Legal
Privacy, terms, and who touches your data.
Summaries of the privacy policy and terms of service that govern the hosted service at oloproof.com, and of the providers in the path of your data. Where a summary and a document differ, the document is what applies.
Last updated 5 October 2026 · applies to the hosted service
Privacy
What we hold. Your email address, name, workspaces, memberships and role, API keys only as digests, and whatever test cases, outputs, traces and labels your organisation chooses to send. The command-line tool and the local workbench send us nothing.
Why. To provide the service you signed up for, run the evaluations your organisation asks for, and keep the service secure. Nothing is sold, there is no advertising, and no model is trained on it.
Retention. Workspace content is kept until the workspace is deleted: there is no time limit yet, and owners will be told before one is set. Server logs are kept about 14 days, email records 90 days, and backups 30 days.
Your rights. Ask to see, correct, delete or receive a copy of your information by writing to [email protected], and we answer within 30 days. You can delete your account yourself, from Account.
If something goes wrong. If a breach puts you at real risk of significant harm, we tell you and the authorities as the law requires.
Terms of service
Your data stays yours. You own your content. We may host, copy, process and display it only as needed to provide the service, keep it secure and meet our legal obligations.
An invited alpha. Features change, some will break, and the service may be unavailable without notice. There is no availability commitment and no guaranteed support response.
Results are evidence, not guarantees. A decision is a statistical statement about the cases you evaluated. It does not certify that a system is safe or fit for a purpose, and the release decision is yours.
Acceptable use. No breaking the law, no content you have no right to share, no attacking the service or working around its limits, and no reaching another workspace without permission.
Ending it. Delete your account at any time, after exporting your evidence. We give workspace owners at least 30 days' notice before ending the alpha, unless the law requires us to stop sooner, and account holders 30 days' notice of a change to the terms that matters.
Who handles data for us
The AI model providers your organisation's own API keys reach are on no list of ours: your organisation chooses them, holds the contract and pays them.
| Provider | Purpose | Region |
|---|---|---|
| Akamai (Linode) | Hosting the service, its database and nightly backups | Canada (Toronto) for the service; United States (Chicago) for backups |
| Cloudflare | DNS, encryption and protection in front of the site; forwarding email sent to our addresses | Its global network |
| Resend | Account email, invitations and the notifications you choose, never the content of your cases | United States |
| Polar | Merchant of record: checkout, subscriptions, invoices and tax; card details stay with Polar and its payment processor | United States |
| GitHub, Google, Microsoft | Signing you in, only if you choose them | Per each provider |
This list is section 6 of the privacy policy. A change to the policy that matters is emailed to account holders before it takes effect.
Status and questions
- Public status pageNot yet
- Privacy policyRead
- Terms of serviceRead
- Data requests and security reports[email protected]