Privacy Policy

This Privacy Policy applies when you visit an Oqoqo website, create or use an Oqoqo account, run agent evals, use our CLI or MCP tools, contact us, or otherwise use a service that links to this policy (together, the “Service”). Oqoqo, Inc. is responsible for this policy.

This policy does not govern third-party websites or services, including model providers, repositories, or MCP servers that you choose to connect. Their privacy notices apply to their processing.

We use personal information for these purposes:

• Provide the Service. Create accounts, manage organizations, run experiments, execute agents, store results, provide CLI and MCP operations, and deliver support. We rely on our contract with you.
• Process your instructions. Send data to the agents, model providers, sandboxes, repositories, tools, and services you select. We rely on our contract with you and, for Customer Content, the customer's instructions.
• Bill and administer. Manage plans, run balances, purchases, invoices, and account communications. We rely on our contract and legal duties.
• Protect the Service. Authenticate users, prevent abuse, investigate security events, enforce limits, debug failures, and protect rights and safety. We rely on legitimate interests, our contract, and legal duties.
• Improve and understand use. Measure feature use and performance, find errors, and improve the Service. We rely on our legitimate interest in improving the Service.
• Communicate. Send service, security, billing, support, and legal notices. Send marketing only as allowed by law. We rely on our contract, legitimate interests, or consent, depending on the message.
• Meet legal duties. Keep required records, respond to lawful requests, resolve disputes, and enforce our agreements.

Where we rely on legitimate interests, we consider the purpose, need, and effect on people's rights. You can object as described below.

The Service sends the parts of Customer Content needed for a task to the agent, model provider, sandbox, repository, MCP server, CLI, SDK, API, or other tool you configured. This can include instructions, files, prompts, tool input and output, and short-lived credentials. Your organization controls these choices.

Oqoqo uses AI to run agents and to help create rubrics, judge results, analyze frictions, consolidate findings, and answer product questions. These features can create new content and inferences from the data you provide. Oqoqo does not use these results to make decisions with legal or similarly significant effects about a person.

We can use aggregate or de-identified operational data to operate, secure, measure, and improve the Service if it cannot reasonably identify you, your organization, or any person.

Do not include personal or sensitive data in tasks, files, prompts, or tools unless it is necessary, lawful, and approved by your organization. Use test data and least-privilege credentials where possible.

We disclose information only as needed for the purposes in this policy:

• Within your organization. Members and administrators can access information based on their role and project access.
• Infrastructure and operations. Vercel and Google Cloud host application, database, and artifact systems. Inngest coordinates workflows. Daytona provides isolated agent sandboxes.
• Identity and secrets. WorkOS provides sign-in, organization management, OAuth connections, and encrypted secret storage.
• Billing and communications. Stripe processes subscriptions and payments. Knock sends product and connection notifications.
• Analytics and diagnostics. PostHog processes product analytics and error data. RB2B processes public website visits to identify companies and eligible business visitors. Mintlify provides product-document search. Unkey helps enforce abuse limits.
• Website advertising. Google Tag Manager loads the LinkedIn Insight Tag and X Pixel on our public website when marketing tracking is enabled under the choices described below. LinkedIn and X process website visits to measure advertising and build audiences for future ads.
• Services you choose. Model providers, GitHub, remote MCP servers, agents, and other connected services receive data when you direct the Service to use them.
• Legal and safety reasons. We can disclose information to comply with law, protect rights or safety, investigate abuse, or enforce agreements.
• Business changes. We can disclose information in a financing, merger, acquisition, reorganization, or sale of assets, subject to suitable confidentiality protections.

Service providers can use data only to provide services to us or as law permits. The list can change as the Service changes. We do not sell Customer Content. Optional website visitor identification and advertising involve sharing information with RB2B and its partners, LinkedIn, and X as described below. You can decline that processing through Privacy choices.

We use cookies and similar browser storage for sign-in, security, preferences, and analytics. Some are necessary for the Service. For example, the dashboard uses a session cookie to keep you signed in, and the website stores your theme choice.

We use PostHog to understand page and feature use, performance, and errors. Depending on configuration, this can collect page URLs, interactions, device and browser details, session identifiers, performance measures, and error messages. We do not use this data for advertising.

When marketing tracking is enabled on our public website, we use RB2B to identify visiting companies and eligible business visitors. RB2B and its partners may use cookies and similar technologies to connect your visits with information they or others hold, including an email address. Where available, we receive company details and professional contact information. We or our service providers may use associated email addresses to send marketing messages about Oqoqo. Individual identification is limited to eligible visitors in the United States.

