Record L-01 · Legal

Privacy

What we hold, why we hold it, and what happens to the content you send.

Your account

EvalBook has no sign-in of its own. Your account lives with the Bookbag account service, which holds your name, email address, profile picture and the organizations you belong to. EvalBook stores a reference to that account; your name, email, picture, job title and timezone are read from the account service when a page needs them and are not copied.

Your project content

Traces, datasets, scorers, suites, reports, review annotations, proposals and impact records belong to your organization and are readable only by members with the project role that covers them. Authorization is checked on the server for every action, against the organization and project the row belongs to; another tenant’s row by id does not exist.

What you send, and what is kept

A span’s input and output are stored under the project’s capture policy — full, redacted, or metadata only — applied before anything is written. Redaction rules record which paths changed. Bodies above the inline limit are kept in your organization’s file store at the account service. Each content class (raw bodies, traces, results, cost records, audit metadata) has its own retention, enforced by a daily purge that writes a receipt. Deleting a trace removes every derived row and file, leaves a tombstone, and withdraws exports made before it.

What reaches a model

A model sees content only when a judge, a pairwise comparison, synthetic generation or an investigation asks for it, and only what the project’s external-judge policy allows; by default a judge may not read span bodies. Every call goes through the Bookbag account service, which meters it against your organization and records it in a ledger you can see. EvalBook holds no provider key and calls no provider directly.

What is kept about a run

Every evaluation, job, delivery and configuration change leaves rows: who asked, which versions were pinned, what each check reported, what was sent to a peer and when. The audit log is hash-chained per organization. This is what makes a report verifiable; it lives in your organization’s data and is removed with it.

Deletion

Archiving a project keeps it readable and restorable. Offboarding an organization revokes API keys, runner tokens and peer links and produces a receipt. Your Bookbag account is closed with the account service, which removes the identity every product refers to.

Contact

Questions about any of this go to hello@nurobook.com.