Privacy Policy

This Privacy Policy applies when you visit an Oqoqo website, create or use an Oqoqo account, run agent evals, use our CLI or MCP tools, contact us, or otherwise use a service that links to this policy (together, the “Service”). Oqoqo, Inc. is responsible for this policy.

This policy does not govern third-party websites or services, including model providers, repositories, or MCP servers that you choose to connect. Their privacy notices apply to their processing.

We use personal information for these purposes:

• Provide the Service. Create accounts, manage organizations, run experiments, execute agents, store results, provide CLI and MCP operations, and deliver support. We rely on our contract with you.
• Process your instructions. Send data to the agents, model providers, sandboxes, repositories, tools, and services you select. We rely on our contract with you and, for Customer Content, the customer's instructions.
• Bill and administer. Manage plans, run balances, purchases, invoices, and account communications. We rely on our contract and legal duties.
• Protect the Service. Authenticate users, prevent abuse, investigate security events, enforce limits, debug failures, and protect rights and safety. We rely on legitimate interests, our contract, and legal duties.
• Improve and understand use. Measure feature use and performance, find errors, and improve the Service. We rely on our legitimate interest in improving the Service.
• Communicate. Send service, security, billing, support, and legal notices. Send marketing only as allowed by law. We rely on our contract, legitimate interests, or consent, depending on the message.
• Meet legal duties. Keep required records, respond to lawful requests, resolve disputes, and enforce our agreements.

Where we rely on legitimate interests, we consider the purpose, need, and effect on people's rights. You can object as described below.

The Service sends the parts of Customer Content needed for a task to the agent, model provider, sandbox, repository, MCP server, CLI, SDK, API, or other tool you configured. This can include instructions, files, prompts, tool input and output, and short-lived credentials. Your organization controls these choices.

Oqoqo uses AI to run agents and to help create rubrics, judge results, analyze frictions, consolidate findings, and answer product questions. These features can create new content and inferences from the data you provide. Oqoqo does not use these results to make decisions with legal or similarly significant effects about a person.

We can use aggregate or de-identified operational data to operate, secure, measure, and improve the Service if it cannot reasonably identify you, your organization, or any person.

Do not include personal or sensitive data in tasks, files, prompts, or tools unless it is necessary, lawful, and approved by your organization. Use test data and least-privilege credentials where possible.

We disclose information only as needed for the purposes in this policy:

• Within your organization. Members and administrators can access information based on their role and project access.
• Infrastructure and operations. Vercel and Google Cloud host application, database, and artifact systems. Inngest coordinates workflows. Daytona provides isolated agent sandboxes.
• Identity and secrets. WorkOS provides sign-in, organization management, OAuth connections, and encrypted secret storage.
• Billing and communications. Stripe processes subscriptions and payments. Knock sends product and connection notifications.
• Analytics and diagnostics. PostHog processes product analytics and error data. Arize Phoenix processes selected agent traces. Mintlify provides product-document search. Unkey helps enforce abuse limits.
• Services you choose. Model providers, GitHub, remote MCP servers, agents, and other connected services receive data when you direct the Service to use them.
• Legal and safety reasons. We can disclose information to comply with law, protect rights or safety, investigate abuse, or enforce agreements.
• Business changes. We can disclose information in a financing, merger, acquisition, reorganization, or sale of assets, subject to suitable confidentiality protections.

Service providers can use data only to provide services to us or as law permits. The list can change as the Service changes. We do not sell Customer Content or personal information. We do not share personal information for cross-context behavioral advertising, and we do not use targeted advertising.

We use cookies and similar browser storage for sign-in, security, preferences, and analytics. Some are necessary for the Service. For example, the dashboard uses a session cookie to keep you signed in, and the website stores your theme choice.

We use PostHog to understand page and feature use, performance, and errors. Depending on configuration, this can collect page URLs, interactions, device and browser details, session identifiers, performance measures, and error messages. We do not use this data for advertising.

Optional browser analytics are off until you allow them. Your choice applies across Oqoqo browser surfaces when your browser permits it. Open Privacy choices in the website footer, or in the dashboard profile menu, to allow or decline analytics. You can also block or delete cookies and local storage through your browser. Blocking necessary storage can stop sign-in or preferences from working.

We treat an enabled Do Not Track signal as a decision to decline optional browser analytics. Because we do not sell personal information or share it for cross-context behavioral advertising, a Global Privacy Control signal does not change those practices.

We keep personal information only as long as reasonably needed for the purposes in this policy. The exact period depends on the type of data, your organization's instructions, the length of the account or contract, security needs, backup cycles, disputes, and legal duties.

• Account and organization information is generally kept while the account is active and for a limited period afterward.
• Customer Content and durable run artifacts remain until the customer deletes them or the service relationship ends, subject to backups and legal holds.
• Agent sandboxes are destroyed after the run and its recovery window. Selected traces, outputs, and evidence are retained separately as Customer Content.
• Billing, transaction, security, audit, and dispute records can be kept longer where law or legitimate protection needs require it.

We can keep aggregated or de-identified information that cannot reasonably identify a person. When deletion is requested, some data can remain temporarily in backups or be kept where law permits.

We use administrative, technical, and organizational safeguards designed for the nature of the information we process. These include access controls, tenant-scoped database rules, encryption for secret values, isolated agent sandboxes, logging, and guarded deletion workflows.

No system is completely secure. Protect your account, use least-privilege credentials, limit personal data in runs, and tell us promptly at support@oqoqo.ai if you find a security issue.

Oqoqo is based in the United States, and the Service's primary hosted systems operate in the United States. We and our providers can process information in other countries. Those countries can have different data-protection laws from your country.

Where required, we use recognized safeguards for international transfers, such as adequacy decisions or standard contractual clauses. Contact us if you need more information about a transfer safeguard.

Depending on your location and applicable law, you can have the right to access, correct, delete, or receive a copy of personal information; restrict or object to processing; withdraw consent; and appeal a refusal. You can also have the right to complain to your local data protection authority.

• Update profile details through the dashboard where available.
• Delete your user account in Profile settings. This removes your user and memberships, but not content owned by an organization.
• Use project and resource controls to export or delete supported Customer Content. Ask an organization administrator for organization data.
• Change notification preferences in the Service or use an unsubscribe link in a marketing email.
• Use browser settings to control cookies and local storage.
• Open Privacy choices in the website footer or the dashboard profile menu to allow or decline optional analytics.

To make a privacy request, email support@oqoqo.ai. Describe your request and the account or organization involved. We can ask for information needed to verify your identity and authority. An authorized agent can submit a request where law allows. We will not discriminate against you for using a privacy right.

We have not sold personal information or shared it for cross-context behavioral advertising in the previous 12 months. Therefore, no sale or targeted-advertising opt-out is needed for our current practices.

The Service is for businesses and people who are at least 18. We do not knowingly collect personal information from children. Contact us if you believe a child gave us personal information, and we will take appropriate steps to delete it.

We can update this policy as our Service or legal duties change. We review it at least once a year and will post the new date when it changes. If a change materially affects your privacy rights, we will give reasonable advance notice by email or in the Service when required.

Send privacy questions, requests, or complaints to support@oqoqo.ai.

You can also contact the organization that gave you access to Oqoqo if your request concerns personal information in that organization's Customer Content.