Privacy Policy
1. Who we are
Octavia Works is operated by Sankhya Ventures, LLC ("Sankhya Ventures," "we," "us," or "our"), a Delaware limited liability company with a registered address at 2810 N Church St. Ste. 40809, Wilmington, DE 19802, United States.
For the purposes of the EU General Data Protection Regulation ("GDPR") and the UK GDPR, Sankhya Ventures, LLC is the data controller of personal data processed through Octavia Works, except where a separate written agreement expressly provides that we act as a processor on behalf of a business customer.
2. Scope
This Policy explains how we collect, use, disclose, and protect personal data when you use the Octavia Works website and service (the "Service"). It applies to visitors, registered users, and anyone whose data we process in connection with the Service. It does not apply to third-party websites or services we link to, including Google, Stripe, our AI infrastructure providers, Google Analytics, and Meta, each of which maintains its own privacy policy.
3. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Account & identity data | Name, email address, profile picture, unique Google account identifier | Google Sign-In, provided when you authenticate |
| Profile preferences | Preferred name, work description, standing instructions, appearance/font settings | Provided by you in My Account |
| Usage, query & response data | Prompts, instructions, conversations, responses, generated files, timestamps, token counts, per-query cost, ratings, revisions and downloads | Provided by you and generated as you use the Service |
| Uploaded content | Documents, PDFs, images, spreadsheets, text files, code, metadata, filenames and other materials you submit | Uploaded or otherwise provided by you |
| Extracted & derived data | Extracted text, document structure, tables, transcriptions, summaries, annotations, classifications, labels, embeddings, vectors, indexes, evaluations, preference data, synthetic data and other transformations | Generated from your content and interactions |
| Billing data | Wallet balance, transaction history, invoice records; not full card numbers | Generated by the Service; card details are handled entirely by Stripe |
| Technical & consent data | IP address, browser type, device information, logs, consent records, Terms and Privacy Policy versions, timestamps and security events | Automatically collected by us and Cloudflare, our hosting provider |
| Optional analytics data | Page viewed, approximate location, referrer, browser/device information and interaction events that do not contain query text | Collected by Google Analytics only if you turn on the Analytics category in Cookie choices |
| Optional advertising data | Page viewed, page address, referrer, IP address, browser/device information, and an advertising identifier stored in the _fbp cookie. Does not contain the text of your requests, files or responses | Collected by the Meta Pixel only if you turn on the Advertising and retargeting category in Cookie choices |
How we handle your requests, files, conversations and responses
We retain the content of requests, uploaded files, extracted file content, conversations, responses, generated files, feedback, and related Interaction Data for an indefinite period. We use this information to operate, secure, evaluate, research, and continually improve the Service; maintain billing and transaction records; develop datasets and evaluation materials; and develop, train, fine-tune, retrain, test, validate, benchmark, and improve artificial-intelligence and machine-learning models and systems operated by us or on our behalf.
These model-development and training purposes are continuing purposes and are not limited to producing the particular response you requested. Information may remain stored after a query is completed, after you stop using the Service, and after account closure, subject to non-waivable rights and obligations under applicable law.
Access may be provided to authorized personnel, contractors, and service providers for processing, review, annotation, quality evaluation, security, and model development. We do not sell your requests, uploaded files, conversations or responses, and their content is never shared with analytics or advertising partners.
Separately from the content above: if you turn on the Advertising and retargeting category described in section 7, limited browsing information is shared with Meta for advertising measurement, audience creation and retargeting. Under some privacy laws, including the California Consumer Privacy Act as amended, that sharing is itself treated as a “sale” or “share” of personal information for cross-context behavioural advertising. It does not occur unless you opt in, it never includes the content of your requests, files or responses, and you can withdraw it at any time.
4. How we use personal data, and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Authenticate you and maintain your account | Performance of a contract |
| Process your queries and uploaded files through our AI pipeline, extract or convert file content, and return a response | Performance of a contract |
| Store and maintain query, conversation, file, response and derived-data history | Performance of a contract; legitimate interests; consent where required by applicable law |
| Apply your saved preferences and instructions to personalize responses | Performance of a contract; consent (you choose to set these) |
| Calculate usage, maintain your wallet balance, and process payments | Performance of a contract |
| Generate invoices, including a brief AI-written description of a billing session | Performance of a contract; legal obligation (recordkeeping) |
| Create extracted text, annotations, labels, embeddings, indexes, datasets, benchmarks, evaluations and other Derived Materials | Performance of a contract; legitimate interests; consent where required by applicable law |
| Develop, train, fine-tune, retrain, test, benchmark, validate, secure, commercialize and improve current and future AI models, systems and services | Performance of a contract; legitimate interests; consent where required by applicable law |
| Conduct authorized human and automated review for quality, safety, annotation, evaluation, fraud prevention and model development | Legitimate interests; consent where required by applicable law |
| Understand site traffic and improve onboarding through optional Google Analytics (Analytics category) | Consent |
| Measure advertising performance, create and refine audiences, and show you Octavia Works advertising on Meta services after you visit (Advertising and retargeting category) | Consent |
| Detect, prevent, and investigate fraud, abuse, or security incidents | Legitimate interests |
| Comply with legal obligations (tax, accounting, lawful requests) | Legal obligation |
5. How your requests and files are processed
Octavia Works uses a multi-stage AI processing pipeline. Submitting a query or file may cause its content, extracted text, images, document structure, metadata, saved preferences, conversation context, and related instructions to be sent to one or more AI, cloud-computing, storage, analytics, security, or processing providers. Files may be converted, parsed, segmented, indexed, embedded, summarized, analyzed with code, or otherwise transformed before or during processing.
