Privacy Policy

We use Your Personal Data to provide and improve the Service. We collect, use and disclose Your information as described in this Privacy Policy and, where required by applicable law, only where We have a valid legal basis to do so, including Your consent where consent is required.

The law this policy is written under

We are an Australian company, and Our handling of personal information is governed by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Where We handle the personal data of people in the European Economic Area or the United Kingdom, the GDPR and UK GDPR also apply, and this policy is written to satisfy both regimes at once — which is why it uses the words "controller" and "processor" alongside the Australian framing.

The two roles We act in

Operant sits between Your software and the model providers You already use. That means We handle two different kinds of information under two different roles, and this policy keeps them apart:

• As a controller, for people who visit this website and for the individuals who hold accounts with Us. We decide why and how that information is processed, and this policy is the notice for it.
• As a processor, for the traffic a Customer sends through the Gateway. That traffic belongs to the Customer, who is its controller. We process it on the Customer's documented instructions. Section 5 describes what We do with it; the binding terms are in the Customer's agreement with Us and, where one is in place, its Data Processing Agreement.

If You are an end user of a Customer's application and Your data reached Us through that Customer, We are not the right first point of contact. Please contact that Customer. We will assist them in responding to You.

1. Interpretation and definitions

The words whose initial letters are capitalized have the meanings defined below. The following definitions have the same meaning whether they appear in the singular or the plural.

• Account means a unique account created for You to access the Service or parts of the Service.
• Affiliate means an entity that controls, is controlled by, or is under common control with a party, where "control" means ownership of 50% or more of the shares, equity interest or other securities entitled to vote for election of directors or other managing authority.
• APPs means the Australian Privacy Principles in Schedule 1 to the Privacy Act 1988 (Cth).
• Company (referred to as "the Company", "We", "Us" or "Our") refers to Operant Pty Ltd ACN 701 597 239 of 330 Church Street, Parramatta, New South Wales 2150, Australia, trading as Operant.
• Cookies are small files placed on Your computer, mobile device or any other device by a website.
• Country/State refers to: New South Wales, Australia.
• Customer means the organization that has an account with Us and sends traffic through the Gateway.
• Customer Content means the prompts, messages, tool definitions, tool inputs, tool outputs and model responses that pass through the Gateway.
• Gateway means the Operant endpoint that Your software calls in place of a model provider's endpoint.
• Organization means a Customer's tenant in the Service. Every record We store about Customer Content belongs to exactly one Organization.
• Personal Data (or "Personal Information") is any information relating to an identified or identifiable individual. We use the two terms interchangeably unless a law uses a specific one.
• Provider means a model provider — for example Anthropic or OpenAI — whose API the Gateway calls on Your behalf.
• Service refers to the Website, the console at app.operantlabs.com, and the Gateway.
• Service Provider means any natural or legal person who processes data on behalf of the Company.
• Usage Data refers to data collected automatically, either generated by use of the Service or from the Service infrastructure itself.
• Website refers to Operant, accessible from https://www.operantlabs.com.
• You means the individual accessing or using the Service, or the company or other legal entity on behalf of which such individual is accessing or using the Service.

2. Who We are, and how to reach Us

The entity responsible for the handling described in sections 3 and 4 — the controller, in GDPR terms — is Operant Pty Ltd ACN 701 597 239 of 330 Church Street, Parramatta, New South Wales 2150, Australia.

• Privacy and rights requests: privacy@operantlabs.com
• Security and vulnerability reports: security@operantlabs.com
• Everything else: support@operantlabs.com

3. Website visitors

3.1 What is collected

Usage Data is collected automatically when You use the Service. It may include Your device's Internet Protocol address, browser type and version, the pages of the Service You visit, the time and date of Your visit, the time spent on those pages, unique device identifiers and other diagnostic data. Our hosting provider records this in server logs.

3.2 Cookies and tracking

This website sets no advertising, analytics or session-recording cookies. We run no third-party analytics on it. If that changes, this section changes first, and any non-essential cookie will be set only with Your consent, which You may withdraw at any time through Your browser or device settings. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

The console at app.operantlabs.com sets a necessary session cookie. It is what keeps You signed in and what prevents fraudulent use of Accounts. Without it the console cannot work, so it is set without consent, as the law permits for strictly necessary cookies.

3.3 Fonts

Pages of the Service load typefaces from Google Fonts (fonts.googleapis.com). Your browser therefore makes a request to Google when a page loads, and Google receives Your IP address and user-agent as part of it. We do not receive anything from Google in return, and no cookie is set by that request.

4. Account holders

When You create an Account We collect:

• Your email address and Your first and last name;
• a password, stored only as a one-way hash — never in a form We can read;
• where You sign in with Google or IBMid instead, the profile information that provider returns to Us, which is Your name, email address and provider identifier;
• the Organization You belong to and Your role in it;
• sign-in events, IP addresses and timestamps, kept for security;
• the API keys You create, stored as a one-way hash with a short display prefix, together with per-key call and spend counters.