You can opt out of RB2B partner advertising through the Retention opt-out page. You can also use RB2B's GDPR opt-out page to opt out of personal data collection.

When marketing tracking is enabled, LinkedIn and X may receive page URLs, device and browser details, IP addresses, and cookie or similar identifiers. They may associate visits with information they hold about their members. We use these tags only on the public marketing website. We do not send form values or Customer Content as tracking event data. Read the LinkedIn Privacy Policy and X Privacy Policy.

For visitors in the United States, our public website provides notice and enables optional analytics and marketing unless you opt out or send a browser privacy signal. Outside the United States, optional tracking stays off until you allow it. We use our hosting provider's country information to apply these defaults. If the country is unknown or the lookup fails, we require permission first. Closing the notice does not record permission. Necessary cookies for sign-in, security, and preferences do not require opting in.

You can choose analytics and marketing independently. Analytics covers PostHog; marketing covers RB2B, LinkedIn, and X. Your explicit choices are stored in host-only cookies for up to a year. We respect saved opt-outs regardless of location. The US website footer also offers "Do not sell or share my personal information" to turn off marketing without changing analytics. Dashboard analytics uses a separate choice. Open Privacy choices in the website footer, then Manage, to choose analytics and marketing independently. Use the dashboard profile menu to change dashboard analytics. You can also block or delete cookies and local storage through your browser. Blocking necessary storage can stop sign-in or preferences from working.

We treat an enabled Do Not Track signal as a decision to decline optional browser analytics and website advertising. We also keep RB2B, Google Tag Manager, LinkedIn, and X off when your browser sends a Global Privacy Control signal. PostHog also keeps optional browser analytics off for Global Privacy Control. If you decline after these tags have loaded, we reload the page to stop their tracking code.

We keep personal information only as long as reasonably needed for the purposes in this policy. The exact period depends on the type of data, your organization's instructions, the length of the account or contract, security needs, backup cycles, disputes, and legal duties.

• Account and organization information is generally kept while the account is active and for a limited period afterward.
• Customer Content and durable run artifacts remain until the customer deletes them or the service relationship ends, subject to backups and legal holds.
• Agent sandboxes are destroyed after the run and its recovery window. Selected traces, outputs, and evidence are retained separately as Customer Content.
• Billing, transaction, security, audit, and dispute records can be kept longer where law or legitimate protection needs require it.

We can keep aggregated or de-identified information that cannot reasonably identify a person. When deletion is requested, some data can remain temporarily in backups or be kept where law permits.

We use administrative, technical, and organizational safeguards designed for the nature of the information we process. These include access controls, tenant-scoped database rules, encryption for secret values, isolated agent sandboxes, logging, and guarded deletion workflows.

No system is completely secure. Protect your account, use least-privilege credentials, limit personal data in runs, and tell us promptly at support@oqoqo.ai if you find a security issue.

Oqoqo is based in the United States, and the Service's primary hosted systems operate in the United States. We and our providers can process information in other countries. Those countries can have different data-protection laws from your country.

Where required, we use recognized safeguards for international transfers, such as adequacy decisions or standard contractual clauses. Contact us if you need more information about a transfer safeguard.

Depending on your location and applicable law, you can have the right to access, correct, delete, or receive a copy of personal information; restrict or object to processing; withdraw consent; and appeal a refusal. You can also have the right to complain to your local data protection authority.

• Update profile details through the dashboard where available.
• Delete your user account in Profile settings. This removes your user and memberships, but not content owned by an organization.
• Use project and resource controls to export or delete supported Customer Content. Ask an organization administrator for organization data.
• Change notification preferences in the Service or use an unsubscribe link in a marketing email.
• Use browser settings to control cookies and local storage.
• Open Privacy choices in the website footer or the dashboard profile menu to allow or decline optional analytics.

To make a privacy request, email support@oqoqo.ai. Describe your request and the account or organization involved. We can ask for information needed to verify your identity and authority. An authorized agent can submit a request where law allows. We will not discriminate against you for using a privacy right.

The Service is for businesses and people who are at least 18. We do not knowingly collect personal information from children. Contact us if you believe a child gave us personal information, and we will take appropriate steps to delete it.

We can update this policy as our Service or legal duties change. We review it at least once a year and will post the new date when it changes. If a change materially affects your privacy rights, we will give reasonable advance notice by email or in the Service when required.

Send privacy questions, requests, or complaints to support@oqoqo.ai.

You can also contact the organization that gave you access to Oqoqo if your request concerns personal information in that organization's Customer Content.