Privacy Policy

When you create an account, we collect:

• Name and email address
• Organization name (if applicable)
• Password (stored as a salted, one-way hash — we never store plaintext passwords)
• Profile information you choose to provide (e.g., role, avatar)
• Authentication tokens from SSO/SAML providers (if you use enterprise SSO)

When you use the Service, you may submit:

• LLM prompts and model outputs for evaluation
• Evaluation datasets and test cases
• Model configurations and provider API keys (encrypted at rest with AES-256)
• Red teaming attack results and security scan outputs
• Prompt versions and templates
• Custom scoring configurations

Important: We do not use your evaluation data, prompts, or model outputs to train any machine learning models. Your Customer Data is processed solely to provide the Service to you.

We automatically collect:

• Feature usage patterns (which pages and features you use, and how often)
• API request metadata (endpoints called, response times, error rates — not request bodies)
• Browser type, operating system, and device information
• IP address (used for security, rate limiting, and approximate geolocation)
• Referring URLs and pages visited within the Service

Payment information (credit card numbers, bank details) is collected and processed directly by our payment processors (Stripe and/or Razorpay). We receive only non-sensitive transaction identifiers, the last four digits of your card, and billing address for invoicing purposes.

Customer Data is stored in Supabase-managed PostgreSQL databases with the following security measures:

• Encryption at rest using AES-256
• Encryption in transit using TLS 1.2+
• Row-Level Security (RLS) policies ensuring strict data isolation between organizations
• Regular automated backups with point-in-time recovery
• Network-level isolation and firewall rules

Access to production data is restricted to authorized personnel on a need-to-know basis. All access is logged and audited. We follow the principle of least privilege for all internal access.

We are pursuing SOC 2 Type II certification. Our infrastructure and operational practices are designed to meet the Trust Services Criteria for security, availability, processing integrity, confidentiality, and privacy.

For organizations with strict data residency requirements, EvalGuard can be self-hosted using our Docker images and Helm charts. In self-hosted deployments, all data remains within your own infrastructure and is never transmitted to our servers.

If you are in the EEA, you have the following rights under the General Data Protection Regulation:

• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate personal data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Restrict Processing: Request that we limit how we use your data
• Right to Object: Object to processing of your data for certain purposes

Our legal basis for processing your data is: (a) performance of a contract (to provide the Service); (b) legitimate interest (to improve the Service and ensure security); and (c) your consent (for optional communications). A Data Processing Agreement (DPA) is available for enterprise customers upon request.

If you are a California resident, you have the following rights under the California Consumer Privacy Act:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: We do not sell personal information. There is nothing to opt out of
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

We do not sell, share, or use personal information for cross-context behavioral advertising.

For users in India, we comply with the Digital Personal Data Protection Act, 2023:

• Consent Management: We obtain clear, informed consent before processing personal data. You can withdraw consent at any time
• Data Localization: For Indian customers requiring data localization, we offer self-hosted deployments and Supabase regions in India (Mumbai)
• Data Principal Rights: You have the right to access, correct, and erase your personal data, and to nominate another person to exercise these rights
• Grievance Redressal: Complaints can be directed to our Data Protection Officer at dpo@evalguard.ai

To exercise any of the above rights, contact us at privacy@evalguard.ai. We will respond to your request within 30 days. We may ask you to verify your identity before processing your request. Data export is also available directly through the dashboard and API at any time.