PRIVACY

Legal / Privacy Policy / Research Beta

Your data,our responsibility.

When you use OnLeash, your agent data, policies, and audit logs are stored securely on our platform. We encrypt everything at rest and in transit, collect only what we need to operate the service, and do not sell personal data or share it for cross-context behavioral advertising.

Research Beta. Use test credentials and self-controlled infrastructure for evaluation only. Not for production, safety-critical, or revenue-generating workflows.

Last updated: April 22, 2026

ENCRYPTED AT REST

RESEARCH BETA

MINIMAL DATA COLLECTION

RIGHTS REQUESTS SUPPORTED

Scroll

SCOPE

CONTROLLER

Roles, Scope, And Responsibility

This Privacy Policy covers the OnLeash website, dashboard, API, managed service, and related support workflows. For website, account, and support data we act as the controller. For agent telemetry, policies, audit logs, and governed workflow data submitted by customers, we generally act as a processor or service provider on the customer's behalf.

—Website visitors, prospective customers, and account holders are covered by this policy for data we collect directly from them.

—Customer workspace and governed agent data remain subject to customer instructions, configuration choices, and the terms governing the workspace.

—If a customer submits third-party data into OnLeash, that customer is responsible for having an appropriate legal basis to do so.

DATA CATEGORIES

CLASSIFIED

What We Collect

We collect only the categories of information needed to provide, secure, and improve the service.

—Account and identity data: name, email address, hashed password, login metadata, session identifiers, organisation membership, role assignments.

—Device and connection data: IP address, user-agent string, device type, approximate geolocation derived from IP, time-zone, and pages visited.

—Governance data: agent registrations, policy definitions, approval actions, audit events, threat detections, security receipts, verdict tokens, telemetry.

—Support and commercial data: messages you send us, trial or sales requests, billing details processed by our payment processor, and administrative correspondence.

—Website analytics and consent signals for the public site, where analytics is enabled by you.

—We do not knowingly collect special-category personal data (health, biometric, sexual-orientation, political-opinion, religious belief, trade-union membership) and you should not submit it to the service.

LAWFUL BASIS

LAWFUL

Why We Process Personal Data

Where privacy laws require a legal basis, we rely on one or more of the following depending on the context:

—Performance of a contract: to create accounts, provide product access, secure workspaces, and operate requested governance features.

—Legitimate interests: to defend the platform, prevent fraud and abuse, investigate incidents, and improve reliability and product quality.

—Consent: for optional analytics and any other processing we clearly present as consent-driven.

—Legal obligations: where retention, disclosure, or recordkeeping is required by law, regulation, litigation hold, or governmental request.

RETENTION & SECURITY

ENCRYPTED

How Long We Keep Data And How We Protect It

We apply technical and organisational controls appropriate to the sensitivity of the data we handle and retain data only as long as needed for the stated purpose.

—Encryption: data at rest is encrypted with AES-256-GCM where supported by the underlying storage layer; data in transit is encrypted with TLS 1.3.

—Account data: retained while your account is active and for up to 90 days after closure to support recovery, fraud prevention, dispute resolution, and legal obligations; thereafter purged or anonymised.

—Audit logs and security telemetry: retained for up to 24 months to investigate incidents, enforce terms, and demonstrate compliance evidence; longer retention only where required by law or active investigation.

—Billing records: retained for the period required by applicable tax and accounting law (typically 7 years).

—Backups: retained for up to 35 days on a rolling basis; deletion requests propagate through backups within that window.

—Deletion requests are typically actioned within 30 days unless longer retention is required for security, legal, or fraud-prevention reasons.

TRANSFERS

SAFEGUARDED

Subprocessors, Hosting, And International Transfers

We may use infrastructure, analytics, email, and support providers to operate the service. Those providers receive only the information needed for their function and are expected to process it under contractual and security controls.

—Data may be processed in jurisdictions outside your home country where our providers operate or where support and infrastructure functions are performed.

—Where required, we rely on contractual safeguards and access controls to govern cross-border transfers.

—We do not permit subprocessors to use customer data for their own advertising purposes.

YOUR RIGHTS

ACCESSIBLE

Access, Deletion, Export, And Opt-Out Rights

Depending on your location, you may have rights under the EU/UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), the Indian Digital Personal Data Protection Act 2023 (DPDPA), or other applicable privacy laws. Where we control the relevant personal data, we will use reasonable efforts to honour these rights.

—You can request access, correction, export (data portability), deletion (right to erasure), restriction of processing, or account closure by emailing onleash@protonmail.com. We will verify your identity before fulfilling the request and respond within the timeframe required by applicable law (typically 30–45 days).

—You may withdraw consent for analytics or marketing at any time. Withdrawal does not affect the lawfulness of processing performed before withdrawal.

—CCPA / CPRA notice for California residents: in the preceding 12 months we have not sold or shared personal information for cross-context behavioural advertising as those terms are defined under the CCPA/CPRA. We do not knowingly process personal data of consumers under 16 without consent.

—You have the right to lodge a complaint with your local supervisory authority (for example, the Data Protection Board of India under DPDPA § 27, your EU member-state Data Protection Authority, the UK Information Commissioner’s Office, or the California Privacy Protection Agency).

—We do not engage in solely automated decision-making producing legal or similarly significant effects on you within the meaning of GDPR Article 22.

CONTACT

OPEN

Questions Or Complaints?

Privacy, deletion, and legal requests can be sent directly to our public contact channel during the current launch stage.

—Privacy contact / Data Protection Officer: onleash@protonmail.com.

—Current launch stage: Research Beta.

—For details of our subprocessors and international transfers, see the Subprocessors page (link in the footer).

—For data-processing terms when OnLeash acts as a processor on your behalf, see the OnLeash Data Processing Addendum (DPA), available on request.

—Cookie-specific disclosures are available on the Cookie Policy page.

—Material updates to this policy will be posted on this page with a new effective date.

onleash@protonmail.com