We may store original files and extracted or transformed versions in our infrastructure, including Cloudflare databases and object storage. We may use automated systems and authorized personnel, affiliates, contractors, and service providers to review, label, annotate, classify, evaluate, and otherwise process content and outputs for quality, security, safety, support, research, dataset creation, and AI model development and training.
We do not control the internal operation of third-party models or infrastructure, but we use contractual, organizational, and technical safeguards appropriate to the services involved. Third-party providers may process data in accordance with their contracts with us and applicable law.
A short, separate AI-generated description of what a billing session was used for (for invoicing purposes only) may be created using a separate process from the one that answers your queries and is generally written without reproducing the full original content.
6. Data retention
We retain information for as long as it remains useful for a purpose described in this Policy. Because service operation, security, recordkeeping, research, dataset development, model evaluation, and AI model training and improvement are continuing purposes, retention may be indefinite.
| Data | Retention |
|---|---|
| Requests, conversations, responses and generated files | May be retained indefinitely, including after account closure, for service operation, research, security, evaluation, dataset creation, AI model training and improvement, and legal purposes |
| Uploaded files and original content | May be retained indefinitely in object storage, databases, archives, backups and model-development environments, unless we choose or are legally required to delete or suppress them |
| Extracted text, embeddings, annotations, labels, indexes, datasets and other Derived Materials | May be retained indefinitely and may remain after deletion of an account or original file, to the fullest extent permitted by law |
| AI models, parameters, weights and evaluation systems | Retained for the useful life of the applicable system or indefinitely; we do not undertake to retrain, unlearn, destroy or modify a system because information was previously used in its development, except where applicable law expressly requires otherwise |
| Invoice records (summary description, amount, date) | Retained for the lifetime of your account plus the period required by applicable tax, accounting and legal requirements |
| Account & profile data | Retained while the account is active and thereafter as needed for the purposes in this Policy, subject to applicable law |
| Wallet & transaction ledger | Retained for the lifetime of your account plus the period required by applicable financial recordkeeping law |
| Technical, consent and server logs | Retained for operational, security, evidentiary and compliance purposes for periods determined by us and our infrastructure providers |
Information may exist in multiple forms and locations, including active systems, object storage, conversation databases, training and evaluation datasets, indexes, vector databases, archives, backups, logs, disaster-recovery systems, and models. We may delete, deidentify, aggregate, quarantine, or exclude information in our discretion, but do not promise routine deletion.
7. Cookies, similar technologies, and your choices
We use cookies, local storage and similar technologies in three categories. Essential is always active. Analytics and Advertising and retargeting are optional and are off until you turn them on: nothing in those categories loads, and no cookie in them is set, before you make a choice. The same categories and the same defaults apply to every visitor, in every country — we do not vary them by location.
7.1 Essential — always active
To keep you signed in, protect the Service against abuse, remember interface preferences such as theme and chat font, and record the cookie choices you make, the Service stores a small amount of data in your browser's local storage. This is required for the Service to function, is never used for advertising, and cannot be switched off.
7.2 Analytics — optional
If you turn this category on, we use Google Analytics 4, provided by Google LLC, to understand page traffic, onboarding and broad product interactions. Nothing is loaded from Google Analytics until you consent. It sets cookies including _ga and _ga_<identifier>, and may set _gid. We configure it without Google Signals and without ad-personalisation signals, and we do not send the text of your requests, files or responses as analytics events.
7.3 Advertising and retargeting — optional
If you turn this category on, we use the Meta Pixel, provided by Meta Platforms, Inc. Nothing is requested from Meta, and no Meta cookie is set, until you consent.
Once enabled, the pixel records a PageView event each time you open a page of the Service. That event carries the page address, the referring page, your IP address, and browser and device information. It sets cookies including _fbp, an advertising identifier for your browser, and _fbc if you arrived through a Meta advertisement. It does not carry the text of your requests, uploaded files, conversations or responses.
We and Meta use this information to:
- Advertising measurement — understand which advertising leads to visits and sign-ups, and report on campaign performance;
- Audience creation — build audiences of people who have visited the Service, and audiences of people who resemble them, for future advertising;
- Personalised advertising and retargeting — show you Octavia Works advertising on Facebook, Instagram and other Meta services after you have visited us.
For its own advertising purposes Meta acts as an independent controller, and its processing is governed by its own policies. Under some privacy laws, including the California Consumer Privacy Act as amended, enabling this category constitutes a “sale” or “share” of personal information for cross-context behavioural advertising. Turning the category off stops the pixel and deletes the _fbp and _fbc cookies from your browser.