Provider credentials. If You store a Provider's API key with Us so the Gateway can call that Provider on Your behalf, it is encrypted with AES-256-GCM before it is written down. It is decrypted only in memory, only to make a call You asked for, and it is never returned to the console or written to a log.

4.1 How We use it, and on what basis

Purpose	Basis
To provide, maintain and monitor the Service, and to manage Your Account	Performance of a contract
To contact You about Your Account, security, and changes to the Service	Performance of a contract
To manage Your requests to Us	Performance of a contract
To keep the Service secure and to investigate misuse	Legitimate interests
To meet legal, tax and accounting obligations	Legal obligation
To evaluate or conduct a merger, restructuring, or other transfer of Our assets	Legitimate interests

We do not sell Personal Data, We do not share it for cross-context behavioural advertising, and We do not use it for automated decision-making that produces legal or similarly significant effects.

We send marketing communications only where applicable law permits: where prior consent is required, only with Your consent; otherwise until You opt out. Every such message carries an unsubscribe link.

5. Traffic through the Gateway

This is the section that matters most, so it is the most specific. Read it before You point production traffic at Us.

5.1 What is never stored

The Gateway does not store request or response bodies as bodies. There is no column anywhere in Our schema that holds a raw HTTP payload, and nothing is written on the response path.

5.2 What is stored for every call

• The Organization, the Account and the API key the call was made on.
• Timestamps, latency, the Provider and model chosen, token counts, cache-hit counts and computed cost.
• A conversation identifier, so turns of the same conversation group together.
• Fingerprints — one-way SHA-256 hashes of normalized request shape. A fingerprint cannot be reversed into the text that produced it.
• The system prompt and tool definitions in full. These are configuration rather than conversation, but they are text, and if You put secrets or personal data in a system prompt We will have stored them.

5.3 What is stored once a workload repeats

This is on by default. When the same workload recurs five times, the Gateway escalates capture for that workload. From that point it stores, for that workload:

• the text of user messages and assistant replies;
• tool call inputs and tool call outputs in full;
• and it backfills the earlier turns of the same conversation.

This is how the Service learns a reusable skill for a repetitive workload, which is the thing that makes the bill fall. It is a deliberate trade of privacy for capability, and We would rather You read it here than discover it later. Stated plainly: for Your most repetitive workloads, full conversation and tool content is retained.

A Customer may ask Us to disable escalated capture, and We will confirm in writing when it is off and what scope the change covers. If You are evaluating Operant under a data protection review, raise this first — it decides most of the rest.

5.4 Redaction, and its limits

Before text is stored, We apply a redaction pass that masks common patterns — email addresses, credit card numbers and similar. Be clear about what that is and is not: it is pattern matching, not classification. It will not catch a name, an address, a medical detail, a customer identifier, or personal data phrased in prose, and a small number of stored fields do not pass through it at all. Do not treat it as anonymization, and do not rely on it to keep special-category data out of Our systems.

5.5 Customer Content sent to models for Our own processing

To summarize a workload, compute an embedding for it, judge a routing outcome or learn a skill, the Service sends Customer Content to a model. Those calls go to the same class of Provider Your own traffic goes to. This means Customer Content leaves Our systems for a Provider not only when You make a call, but also when We process what that call produced.

5.6 Tenant isolation

Every record described above belongs to exactly one Organization, and the database enforces that with row-level security rather than leaving it to application code. We do not use one Customer's content to serve another Customer, and learned artifacts do not cross Organizations.

5.7 What We do not do with Customer Content

• We do not train, fine-tune or distil any model that is offered to anyone else on Your Customer Content.
• We do not sell it, and We do not disclose it for advertising.
• We do not access it except to operate the Service, to investigate a fault or a security event, or where You ask Us to.

6. Sharing, and who else processes data

We may share Personal Data with Service Providers who process it on Our behalf, with Affiliates who are required to honour this policy, in connection with a merger, sale or financing, where You consent, and where the law requires it.

Sub-processor	What it handles	Where
Google Cloud Platform	Hosting, the managed database, object storage, logs	asia-south1 (Mumbai, India)
Anthropic	Model calls You direct to it, and Our internal summarization, embedding and judging calls	United States
OpenAI	The same, where selected	United States
A proxy You configure	Any additional Provider You point Us at. Where You configure it, You choose that recipient and are responsible for it	As You configure
Our email provider	Sign-up verification, invitations, sign-in links	As configured
Google Fonts	Typefaces, as described in section 3.3	Global

We will give Customers notice before adding a sub-processor that handles Customer Content, so that a Customer has an opportunity to object.

6.1 Law enforcement and other legal requirements

Under certain circumstances We may disclose Personal Data if required to do so by law or in response to valid requests by public authorities. We may also disclose it in the good-faith belief that doing so is necessary to comply with a legal obligation, to protect and defend Our rights or property, to prevent or investigate possible wrongdoing in connection with the Service, to protect the personal safety of users or the public, or to protect against legal liability. Where We are lawfully able to tell You about such a request before responding to it, We will.

