Privacy policy

What we collect

Account data. Your email address, your name if you give one, and the members you invite. Sign-in events and API key use are kept in an audit log you can read.

Workspace content. The files you push — agents, flows, tools, knowledge — and everything your runs produce: run records, step conclusions, tool output, files written to storage. This is your data; we store it so the product works and show all of it to you.

Secrets. Values you store in the vault are encrypted with a key unique to your account, wrapped by a root key no data backup contains. They are handed to your tools as environment variables and are never in a prompt or a log.

Usage metering. Tokens, sandbox seconds, storage GB-months and network GB, per step, so your Usage page and your invoice are correct.

Site analytics. This website sets no cookies and runs no analytics scripts. Cloudflare, which serves it, keeps aggregate request logs.

What we do not do

• We do not use your workspace content or run records to train models.
• We do not sell or share personal data with advertisers.
• We do not read your workspaces except to operate the service or when you ask for support and say so.

Model providers

A step's prompt goes to the model provider your agent names — by default ours, or yours if you bring your own key. The provider's own policy governs what it does with the request. We choose providers that do not train on API traffic.

Where data lives

Workspace files and run artefacts are stored in object storage in the Asia-Pacific region; the database and the runtime are in Australia. Backups are encrypted before they leave the cluster.

Retention and deletion

Content stays as long as your account does. Deleting a workspace deletes its files, runs and storage; deleting an account deletes everything under it within thirty days, backups included on their rotation. Write to [email protected] to have it done sooner or to ask for an export.

Your rights

Under the Australian Privacy Act and, where it applies, the GDPR, you can ask what we hold about you, have it corrected, exported, or deleted. Email [email protected]; we answer within a week.

Changes

When this policy changes, the date above changes and account owners are told by email.