Privacy Policy

This Privacy Policy explains how Metrum AI (“we”, “us”, “our”) collects, uses, shares, and protects personal data when you use the Metrum AI Bench platform (“Service”). We designed it to follow the General Data Protection Regulation (GDPR) and other applicable data protection laws.

1. Data controller

Metrum AI is the data controller for personal data processed through the Service. You can reach us at contact@metrum.ai.

2. Personal data we collect

Account information:

• Your email address and display name, which we receive from Auth0 when you sign in.
• The workspaces you belong to and the role you hold in each.

Billing information, for paid plans:

• Your billing email address, organization, plan, and invoices, plus the billing address and tax ID you choose to provide.
• Stripe handles your card details. We never receive or store card numbers.

Usage data:

• The projects, workloads, benchmark runs, results, and logs you create.
• Your cloud machine requests, including start and stop times and the cost of each machine.
• Activity records of actions in your workspace, such as changes to team membership, with who did it and when.
• A record each time someone reads a run log, with the IP address and browser type (user agent) of that request.

Hardware and machine data, when you register a machine or run the agent:

• The hardware inventory, operating system, driver versions, telemetry samples, and network addresses of the machines you register.

Credentials you add:

• Cloud provider keys and Hugging Face tokens.
• Personal API tokens you create.

Support messages:

• The message you send through in-app support. We email a screenshot to our support team and do not store it in our database.

3. How we collect your data

• Directly from you, when you create an account, add data, or contact us.
• Automatically, from your browser and from the agent that runs on machines you register.
• From service providers: Auth0 sends your profile, Stripe sends payment status, and cloud providers send machine state and cost.

4. Purpose and lawful basis for processing

Providing the Service (contract performance, Article 6(1)(b) GDPR):

• Creating and managing your account and workspaces.
• Running benchmarks, creating cloud machines, and showing you the results.
• Sending emails about your runs, team invitations, and billing.
• Answering your support requests.

Billing and legal records (legal obligation, Article 6(1)(c) GDPR):

• Issuing invoices and keeping the tax and accounting records the law requires.

Security and fraud prevention (legitimate interest, Article 6(1)(f) GDPR):

• Detecting and preventing unauthorized access.
• Keeping activity records to investigate suspicious activity.

Reliability (legitimate interest, Article 6(1)(f) GDPR):

• Finding and fixing technical problems in the Service.

5. Data retention

After a retention period ends, we delete the data or anonymize it.

6. Data sharing and service providers

We share personal data with the providers below, and only so that they can help us run the Service. They process it under written agreements. We do not sell your personal data.

If you add an endpoint or a judge model, the Service sends test prompts to the address you enter, using the key you provide. That provider is your own vendor, and its terms and privacy policy apply to that data.

7. International data transfers

Some of our providers are outside the European Economic Area. When we transfer personal data to them, we rely on safeguards such as Standard Contractual Clauses and EU-US Data Privacy Framework certification where it applies.

8. Your rights under GDPR

You have these rights over your personal data:

• Access (Article 15): ask for a copy of your personal data.
• Rectification (Article 16): ask us to correct inaccurate data.
• Erasure (Article 17): ask us to delete your data. We may keep some data where the law requires it.
• Restriction (Article 18): ask us to limit how we use your data in some cases.
• Portability (Article 20): ask for your data in a machine-readable format, such as JSON.
• Objection (Article 21): object to processing that relies on legitimate interest.
• Withdrawal of consent: withdraw consent at any time where we rely on it.

To use any of these rights, email contact@metrum.ai from the address on your account. We answer within one month.

9. Data security

We protect your personal data with these measures:

• Your browser connects to the Service over an encrypted HTTPS connection.
• We encrypt cloud provider keys and Hugging Face tokens with AES-256-GCM before we store them.
• We store only a hash of each personal API token you create.
• Role-based access control limits each workspace’s data to its members.

10. Cookies and local storage

The Service sets a session cookie so that you stay signed in. It keeps display preferences, such as your theme and command palette history, in your browser’s local storage, and that data stays on your device. We do not use advertising or tracking cookies.

11. Changes to this policy

We may update this Privacy Policy. We post the updated policy on this page and change the date at the top. For a material change, we also tell you in the Service or by email. If you keep using the Service after a change, you accept the updated policy.

12. Complaints

If you have concerns about how we handle your data, you can lodge a complaint with your local data protection authority.

13. Contact us

For questions about this policy or to use your rights, email contact@metrum.ai.