Privacy
Policy.

2.1 Information You Provide

• Account Information: Name, email address, company details, and professional information
• Authentication Information: Passwords, API keys, and access credentials
• Payment Information: Credit card details or other payment method information (processed securely through our payment processor)
• Service Data: Content, prompts, and responses submitted for AI governance
• Communication Data: Information you provide when contacting us for support or other inquiries

2.2 Information Collected Automatically

• Usage Data: API calls, feature usage, interaction patterns, and performance metrics
• Technical Data: IP addresses, browser type, device information, and operating system
• Log Data: Error reports, access times, and system activity logs
• Cookie Data: As described in our Cookie Policy

Service Provision

• Providing and maintaining our AI governance services
• Processing your transactions and managing your account
• Authenticating access to our services

Service Improvement

• Analysing usage patterns to enhance our services
• Debugging and fixing technical issues
• Developing new features and services

Communication

• Sending service updates and notifications
• Responding to your enquiries and support requests
• Providing information about new features or services

Security and Compliance

• Detecting and preventing fraud or abuse
• Protecting our services and users
• Complying with legal obligations

11.1 What the app sends to us

• Your messages and the replies, so they can be checked against your organization's policy, passed to the AI model, shown in your history and kept in an audit record for your organization
• Text of files you attach to a message and, if your organization turns on coding mode, text of files in folders you choose that the model reads, with proposed changes and command output
• A record of actions in coding mode: the tool, the file path inside your folder (or the command line you ran), the size, the outcome, the time and your account. It does not include file text or command output
• Account details such as your email address, organization and role, and your name where your account has one
• Technical details such as the app version, platform and network address, for security, support and version checks
• Usage counts such as request IDs, status, response time, and organization and user IDs, for billing and reliability

11.2 Who can see it

• Your organization's owners, admins and reviewers can read what you send and what comes back, including text the model read from your files and from web pages. Each time they open people's chats, it is recorded. Other colleagues cannot see your chats
• The AI model provider your organization chose receives the conversation, including file and page text, after Obiguard hides secrets and applies your organization's rules. Your organization connects its own provider, so the provider depends on the organization

11.3 Web access and the browser pane

If your organization allows web access, when you give the model a link, Obiguard's servers fetch the public page for you. The fetcher reads only public addresses, obeys robots.txt and does not send cookies or your identity. Our audit record keeps only the host and path, not the query string or the page text, and we hold the page text in memory for up to 10 minutes. The browser pane is a separate browser inside the app. Its cookies and sign-ins stay on your computer and it cannot see your Obiguard sign-in. Nothing from it is shared with the model unless the model asks to read the open page, you see the start of the text that would be sent, and you approve. You can clear its data with "Clear browsing data", and your organization can switch it off.

11.4 Connectors

Connectors are off by default for every organization. If your organization turns them on, the model can call tools offered by outside systems that your administrators registered, and you choose per chat whether a connector is on. When the model calls a tool, our servers send the tool's name and arguments, which the model wrote and which may include parts of your conversation, to the connector's service. That service is run by a third party or by your organization, under its own terms. The result comes back, is checked against your organization's rules and is passed to your organization's model provider. If you sign in to a connector with your own account, the access token is stored encrypted on our servers and never on your computer. You can disconnect at any time: we delete your stored tokens and ask the provider to revoke them where it supports that.

11.5 What stays on your computer, and updates

• The app does not send analytics or crash reports
• Undo copies of files the model changed, held changes and the browser pane data stay on your computer. Undo copies are kept for up to 14 days or 200 changes
• The app asks our servers for the latest version of its release channel to check for updates. Versions from the Microsoft Store and the Mac App Store are updated by those stores

11.6 How long we keep it

You can delete a chat to remove it from your history. Your organization keeps its own audit record, and records such as request traces can remain after a chat is deleted. How long they are kept depends on your organization's settings and our agreements with it. To ask about a particular record, write to [email protected].