Privacy Policy

1. Overview

This Privacy Policy explains how Ovrin, Inc. ("Ovrin," "we," "us") collects, uses, discloses and protects information when you use ovrin.app, api.ovrin.dev, our dashboard, and the sandbox compute platform (together, the "Service"). It applies to visitors, registered account holders ("Customers"), and individuals whose personal data Customers process using the Service. If you are a Customer's end user or employee and have a question about data a Customer submitted, please contact that Customer directly — we act as their service provider for that data.

Capitalized terms not defined here have the meaning given in our Terms of Service or Data Processing Agreement.

2. Information we collect

Account information. Name, email address, organization name, and authentication credentials when you register. If you sign in via a third-party identity provider, we receive the profile fields that provider shares under its permission scope.

Billing information. Billing address and tax identifiers. Card and bank details are collected and stored directly by our payment processor, Stripe — Ovrin does not store full payment card numbers.

Usage and platform data. API requests and responses metadata, sandbox lifecycle events (create, run, kill timestamps), resource consumption (vCPU-seconds, GiB-seconds, egress bytes), template selection, error and crash logs, and IP address / user agent for security and abuse monitoring.

Sandbox content. The code, files, commands, and agent prompts/output that flow through a sandbox you create ("Customer Content"). This is Customer's data, not Ovrin's — see Section 3 for how we process it and Section 8 for retention.

Marketing site analytics. Standard web analytics (page views, referrer, approximate location from IP, device type) collected via cookies and similar technologies on ovrin.app. See Section 12.

Support communications. Content of support tickets, emails, or messages you send us.

3. AI and agent processing

The Service's core function is provisioning isolated compute so a coding agent (Claude Code, Codex, Gemini CLI, DeepSeek Harness, or a custom process you run) can execute inside it. This section explains specifically how that agent-related data moves.

You bring your own model access. Ovrin does not operate the underlying language models. When you create a sandbox with a template like claude-code, you supply your own API key for that provider (e.g. ANTHROPIC_API_KEY). Prompts and completions for that session are sent directly from the sandbox to the model provider under your account and their terms — Ovrin's network layer permits that specific egress but does not sit in the middle of, log the content of, or use those prompts/completions for its own purposes.

What Ovrin does process. We process Customer Content only as needed to operate the sandbox: allocating compute, enforcing the egress allowlist, streaming stdout/stderr back to your client, and — only if you explicitly call memory.add() — storing the text you chose to persist. We do not read, inspect, or use sandbox filesystem contents for any purpose other than fulfilling your API calls, and we do not train any model on Customer Content.

No training on your data. Ovrin does not use Customer Content, API traffic, or persisted memory to train, fine-tune, or evaluate machine learning models, ours or anyone else's.

Agent-directed actions are yours. Because an agent inside your sandbox acts on instructions you or your integration provide, any data it reads, generates, or transmits (subject to the egress policy) is Customer Content under your control, not data Ovrin collects independently.

4. How we use information

• Provide, operate, secure and maintain the Service, including scheduling sandboxes and enforcing isolation and egress policy.
• Process payments, calculate compute-second billing, and send invoices.
• Monitor for abuse, fraud, and violations of the Acceptable Use Policy.
• Provide customer support and respond to inquiries.
• Send service, security, and billing notices (transactional, not marketing).
• With consent or opt-in, send product updates and marketing communications, which you may opt out of at any time.
• Debug, improve reliability, and develop new features, using aggregated or de-identified usage data wherever practical.
• Comply with legal obligations and enforce our agreements.

5. Legal bases for processing (EEA/UK)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (operating the Service you signed up for); legitimate interests (security monitoring, abuse prevention, product analytics), balanced against your rights; consent (marketing communications, non-essential cookies); and legal obligation (tax, accounting, law enforcement requests). Where Ovrin processes personal data within Customer Content as a processor on a Customer's behalf, the Customer determines the legal basis and our DPA governs that processing.

6. Data sharing and sub-processors

We do not sell personal data. We share information with:

• Sub-processors who provide infrastructure, model access (only for the template you select), payments, and analytics on our behalf, listed in full in the DPA.
• Professional advisors (legal, accounting) under confidentiality obligations.
• Acquirers in connection with a merger, financing, or sale of assets, subject to this policy continuing to govern previously collected data.
• Law enforcement or regulators when required by valid legal process, or to protect the rights, property, or safety of Ovrin, our users, or the public.

Current sub-processors:

7. International data transfers

Ovrin is headquartered in the United States and uses infrastructure providers with regions in the United States and European Union. If you are located in the EEA, UK, or Switzerland, your data may be transferred to and processed in countries that have not received an adequacy decision. Where that occurs, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum) with our sub-processors, incorporated by reference into our DPA, as the transfer mechanism.

Enterprise customers with data residency requirements can request that sandbox compute and object storage be pinned to a specific supported region; contact sales@ovrin.app.

8. Data retention and deletion

• Sandbox filesystem & process state — destroyed immediately when a sandbox is killed or times out. Nothing here survives the sandbox.
• Persistent memory (data you explicitly wrote via memory.add()) — retained until you delete it or close your account, then purged within 30 days.
• Usage & billing records — retained for the life of the account plus 7 years to satisfy tax and accounting obligations.
• Security & audit logs — retained up to 18 months for abuse investigation and incident response.
• Account data — retained until account deletion is requested, then purged within 30 days except where retention is legally required.

9. Security measures

We protect information with encryption in transit (TLS 1.2+) and at rest (AES-256), gVisor kernel isolation between sandboxes, default-deny network egress, role-based access control on internal systems, and audit logging of administrative access to production infrastructure. Full detail is published at /security. No system is perfectly secure; see Section 11 of the Terms of Service for disclaimers.

10. Your privacy rights

Depending on where you live, you may have the right to: access the personal data we hold about you; correct inaccurate data; delete your data; export it in a portable format; restrict or object to certain processing; and withdraw consent where processing is consent-based. California residents have equivalent rights under the CCPA/CPRA, including the right to know, delete, correct, and opt out of "sale" or "sharing" — Ovrin does not sell or share personal data for cross-context behavioral advertising.

To exercise any of these rights, email privacy@ovrin.app. We will verify your request and respond within the time required by applicable law (typically 30 days). If a Customer submitted your data to the Service, we will generally direct your request to that Customer, who controls it, and support them in responding.

You may also lodge a complaint with your local data protection authority.

11. Children's privacy

The Service is intended for business and professional use and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact privacy@ovrin.app and we will delete it.

12. Cookies and tracking

The marketing site (ovrin.app) uses strictly necessary cookies (session, load balancing) and, with consent where required, analytics cookies to understand aggregate traffic. The dashboard and API (api.ovrin.dev) use only strictly necessary session cookies/tokens for authentication — there is no third-party advertising tracking anywhere on the Service.

13. Changes to this policy

We may update this policy as the Service evolves or the law requires. Material changes will be announced by email to account holders or a notice on the dashboard at least 14 days before taking effect. The "Last updated" date above always reflects the current version.

14. Contact us

Ovrin, Inc. · privacy questions: privacy@ovrin.app · data protection officer: dpo@ovrin.app · general: legal@ovrin.app