Privacy policy
This policy explains what Observo Labs collects when you use the service at app.observolabs.com, why, who else handles it, and what you can ask us to do. We have tried to describe what the service actually does today, in plain language. The service is a beta.
Who we are#
The service is operated by Observo Labs (“we”, “us”). Operating entity: [Operating legal entity and registered address: to be completed by the owner]
Questions about privacy go to privacy@observolabs.com.
What we collect#
Account and sign-in
You sign in through Clerk, our authentication provider. Clerk holds your email address, name and sign-in method (email, or Google), and your organization memberships. Our own database does not store your email address or name. It stores your Clerk user ID, a placeholder address that is not your real email, the ID and short name (“slug”) of your organization, and your role (admin or member).
API keys
When an admin creates an API key, we show it once. We store only a SHA-256 hash of it, its first few characters, its name, its role, its expiry and when it was last used. We cannot recover the key.
What you submit
The jobs you run: the job type, the payload you send, runtime limits, progress events, results, error messages, and the files and artifacts you upload or that your jobs produce. This content belongs to you (see the Terms).
Spend and payments
A ledger of reservations and settled spend for each job, your credit purchases and adjustments, and identifiers from Stripe (customer, checkout session and payment intent IDs, amounts and currency). Card numbers are entered at Stripe and are never sent to or stored by us.
Audit log
A record of administrative and security-relevant actions (for example creating or revoking an API key, creating a job, requesting a file link, billing events): who did it, when, what it affected, and some detail about the action.
Technical data
Our servers handle your IP address to rate-limit requests and to keep structured access logs (time, route, status, request ID and IP address). Access logs do not include query strings, request headers or file links.
We do not use advertising or analytics trackers in the console.
Signing in with Google#
If you choose Google sign-in, Google shares basic profile information (your name, email address and profile picture) with Clerk, which creates your account. We use it only to identify you and let you sign in. We do not request access to your Gmail, Drive, Calendar or other Google data. We do not sell Google user data, use it for advertising, or transfer it except to the providers listed below as needed to run the service.
How we use it#
- to authenticate you and enforce who in your organization may do what;
- to run the jobs you submit, and store and return their results and files;
- to meter spend, sell and account for prepaid credits, and handle refunds and disputes;
- to keep the service secure, prevent abuse and enforce rate limits;
- to investigate problems and respond to your requests.
We do not sell personal information.
Where it is processed and stored#
We rely on the following service providers (subprocessors). Each handles data only as needed to provide its part of the service.
| Provider | Purpose | Data involved |
|---|---|---|
| Railway | Application hosting, PostgreSQL database, application logs | Account identifiers, job data, billing records, access logs |
| Cloudflare (R2) | Object storage for artifacts and files you upload | Files and job outputs you store |
| Clerk | Sign-in, sessions, organizations and membership | Email address, name, sign-in method, organization membership, and the IP address and device details Clerk uses for sessions |
| Optional sign-in with a Google account (through Clerk) | Basic profile information you approve at sign-in | |
| Stripe | Payments for prepaid credits | Payment and billing details you enter at Stripe checkout; purchase records |
| Modal | Compute that runs your jobs, when compute jobs run | The job you submit (type, payload, runtime settings) and its outputs while it runs |
Your data may be processed in the United States and in other countries where these providers operate. Jobs run on Modal only when compute jobs run; during the beta that may not always be available.
Data is isolated per organization: database rows are protected by row-level security so one organization’s requests cannot read another’s, and stored files live under a per-organization path.
How long we keep it#
We keep records for as long as the account and the service need them. In particular:
- The audit log is append-only. Entries cannot be edited or deleted by the application.
- The spend ledger and credit purchase and adjustment records are never deleted by the application.
- Users and organizations are disabled, not erased. If you delete your Clerk account or are removed from an organization, your access and the API keys you created stop working. If an organization is deleted, its access stops, queued jobs are cancelled and running jobs are asked to stop. In every case its jobs, ledger rows and stored files remain in our systems.
- Jobs, their events and results, and stored files have no automatic expiry today, and there is no self-service delete for them yet.
- Revoked API keys keep their (hashed) record.
- Access logs are kept by our hosting provider under its own log retention.
Because there is no automated deletion, deleting your data on request is handled manually by us (see Your choices and rights). We may need to keep some records, such as billing and ledger entries and the audit log, where required by law or for security and accounting.
Security#
- Traffic to the service uses HTTPS, and the service sends an HSTS header.
- API keys are random, shown once, and stored only as hashes.
- Row-level security in the database separates organizations, and the web process does not hold database owner credentials.
- Rate limits apply per IP address, per API key and per organization.
- Webhooks from Stripe and Clerk are accepted only with a verified signature.
- File links are short-lived (at most 15 minutes) and limited to your organization’s path.
- