Privacy policy
Effective November 8, 2026
This policy explains what OpenGray ("we", "us", "our") collects when you use our web application and evaluation SDK, why we collect it, and how long we keep it.
1. What we collect
| Category | Examples | Purpose |
|---|---|---|
| Account data | Name, email address, optional company, bcrypt password digest | Creating and securing your workspace |
| Credentials | SHA-256 hashes of project tokens, prefix and last four characters | Authenticating CI/CD evaluation runs |
| Billing data | Workspace plan status, purchase history, transaction identifiers, amounts | Provisioning plans and accounting |
| Telemetry metadata | Timestamp, evaluation suite, token counts, latency, HTTP status, IP address | Workspace analytics, support and abuse prevention |
| Security logs | Sign-in attempts with IP address and outcome | Rate limiting and intrusion detection |
| Correspondence | Messages sent through the contact form | Answering your enquiry |
2. Prompts and evaluation payloads
We do not store the content of your prompts or evaluation responses. Payloads are processed in memory to execute your requested workspace evaluation and are discarded once the response has been delivered. Only the telemetry metadata listed above is retained.
3. Sub-processors we use
- Cloud AI Infrastructure Providers - execute language and reasoning computations for workspace evaluation runs under strict commercial zero-data-retention configurations.
- Supabase - hosts the Postgres database holding accounts, plan quotas, and telemetry metadata.
- Merchant of Record Payment Partner - processes payments, tax compliance, and invoicing. Card details are entered directly on the payment processor's systems and never reach ours.
4. Cookies
We set one strictly necessary session cookie (og_session) to keep you signed in.
Your colour theme preference is stored in your browser's local storage. We do not use
advertising cookies or third-party analytics trackers.
5. Retention
- Account and billing records: retained while the account is open and for up to 7 years afterwards as required for tax and financial records.
- Telemetry metadata: retained according to your workspace plan tier (up to 12 months).
- Sign-in attempt logs: 90 days.
- Contact form messages: 24 months.
6. Your rights
You may request a copy of your data, correction of inaccurate data, or deletion of your account. Where you are covered by the GDPR, UK GDPR, KVKK, or CCPA you also have the right to object to processing and to data portability. Write to contact@open-gray.com and we will respond within 30 days. We do not sell personal information.
7. Security
Traffic is encrypted in transit via TLS. Passwords are hashed with bcrypt and project tokens with SHA-256; neither can be recovered from our database. Database tables are protected by row-level security and are reachable only by the application backend.
8. Children
The service is intended for software professionals and is not directed at children under 18.
9. Contact
For privacy enquiries or data requests, contact contact@open-gray.com.