Privacy policy

The short version

We hold the minimum needed to run your account and your workloads. Your training data is used for the runs you start and for nothing else — it is not used to train any model of ours, and it is never shared with another customer or published.

What we hold

Account data. Your email address, the organisation it belongs to, and the API keys you create. There are no passwords, because sign-in is a single-use link.

Workload data. Datasets you upload, validation reports, checkpoints, trained weights, logs, metrics and evaluation artefacts. These live under a prefix scoped to your tenant.

Usage and billing records. What was consumed, when, and under which pricing revision. Payment details are handled by our payment processor; we do not store card numbers.

Audit records. Consequential actions — keys created and revoked, models deployed and retired, limits changed, data deleted — written to an append-only log.

What we do not do

We do not train models on your data. We do not sell or share it. We do not use it to improve a shared model, a base model, or anything offered to another customer. Publishing a model pushes weights and a model card only — datasets are never included, and publishing never happens without an explicit call from you.

Retention and deletion

Workload data is retained while your account is active and you keep it. You can delete a data asset and its derived artefacts at any time, and deletion is recorded in the audit log. Billing records are kept for as long as tax and accounting obligations require.

Sub-processors

Running this service requires third parties for compute, storage, payments and email delivery. We do not publish the list of compute providers publicly; it is available under a security review or an enterprise agreement, and the obligations we impose on them travel with your data regardless.

Your rights

You can ask what we hold about you, ask for it to be corrected, ask for it to be deleted, and ask for an export. Write to hello@onrup.com and we will respond within thirty days.

Changes

If this policy changes in a way that affects how your data is handled, we will say so before the change takes effect rather than after. The date at the top is the effective date.