP rules, you may have to pay their legal bills.
Read the exact line
Terms of service
“Subscriber agrees to HackTheBox from and against any and all claims, damages, obligations, losses, liabilities, costs, debts, and expenses (including but not limited to attorney’s fees) suffered or incurred by HackTheBox arising out of or related to any breach by the Subscriber of this Section 5.2.”
For example, if an employee copies lab content into a competing product, your company could owe their lawyer fees.
Forum posts are public; anyone can copy what you write there.
Read the exact line
Privacy policy
“Any information you include in a comment on our forum may be read, collected, and used by anyone.”
For example, a write-up with your username could be copied off the forum by strangers.
Under the business terms, you keep ownership of data you upload.
Read the exact line
Terms of service
“Subscriber owns all right, title, and interest in all Subscriber Data.”
For example, files you upload for training stay yours, not Hack The Box’s property.
They say they follow well-known security and privacy management standards.
Read the exact line
Privacy policy
“We are certified with and apply ISO 9001, 27001 and 27701 standards.”
For example, they claim independent ISO 27001 certification for how they protect data.
The service is for adults unless a parent fills out their consent form.
Read the exact line
Privacy policy
“HackTheBox does not allow use of the Services by anyone younger than 18 years old, unless a written parental or legal guardian consent is provided through our relevant consent form.”
For example, a 16-year-old should not sign up unless a parent uses the official consent form.
Words to know
Legal words from the lines above, in plain English.
- biometric
- Measurements of your body that identify you, like your face, fingerprint or voice. For example, a selfie used to unlock the app or a voice recording matched to you.
- cookies
- Small files a website saves on your device so it can recognise you and remember what you did. For example, a cookie keeps you logged in and can also tell an ad company which sites you visited.
- service providers
- Outside companies that handle your data on the app's instructions, such as a cloud host or an email sender. For example, the company that stores the app's files in the cloud sees your data but only does what the app tells it.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
- retention
- How long a company keeps your data before deleting it. For example, a policy might keep your messages for 30 days after you delete them, or for as long as it likes.
- class action waiver
- You agree not to join with other users in one lawsuit; each person must complain alone. For example, if a bug overcharges a million people, you cannot all sue together for a refund.
- indemnify
- You promise to pay the company's legal costs and losses if your use of the service gets it sued. For example, if you post a song you do not own and the label sues the app, you owe the app's lawyer bills.
- consent
- Your clear agreement to something, given by an action like ticking a box or tapping Accept. For example, a pop-up asking if the app may use your location is asking for consent.
How we got here · grade D · score 40/100 · 15 of 15 policy answers backed by a verified quote · 3 not stated
What does the app collect beyond what it needs to work?
They collect more than login and content, including ID documents, job and social profiles, payments, IP, cookies, third-party leads, and sometimes audio, video, or biometric data.
Does it record your voice, face or body, and what happens to that?
They say they collect audio, video, chat transcripts, and biometric data from communication platforms, and keep personal data under long retention rules.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
Not stated in the documents.
Are you profiled or tracked for advertising?
They use targeting cookies from advertising partners, ad networks, and data exchange partners, with a cookie banner and industry opt-outs.
Do they sell or share your data, and can you opt out?
They share data with affiliates, resellers, employers, processors, and investors. You can opt out of marketing communications.
What rights do they take over what you type and what the AI makes?
Business terms say you own Subscriber Data and they only get a limited license to provide the service.
How long do they keep your data after you delete it, and can you delete it in the app?
They keep service data five years after contract end and billing data ten years. Deletion is by contacting them, not a simple in-app wipe.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
Not stated in the documents.
Do they commit to basic security, and have they leaked data?
They say they apply ISO 9001, 27001 and 27701 and point to a technical security measures document.
Is there a real age gate, and are teens protected?
They say users must be 18 unless a parent uses their consent form. They do not describe age-checking technology.
Will they tell you when the rules change, and is the policy specific?
The privacy notice is dated and lists data types, purposes, and retention. They say they will give notice of changes; continued use then means you accept.
Can they close your account without warning, and can you get your data out first?
They may suspend with prior notice where practicable. After termination you must export your own data; they have no duty to keep it.
If something goes wrong, who pays?
Services are as-is, liability is capped at fees paid in 12 months, and you must indemnify them for certain IP breaches.
Do subscriptions renew on their own, and can you get a refund?
Business subscriptions auto-renew for 12 months unless you give 30 days’ written notice. Fees are non-refundable except in limited cases.
The privacy policy is 4,999 words at a college graduate level (Flesch reading ease 39.9); the terms are 6,278 words at a college level.
