U22A8
A8
A8 (Touchstone) available for previewDocumentation calls, abstention, reproducibility
Research
All research benchmarks
U22A8··Terms·Privacy

Privacy Policy

Last updated: 2026-09-23

1. Scope

This Privacy Policy describes what personal information u22a8.ai (the “Service”) collects, how it is used, how long it is kept, and your rights in respect of it. It applies to visitors, account holders, and API users.

2. Controller and Privacy Officer

The controller and responsible party for personal information processed by the Service is U22A8 Inc., a corporation incorporated under the laws of Canada (the “Operator”). The Operator has designated a Privacy Officer for the purposes of Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), reachable at .

For personal information inside the content a workspace submits (§3), the workspace’s organization decides what is submitted and why, and the Operator processes it on that organization’s behalf.

3. What we collect

When you use the Service we may process:

  • Account information: your name, email address and display name; the workspaces you belong to and your role in each; sign-in events; and which version of the Terms of Use and this Policy you accepted, and when. Sign-in is handled by WorkOS.
  • Access requests: when you request a model, the model, the workspace, and what you told us you want to use it for.
  • Workspace content: what a workspace submits to a model, meaning criteria, the content to be judged, and corrections, as the Terms of Use define it. It is stored with the workspace it came from. Any personal information in it is there because the workspace put it there.
  • Encodings: to judge content, a model first converts its text into a fixed-length numerical encoding. We cache encodings under a one-way hash of the text. The cache holds neither the text nor anything that links an encoding to a workspace or a person.
  • Usage records: for each API request, the workspace, the API key, the model, the time, and the number of tokens processed. These are what usage is metered and billed on.
  • Request metadata: timestamp, path, HTTP method, response status, user-agent string, and a hashed representation of the source IP address.
  • Public demonstrations: text you submit to a demonstration on the public website, which may be held in transient caches and in application logs for operational purposes.
  • Cookies and local storage: the Service sets no advertising or tracking cookies. A session cookie keeps you signed in, and a cookie remembers which theme you chose, on the console and sign-in pages only. Your browser’s local storage remembers which announcements you have dismissed; it stays in your browser and is never sent to us. Page views are counted by Simple Analytics, which sets no cookies and records no personal information.

4. Purposes

We use the information identified in §3 only for the following purposes:

  • Providing your account, your workspaces, and the models they have access to.
  • Reviewing access requests and writing to you about them.
  • Metering usage and billing for it.
  • Operating, debugging, and securing the Service.
  • Producing aggregate, non-identifying usage metrics.

Workspace content trains only that workspace’s own models. It is never used to train or improve any model outside the workspace, and it is never shared with another customer.

Where the GDPR or UK GDPR applies, the legal bases for our processing are: (a) performing our agreement with you, for your account, your workspaces, and billing; (b) our legitimate interests in operating and securing the Service; (c) compliance with our legal obligations, where applicable; and (d) your consent, wherever you give us an address through a form on the Service, which you may withdraw at any time.

6. Sharing

We do not sell personal information. We do not share it with third parties except: (a) infrastructure providers strictly necessary to operate the Service, (b) upstream dataset licensors upon demonstrated contractual need, and (c) in response to valid legal process.

The providers under (a) are:

  • Rackspace (United States, Dallas–Fort Worth), which hosts the Service and its database.
  • WorkOS (United States), which handles sign-in, accounts, and API key verification.
  • OpenRouter (United States), which routes text to be encoded to the encoding model’s host, under zero data retention.
  • Nebius (the EU or the United States), which encodes text under zero data retention: it keeps nothing after encoding, and trains on nothing.
  • Simple Analytics (the Netherlands), which counts page views without cookies or personal information.
  • Resend (United States), which delivers the mail we send.

7. Retention

  • Account information: while the account exists, and deleted within 30 days of its closure. The record of which Terms you accepted is kept as long as it may be needed to show that agreement.
  • Workspace content and the models trained on it: until the workspace deletes it, or within 30 days of the workspace closing. Withdrawing content in the console takes it out of the workspace’s next model; to delete it, write to .
  • Encodings: kept, because they hold no text and cannot be linked to a workspace or a person, and they keep results reproducible.
  • Access requests: with the workspace they were made for.
  • Usage records: as long as tax and accounting law requires.
  • Request logs: up to 30 days, then rotated.
  • Transient caches for public demonstrations: up to 24 hours, best-effort.

8. Security

We apply reasonable technical and organizational safeguards appropriate to the sensitivity of the information, including keeping each workspace’s content separate, hashing IP addresses at ingress, and transport encryption (HTTPS). No internet service can be guaranteed secure; users assume residual risk.

9. International transfers

The Service itself runs in the United States, and the Operator is in Canada. Simple Analytics is in the European Economic Area, and Nebius encodes text in the EU or the United States without retaining it. Personal information may therefore be processed in Canada, the United States or the EEA, depending on which of them holds it. Where the GDPR or UK GDPR applies, transfers out of the EEA rely on recognized mechanisms (e.g., Canada’s adequacy decision; standard contractual clauses where adequacy does not apply).

10. Your rights

Subject to applicable law, you may have rights to access, correct, or delete personal information associated with you, and to lodge a complaint with a supervisory authority. To exercise these rights, contact the Privacy Officer (see §2).

What we hold differs by what you gave us. Your account, and any address you gave us through a form, can be found, corrected and deleted. Personal information inside a workspace’s content is handled at the request of that workspace’s organization, so we refer a request about it to them. We hash source IP addresses at ingress and link no identifier to encodings or to public demonstrations, so a request about those is usually answered by telling you that nothing associated with your identifier is retained. Canadian residents may also file a complaint with the Office of the Privacy Commissioner of Canada.

11. Children

The Service is not directed at children under the minimum age of digital consent in your jurisdiction, and we do not knowingly collect personal information from such children.

12. Changes

We may update this Policy from time to time; the “Last updated” date changes with every update. When a change is material, account holders are asked to accept it in the console, and it is surfaced prominently on the Service.

13. Contact

Privacy Officer: . Public repositories are hosted at github.com/u22a8.

See also: Terms of Use