7.4 Changing or withdrawing your choices
The Cookie choices link in the footer of every page reopens the preference centre, where you can turn either optional category on or off at any time. Withdrawing consent takes effect immediately: we stop the relevant technology and delete the cookies it set. Withdrawal applies going forward and does not affect processing already carried out while consent was in place. Information already shared with Google or Meta is subject to their own policies and controls, linked below. You can also block or delete cookies through your browser settings, and use browser or operating-system signals that limit tracking.
7.5 Third parties that set their own cookies
When you sign in with Google or complete a payment through Stripe Checkout, those providers may set their own cookies on their own domains, governed by their own privacy and cookie policies:
8. Who we share data with
We share personal data with the following categories of recipients, each acting as our processor or, where noted, as an independent controller for their own purposes. Apart from the optional advertising sharing described in sections 3 and 7 — which occurs only if you turn on the Advertising and retargeting category, and never includes the content of your requests, files or responses — we do not sell personal data or share it with third parties for their own marketing purposes.
| Provider | Purpose | Data involved |
|---|---|---|
| AI infrastructure providers | Processing, model inference, content analysis, extraction, evaluation, safety and related Service functions | Queries, conversations, uploaded and extracted content, preference context, metadata, generated work product and related Interaction Data |
| Cloudflare, Inc. | Hosting, databases, object storage, content delivery, security and serverless computing | All Service data, including files and Derived Materials, in transit and at rest |
| Authorized reviewers, contractors and annotation providers | Quality review, annotation, classification, evaluation, support, security, research and model development | Relevant User Content, Interaction Data, Derived Materials and outputs |
| Stripe, Inc. | Payment processing (independent controller) | Payment details, billing email |
| Google LLC | Authentication (independent controller) | Name, email, profile picture, account identifier |
| Google Analytics (Google LLC) | Optional website analytics, only with Analytics consent | Page, referrer, approximate location, browser/device data and non-content interaction events |
| Meta Platforms, Inc. | Optional advertising measurement, audience creation and retargeting via the Meta Pixel, only with Advertising and retargeting consent (independent controller for its own advertising purposes) | Page address, referrer, IP address, browser/device data, PageView events and the _fbp advertising identifier |
We may also disclose personal data where required by law, to protect our legal rights, or in connection with a merger, acquisition, or sale of assets, subject to standard confidentiality protections.
9. International data transfers
We and our service providers are based in, or process data in, the United States. If you are located in the European Economic Area, the United Kingdom, or Switzerland, your personal data will be transferred outside of those regions. Where required, such transfers are made subject to appropriate safeguards, such as the European Commission's Standard Contractual Clauses, or reliance on a provider's own certified transfer mechanism.
10. Your rights
Depending on your location, you may have some or all of the following rights regarding your personal data:
- Access — request a copy of the personal data we hold about you.
- Rectification — request correction of inaccurate or incomplete data.
- Erasure — request deletion of your personal data, subject to legal retention requirements.
- Restriction — request that we limit how we use your data in certain circumstances.
- Portability — request your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interests.
- Withdraw consent — where processing is based on consent, withdraw it at any time. For analytics and advertising, use the Cookie choices link in the footer of any page: turning a category off stops the relevant technology and deletes the cookies it set.
- Lodge a complaint — with your local data protection supervisory authority, if you believe we have not handled your data lawfully.
To exercise any of these rights, contact us at support@octaviaworks.com. We may verify your identity and authority before acting and will respond within the timeframe required by applicable law.
These rights are subject to applicable exceptions and limitations. A withdrawal or deletion request applies prospectively and does not affect the lawfulness of processing completed before the request. Unless applicable law expressly requires otherwise, a request does not require us to delete deidentified, aggregated, or non-personal information; delete records required for security, fraud prevention, legal compliance, dispute resolution, or enforcement; remove information from backups before their ordinary retirement; transfer ownership of Derived Materials; or retrain, unlearn, destroy, modify, or cease using an AI model or system developed before the request. Where requested processing is necessary to provide the applicable version of the Service, exercising a right may require closure or restriction of the account.
11. Data security
We use technical and organizational measures designed to protect personal data, including encryption in transit, access controls, and reliance on infrastructure providers that maintain industry-standard security certifications. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
12. Children's privacy
The Service is not directed to, and is not intended for use by, anyone under the age of 18. We do not knowingly permit children to create accounts. Users must not submit a child's personal data unless they possess all legally required authority and the submission has been expressly permitted by us. If you believe a child has provided us with personal data without authorization, contact us.
13. Changes to this Policy
We may update this Policy from time to time. If we make material changes, we will update the "Last updated" date above and may provide notice through the Service, by email, or by requiring renewed acceptance. Continued use of the Service after changes take effect constitutes acceptance of the revised Policy to the fullest extent permitted by law. Where applicable law requires affirmative consent before a materially expanded purpose applies to previously collected personal data, we will seek that consent before applying the expanded purpose to such data.
14. Contact us
Sankhya Ventures, LLC
2810 N Church St. Ste. 40809
Wilmington, DE 19802, United States
Email: support@octaviaworks.com