Privacy Policy
Who we are
Oversight Labs Limited (company number 17145488) is the controller of personal data described here. Our registered office is 61 Rodney Street, Liverpool L1 9ER, United Kingdom. Privacy enquiries: info@oversightlab.ai. Our registration with the Information Commissioner's Office (ICO) is in progress and we will publish the registration number here once it is confirmed.
What we collect
- Account details: your email address, chosen plan, number of seats and subscription status.
- Billing: payments are taken by Stripe. We receive a customer reference, subscription and payment status. We never see or store card numbers.
- Usage records: for each request, the mode used, token counts before and after, timing, whether a fallback was used, and an optional request reference you supply. These power your usage page and billing.
- API keys: we store only a one way hash of each key and its short prefix. We cannot recover a key after it is shown once.
- Message content: text you send to Athena is processed in memory to compress it. We do not store message content. Requests to the free measure tool are processed in memory and not stored.
- Provider keys: if you use the proxy, your own AI provider key is sent with each request, used once to call the provider you choose, and is never stored or written to logs.
- Sign in session: when you sign in to your account page we set one cookie,
ath_sess. It is strictly necessary to keep you signed in, is HttpOnly and secure, lasts up to 30 days or until you sign out, and is stored on our side only as a hash with its expiry. We use no advertising or analytics cookies. - Technical data: your IP address appears in our web server access logs, kept only for as long as needed to run and secure the service.
Why we use it and our legal basis
- To provide the service and bill you: performance of a contract.
- To keep the service secure, prevent abuse and fix faults: legitimate interests.
- To keep accounting and tax records: legal obligation.
Where your data comes from
Almost all of it comes from you when you sign up or use the service. Payment and subscription status come from Stripe. We do not buy personal data from other sources.
Automated decisions
We do not make decisions about you that have legal or similarly significant effects by automated means, and we do not profile you. Athena automatically compresses the content you send, but that does not make a decision about you.
Who receives your data
- Stripe, to take payments and manage subscriptions.
- Our hosting provider Fasthosts, which hosts our servers.
- The AI provider you choose (OpenAI, DeepSeek, OpenRouter or Google Gemini) when you send a proxy request. That provider processes the content under its own terms, and you agree those terms with it directly.
Where data is transferred outside the United Kingdom, we rely on UK adequacy regulations or, where there are none, the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
How long we keep it
UK GDPR requires us to keep personal data no longer than necessary for the purpose it was collected. We review what we hold against that rule.
- Account and billing records: while your account exists, then for six years to meet accounting obligations.
- Usage records: only as long as needed to show your usage, bill you and handle disputes.
- Web server logs: only as long as needed for security and fault finding.
- Sign in sessions: deleted when you sign out and in any case after 30 days.
- Message content and provider keys: not kept beyond the request.
Your rights
You can ask us for access, correction, deletion, restriction, portability or to object to processing, and you can withdraw consent where we rely on it. Contact info@oversightlab.ai. You can complain to the Information Commissioner's Office at ico.org.uk.
Security
We use encryption in transit, hashed API keys, signature checked webhooks and restricted server access. No system is perfectly secure, so please keep your keys private and revoke any you think are exposed.
Children
The services are not directed at anyone under 18.
Changes
We will post changes here and update the date above. For material changes we will tell account holders by email.