Privacy policy

1. Information we handle

Account and workspace information includes your email address, name, profile image when supplied by your sign-in provider, account identifiers, memberships, permissions and communications with us.

Customer Content includes information you submit or generate through the service, such as datasets, task inputs, code, configuration, prompts, outputs, execution logs, metrics, checkpoints and other artifacts. It may contain personal information if you include it.

Service records include requests and timestamps, IP addresses, browser or device information, authentication and security events, resource usage, billing contacts and transaction or credit records. A workload’s own logs may contain content printed by your code.

2. Google sign-in

If you choose Google sign-in, Google and our authentication provider, Clerk, help verify your identity. We receive the basic identity information made available for that sign-in, such as your name, email address, profile image and a provider identifier. The current Google sign-in flow requests only basic identity scopes for your profile, email and OpenID authentication.

Signing in does not give EnvLoop access to your Gmail messages, Google Drive files or contacts. Google account information is used to authenticate you, maintain your account, secure access and support the service. We do not sell it, use it for advertising or use it to train general-purpose AI models. You can remove the connection through your Google Account; this does not by itself delete your EnvLoop workspace or its content.

3. Why we use information

We use information to provide requested services, manage accounts and permissions, execute workloads, store and return artifacts, measure usage, administer charges, respond to support requests and communicate service changes.

We also use operational information to investigate failures, prevent abuse, protect accounts and infrastructure, comply with legal obligations and resolve disputes. Where applicable law requires a legal basis, we rely on performing our agreement with you, our legitimate interests in operating a secure service, legal obligations or your consent, as appropriate. Consent can be withdrawn where processing depends on it.

4. Your content and model training

We process private Customer Content to carry out your instructions and to operate, secure and support the requested service. Training or fine-tuning a model that you initiate necessarily processes the inputs, model files and artifacts required for that job.

Using private Customer Content to train a general-purpose model for our own purposes or for another customer requires your separate, explicit agreement. Publishing content or granting workspace access makes that content available to the people you authorize. You are responsible for having permission to submit personal information and for choosing suitable sharing settings.

5. Providers and other disclosures

We use providers to deliver the service, including Clerk for authentication, Cloudflare for website delivery and platform storage, and cloud, compute, storage or model providers needed for your workloads. Information sent to these providers depends on the feature and workload. If you connect a third-party service or configure your code to send data elsewhere, its terms and privacy practices also apply.

Authorized workspace members and administrators can access information permitted by their roles. We may disclose information when necessary to comply with law, respond to lawful requests, protect safety or rights, investigate abuse, or carry out a business transfer subject to applicable protections. We do not sell personal information or share it for targeted advertising.

6. Cookies and browser storage

EnvLoop and its authentication and security providers use cookies and similar storage to maintain sessions, prevent abuse and remember preferences such as language and theme. These functions may stop working if you block the relevant storage. The public policy pages can be read without signing in.

We do not use Customer Content or Google account data to personalize advertisements. If we introduce optional analytics or advertising tools, we will describe them and provide any choices required by applicable law before using them.

7. Retention and deletion

We retain information for the purposes described here, taking account of the active account or workload, your instructions, operational and backup needs, and legal, billing, security or dispute obligations. Different records and artifacts may have different retention periods; we do not promise that all information disappears when a job ends.

Use available resource controls to remove content, or contact us to request account or data deletion. We may verify your identity and authority, including whether a workspace owns the content. Copies may remain for a limited operational or backup period or where retention is legally required. Copies already downloaded by other people and data held independently by connected services may require a separate request to them.

8. Security and international processing

We use access controls, authenticated service connections and HTTPS on public service endpoints to help protect information. No system is completely secure. Protect your credentials, limit workspace access and avoid placing secrets or unnecessary sensitive personal information in logs or public artifacts.

Our service and providers may process information in countries other than your own. Available locations depend on the service and provider; no specific storage location is guaranteed unless we agree to it separately. Where required, international processing must be subject to safeguards required by applicable law. Contact us before submitting data that requires a particular residency, contractual safeguard or regulated environment.

9. Your choices and rights

Depending on the law that applies, you may request access to or a copy of your personal information, correction, deletion, restriction or an objection to processing, portability, or withdrawal of consent. You may also have the right to complain to a relevant data protection authority. We do not deny a service or discriminate merely because you exercise a legal privacy right.

Send requests to hello@envloop.ai from an address associated with your account when possible. Do not send passwords, API keys or full payment credentials. If your organization controls the workspace, its administrator may need to handle the request, and its own privacy notice may also apply.

10. Children

EnvLoop is intended for adults and professional use, not for children under 18. We do not knowingly seek personal information from children. Contact us if you believe a child has supplied personal information so that we can investigate and take appropriate action.

11. Changes and contact

We may update this policy as the service changes. We will publish the revised text and effective date here and provide additional notice of material changes where appropriate or required by law. New purposes that require consent will not be treated as authorized merely because we update this page.

For privacy questions, requests or information about the operator of a particular service order, contact the EnvLoop team at hello@envloop.ai.