7. Overseas disclosure

We are an Australian company, but the Service does not run on Australian infrastructure. Say it plainly, because APP 8 requires it said plainly:

• The Service is hosted in asia-south1 (Mumbai, India). Your information, including Customer Content, is stored there.
• Model calls, and the internal summarization, embedding and judging calls described in section 5.5, reach Providers in the United States.
• If You configure Your own proxy, You choose the recipient and the country it sits in, and You are responsible for that choice.

Under APP 8 We remain accountable for what an overseas recipient does with personal information We disclose to it, and We take reasonable steps to ensure each recipient handles it consistently with the APPs. Where We disclose the personal data of people in the EEA or the UK, We rely on the European Commission's and the UK's standard contractual clauses, together with the supplementary measures the circumstances require.

What this means for an Australian buyer. If Your procurement or data policy requires that Your data stay onshore in Australia, the Service as deployed today does not meet that requirement, and You should raise it with Us before You send production traffic. Do not read APP 8 accountability as data residency; they are different things.

8. Retention

We keep Personal Data only as long as necessary for the purposes set out in this policy, and to comply with Our legal obligations, resolve disputes and enforce Our agreements.

Category	Retention
Account and Organization records	For the life of the Account, then deleted on request
Sign-in and security logs	Up to 24 months
Server logs held by Our hosting provider	Per that provider's default retention
Call metadata and fingerprints	See the honest note below
Captured conversation and tool content (section 5.3)	See the honest note below
Support correspondence	Up to 24 months from closure

The honest note. The Service does not currently expire or purge call metadata, fingerprints or captured content automatically. There is no time-to-live and no scheduled deletion job, which means that in practice this data is kept until someone deletes it. We are building scheduled retention, and until it ships We delete on request, manually, within 30 days. We would rather write that sentence than imply a retention window We do not yet enforce.

9. Your rights

Under APP 12 and APP 13 You may ask Us for access to the personal information We hold about You, and ask Us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. Depending on where You live You may also have the right to delete it, to restrict or object to its processing, to receive it in a portable form, and to withdraw a consent You previously gave.

You may update or correct much of Your information yourself by signing in and visiting Your Account settings. For anything else, write to privacy@operantlabs.com. We will respond within 30 days, or sooner where the applicable law requires it. We may need to verify Your identity first, and We may need to retain certain information where We have a legal obligation or other lawful basis to do so. If We refuse a request We will tell You why in writing, and how to complain about that decision.

Complaints. If You are not satisfied with how We have handled Your personal information or Your request, write to privacy@operantlabs.com first — We will investigate and respond within 30 days. If You remain dissatisfied, You may complain to the Office of the Australian Information Commissioner at oaic.gov.au. If You are in the EEA or the UK, You may instead complain to Your local supervisory authority.

If Your data reached Us as Customer Content, the Customer controls it. Send Your request to that Customer; where We receive it directly We will pass it on and assist them in responding.

10. Security

The security of Your Personal Data is important to Us. Traffic to the Service is carried over TLS; passwords and API keys are stored only as one-way hashes; Provider credentials are encrypted with AES-256-GCM; and tenant isolation is enforced by the database rather than by application code.

But no method of transmission over the Internet, and no method of electronic storage, is 100% secure. While We strive to use commercially reasonable means to protect Your Personal Data, We cannot guarantee its absolute security.

If a breach happens. We will assess any suspected data breach promptly. Where a breach is likely to result in serious harm to any individual whose personal information is involved, the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth) requires Us to notify the affected individuals and the Office of the Australian Information Commissioner as soon as practicable, and We will. Where the GDPR or UK GDPR applies We will additionally notify the relevant supervisory authority within 72 hours of becoming aware of the breach. Where a breach affects Customer Content, We will notify the Customer without undue delay so that it can meet its own obligations.

11. Children's and minors' privacy

The Service is not directed to, and We do not knowingly collect Personal Information from, anyone under the age of 16. If You are a parent or guardian and You believe Your child has provided Us with Personal Information, please contact Us; if We become aware that We have collected it, We will remove it from Our servers as soon as reasonably possible. Where We rely on consent and the law applicable to a user sets an age higher than 16, We may require the consent of that user's parent or guardian.

12. Links to other websites

The Service may contain links to sites We do not operate. We have no control over, and assume no responsibility for, the content, privacy policies or practices of any third-party site or service. We advise You to review the privacy policy of every site You visit.

13. Changes to this policy

We may update this policy from time to time. We will post the new policy on this page, update the "Last updated" date at the top, and — where the change is material — tell You by email or by a prominent notice on the Service before it takes effect.

14. Contact Us

If You have any questions about this Privacy Policy, You can contact Us by email at privacy@operantlabs.com.

See also the Terms and Conditions.