Privacy Policy

Information we collect

Account and workspace information

We may collect names, email addresses, password hashes, organization and workspace details, roles, onboarding information, account-review records, notification preferences, and support communications.

Platform and workload information

Customers may provide workload definitions, runtime configurations, evaluation datasets and cases, experiment results, deployment records, model metadata, production traces, and other technical content needed to operate the Services. Production content is retained according to the capture mode and settings chosen by the customer.

Credentials and API keys

The Services may process encrypted execution-target credentials, scoped API keys, and managed-provider credentials. Secret values are protected and are not intended to be returned after initial creation. Customers should not include secrets in prompts, trace content, names, or free-form metadata.

Billing and usage information

We collect plan, subscription, payment-status, compute-credit, reservation, settlement, and measured usage information. Payment card details are handled by our payment processor and are not stored directly by Skhemata.

Website and device information

We may collect browser and device type, IP address, approximate location, referring page, pages viewed, security events, and cookie-related identifiers. Non-essential analytics are used only according to your cookie choice.

How we use information

• Provide, secure, maintain, and troubleshoot the Services.
• Authenticate users and enforce workspace roles, policies, limits, and tenant isolation.
• Run customer-authorized evaluations, managed compute, billing settlement, alerts, and reports.
• Process subscriptions, credit purchases, usage accounting, and related transactions.
• Send essential account, security, approval, billing, incident, and service communications.
• Respond to support and contact requests.
• Measure and improve the Services when analytics consent has been provided.
• Prevent abuse, investigate incidents, enforce our agreements, and comply with law.

We may use aggregated or de-identified information for analytics, capacity planning, reporting, security, and service improvement.

How we share information

We do not sell personal information. We may share information with:

• Cloud hosting, database, email, analytics, security, and customer-support providers.
• Payment processors such as Stripe for subscriptions and credit purchases.
• Customer-selected inference providers and execution targets when executing authorized requests.
• Managed-compute providers such as Runpod when a customer authorizes managed evaluation.
• Professional advisers and authorities when reasonably required for legal, security, or compliance purposes.
• A successor in connection with a merger, financing, reorganization, or sale of assets, subject to applicable law.

Customer content and model providers

When a customer directs Skhemata to send evaluation input to an execution target, model provider, or managed environment, that provider may process the input and output under the customer's agreement with that provider or the applicable provider terms. Workspace administrators control which targets, datasets, capture modes, and automation policies are used.

Data retention

We retain information for as long as reasonably necessary to provide the Services, preserve experiment and audit history, settle billing, enforce agreements, resolve disputes, maintain security, and meet legal, tax, accounting, or compliance obligations. Retention periods vary by record type and customer configuration. Runtime traces may be deleted according to customer retention settings, while promoted evaluation cases retain the reviewed snapshot required for historical reproducibility.

International processing

Skhemata is based in Canada. Information may be processed in Canada and in other countries where our service providers, customers, or customer-selected execution providers operate. Those countries may have different data-protection laws.

Security

We use reasonable administrative, technical, and organizational safeguards, including scoped authorization, encryption for supported stored credentials, and audit records. No system is completely secure. Customers are responsible for protecting their credentials, configuring appropriate capture settings, and controlling access to their workspaces and infrastructure.

Your choices and rights

• Update certain account, workspace, and notification settings in the application.
• Choose whether non-essential analytics cookies are enabled.
• Unsubscribe from optional marketing email while continuing to receive essential service messages.
• Request access, correction, deletion, or other privacy assistance, subject to applicable law and necessary business records.

Changes and contact

We may update this policy and will revise the effective date when we do. For privacy questions or requests, contact privacy@skhemata.com.