Privacy Policy

This Privacy Policy explains how Octoriq (“Octoriq”, “we”, “us”) handles personal data when you visit octoriq.ai, use the dashboard at dash.octoriq.ai, or call the API at api.octoriq.ai (together, the “Service”).

Octoriq is in early access and is currently operated by its founder ahead of incorporation. When a legal entity is formed, this policy will be updated to name it as the data controller, and we will notify account holders by email.

We act in two roles:

• As a controller for account, billing and technical data that we need to run the Service (for example your email address, sign-in records and payment history).
• As a processor or service provider for the content you submit through jobs (goals, inputs, connected-account actions and results). We process that content on your instructions to deliver the job. If your goals or inputs contain other people’s personal data, you are responsible for having a lawful basis to share it with us.

Account and workspace

• Email address, display name and, if you sign in with Google or GitHub, the name, email and avatar they return.
• Your password, stored only as a salted hash by our authentication library. We never see or store it in plain text.
• Workspace membership and role (owner, member, viewer) and the environment you work in.
• API key metadata: name, prefix, scopes, environment, creation, last-use and revocation times. The full key is shown once at creation; we store only a hash.

Content you submit through jobs

• Goals, constraints, output schemas, context references and structured action inputs.
• Execution records: the route chosen, each executor call (provider, status, latency, normalized errors and the provider’s output), retries and reroutes, verification checks, the final result and its citations, and job events.
• Feedback you leave on completed jobs.
• For actions on connected accounts (for example sending an email or creating a calendar event): the exact payload put up for approval, who approved or rejected it, and what the target service reported back.

Integrations you configure

• Connections to SaaS accounts are made through Composio. We store a reference to the connection and its health status. OAuth access tokens for those accounts are held by Composio, not in our database.
• For MCP servers and A2A agents you register: their URLs, the tools or skills they advertise, your policy for each, and any authentication header you provide, which we encrypt (AES-256-GCM) before storing.

Billing

• An append-only ledger of provider costs, platform fees, customer charges, credit top-ups, debits, refunds and disputes, linked to jobs and to your workspace.
• Stripe Checkout session and payment identifiers, amounts and payment status. Card numbers and other payment credentials are entered on Stripe’s pages and never reach our servers.

Technical data

• For each dashboard session: its creation and expiry time, IP address and browser user agent.
• Short-lived rate-limit counters keyed by IP address or API key, used to protect sign-in and the API.
• Server logs with request metadata and job identifiers. Our logging rules exclude API keys, OAuth tokens, authorization headers and full sensitive payloads.
• Execution traces containing identifiers, timings, model names and token counts (no goal or result text).

octoriq.ai

This marketing site is a static website. It sets no cookies, runs no analytics or advertising scripts, and loads its fonts from our own domain. Our hosting and network providers may log standard request data (such as IP address and user agent) to deliver and protect the site.

• To run jobs you request: plan and route each job, call the executors the route needs, verify the outcome, stream progress and return the result.
• To operate accounts and security: authenticate you, enforce workspace and environment boundaries, apply rate limits, detect abuse and investigate incidents.
• To bill accurately: record provider costs and customer charges, apply your credit balance and reconcile payments.
• To improve routing: AgentRank and route experiments use aggregated outcome metrics — success and verification rates, reroute counts, latency and cost per executor. These rankings contain counts and rates only, never your goals, inputs or results.
• To communicate: send verification, password-reset and essential service emails, and answer your support requests.
• To meet legal obligations: keep financial records and respond to lawful requests.

We do not sell personal data, we do not use it for advertising, and we do not train AI models on your content.

Where data protection law requires a legal basis, we rely on:

• Performance of a contract — to provide the Service you signed up for, including running jobs, billing and support.
• Legitimate interests — to secure the Service, prevent abuse, keep it reliable and improve routing with aggregated metrics, balanced against your rights.
• Legal obligations — to keep accounting records and comply with lawful requests.
• Consent — where you choose it, for example signing in with Google or GitHub or connecting a SaaS account. You can withdraw consent by disconnecting the account or contacting us.

Octoriq works by sending parts of a job to the providers its route uses. A job only reaches the providers its route needs: a research job uses search and model providers, and an action job reaches the connected service you approved. The providers below may receive data:

MCP servers and A2A agents that you register receive the requests your jobs send to them. They are operated by you or third parties you choose, under their own terms.

Each provider processes data under its own terms and privacy policy, including its own retention rules. Model providers reached through OpenRouter may differ from job to job.

We may also disclose information if required by law, to protect the rights, safety or property of users or the public, or as part of a merger, acquisition or incorporation of the Service. In that case this policy would continue to apply to existing data unless you are notified otherwise.

Our production servers and primary database are located in the United States. Off-host backup copies are stored with Cloudflare R2. The providers listed above operate in various countries, so data may be processed outside your country of residence, including in countries with different data protection laws.

Where the law requires it, we rely on appropriate safeguards for such transfers, such as the providers’ standard contractual clauses or equivalent commitments. You can ask us for more information about the safeguards that apply to a given provider.

• Account and workspace data is kept while your account is active and deleted or anonymized after you ask us to close it, except where we must keep it longer (see below).
• Job content and execution records are kept while your workspace exists, so you can inspect past jobs, unless you ask us to delete them sooner.
• Billing records (the cost and credit ledgers) are append-only and kept for as long as accounting and tax law requires, even after an account is closed.
• Sessions are kept until they expire or you sign out; signing out or resetting your password ends sessions immediately.
• Rate-limit counters cover short time windows and are not used for anything else.
• Backups: daily database backups are kept on the server for 14 days, and off-host copies for up to about 30 days. Deleted data disappears from backups as they rotate out.

Data held by providers is retained according to their own policies.

Measures we use to protect data include:

• TLS for all traffic to the website, dashboard and API.
• Hashed passwords and API keys; full API keys are shown once and never stored.
• Encryption of stored MCP and A2A authentication headers (AES-256-GCM).
• Strict separation of workspaces and of development and production environments in every query.
• Logging rules that exclude secrets, tokens and authorization headers.
• Untrusted code and browsing run in third-party sandboxes (E2B, Browserbase), never on our application servers; outbound requests to registered servers are checked against private-network addresses.
• Sensitive actions require a permission policy and, where configured, explicit human approval.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by law. Please report vulnerabilities to [email protected].

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate data;
• delete your data or close your account;
• restrict or object to certain processing, including processing based on legitimate interests;
• receive your data in a portable format;
• withdraw consent where processing relies on it;
• lodge a complaint with your data protection authority.

You can manage much of your data directly in the dashboard: revoke API keys, disconnect connected accounts, remove MCP servers and agents, and review jobs. Account closure and deletion of job history are currently handled on request. Email [email protected] from the address on your account; we may need to verify your identity before acting, and we will respond within the time the law requires.

If your data reached us because a customer submitted it in a job, please contact that customer first; we will assist them in responding to you.

The Service is built for developers and businesses. It is not directed to children, and you must be at least 18 years old (or the age of majority where you live) to create an account. We do not knowingly collect personal data from children; if you believe a child has provided data to us, contact [email protected] and we will delete it.

We will update this policy as the Service changes — for example when we incorporate, add a provider or launch a feature that uses data differently. The effective date at the top shows the latest version. For material changes we will notify account holders by email or in the dashboard before they take effect.

Questions, requests or complaints about privacy: [email protected]. Please do not include API keys, passwords or other secrets in your message.