U22A8
A8
A8 (Touchstone) available for previewDocumentation calls, abstention, reproducibility
Research
All research benchmarks
U22A8··Terms·Privacy

Privacy Policy

Last updated: 2026-09-29

1. Scope

This Privacy Policy describes what personal information u22a8.ai (the “Service”) collects, how it is used, how long it is kept, and your rights in respect of it. It applies to visitors, account holders, and API users.

2. Controller and Privacy Officer

The controller and responsible party for personal information processed by the Service is U22A8 Inc., a corporation incorporated under the laws of Canada (the “Operator”). The Operator has designated a Privacy Officer for the purposes of Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), reachable at .

For personal information inside the content a workspace submits (§3), the workspace’s organization decides what is submitted and why, and the Operator processes it on that organization’s behalf.

3. What we collect

When you use the Service we may process:

  • Account information: your name, email address and display name; the workspaces you belong to and your role in each; sign-in events; and which version of the Terms of Use and this Policy you accepted, and when. Sign-in is handled by WorkOS.
  • Access requests: when you request a model, the model, the workspace, and what you told us you want to use it for.
  • Workspace content: what a workspace submits to a model, meaning criteria, the content to be judged, and corrections, as the Terms of Use define it. It is stored with the workspace it came from. Any personal information in it is there because the workspace put it there.
  • Encodings: to judge content, a model first converts its text into a fixed-length numerical encoding. We cache encodings under a one-way hash of the text. The cache holds neither the text nor anything that links an encoding to a workspace or a person.
  • Usage records: for each API request, the workspace, the API key, the model, the time, and the number of tokens processed. These are what usage is metered and billed on.
  • Request metadata: for each request, the time, path, HTTP method, response status, user-agent string and source IP address, recorded in request logs and traces.
  • Public demonstrations: text you submit to a demonstration on the public website, which may be held in transient caches and in application logs for operational purposes.
  • Cookies and local storage: the Service sets no advertising or tracking cookies. A session cookie keeps you signed in, and a cookie remembers which theme you chose, on the console and sign-in pages only. Your browser’s local storage remembers which announcements you have dismissed; it stays in your browser and is never sent to us. Cloudflare Web Analytics counts page views without cookies or local storage.

4. Purposes

We use the information identified in §3 only for the following purposes:

  • Providing your account, your workspaces, and the models they have access to.
  • Reviewing access requests and writing to you about them.
  • Metering usage and billing for it.
  • Operating, debugging, and securing the Service.
  • Producing aggregate, non-identifying usage metrics.

Workspace content trains only that workspace’s own models. It is never used to train or improve any model outside the workspace, and it is never shared with another customer.

Where the GDPR or UK GDPR applies, the legal bases for our processing are: (a) performing our agreement with you, for your account, your workspaces, and billing; (b) our legitimate interests in operating and securing the Service, and in reviewing the access requests you send; and (c) compliance with our legal obligations, where applicable.

6. Sharing

We do not sell personal information. We do not share it with third parties except: (a) infrastructure providers strictly necessary to operate the Service, and (b) in response to valid legal process.

The providers under (a) are:

  • Cloudflare (global), which delivers traffic to and from the Service, protects it from abuse, and counts page views without cookies.
  • Rackspace (United States, Dallas–Fort Worth), which hosts the Service and its database.
  • WorkOS (United States), which handles sign-in, accounts, and API key verification.
  • OpenRouter (United States), which routes text to be encoded to the encoding model’s host, under zero data retention.
  • Nebius (the EU or the United States), which encodes text under zero data retention: it keeps nothing after encoding, and trains on nothing.
  • Resend (United States), which delivers the mail we send.

7. Retention

  • Account information: while the account exists, and deleted within 30 days of its closure. The record of which Terms you accepted is kept as long as it may be needed to show that agreement.
  • Workspace content and the models trained on it: until the workspace deletes it, or within 30 days of the workspace closing. Withdrawing content in the console takes it out of the workspace’s next model; to delete it, write to .
  • Encodings: kept, because they hold no text and cannot be linked to a workspace or a person, and they keep results reproducible.
  • Access requests: with the workspace they were made for.
  • Usage records: as long as tax and accounting law requires.
  • Request logs: up to 30 days, then rotated.
  • Transient caches for public demonstrations: up to 24 hours, best-effort.

8. Security

We apply reasonable technical and organizational safeguards appropriate to the sensitivity of the information, including keeping each workspace’s content separate and encrypting every connection (HTTPS). No internet service can be guaranteed secure; users assume residual risk.

9. International transfers

The Service itself runs in the United States, and the Operator is in Canada. Cloudflare operates globally, and Nebius encodes text in the EU or the United States without retaining it. Personal information may therefore be processed in Canada, the United States, the EEA or other countries where these providers operate. Where the GDPR or UK GDPR applies, transfers rely on adequacy decisions (which cover Canada), the EU–U.S. Data Privacy Framework where the recipient is certified under it, or standard contractual clauses.

10. Your rights

Subject to applicable law, you may ask to access, correct or delete personal information about you, to restrict or object to its processing, or to receive it in a portable form, and you may lodge a complaint with a supervisory authority. To exercise these rights, contact the Privacy Officer (see §2).

What we hold differs by what you gave us. Your account and your access requests can be found, corrected and deleted. Personal information inside a workspace’s content is handled at the request of that workspace’s organization, so we refer a request about it to them. Encodings are linked to no one, so there is nothing in them to find. Canadian residents may also file a complaint with the Office of the Privacy Commissioner of Canada.

11. Children

The Service is not directed at children under the minimum age of digital consent in your jurisdiction, and we do not knowingly collect personal information from such children.

12. Changes

We may update this Policy from time to time; the “Last updated” date changes with every update. When a change is material, account holders are asked to accept it in the console, and it is surfaced prominently on the Service.

13. Contact

Privacy Officer: . Public repositories are hosted at github.com/u22a8.

See also: Terms of Use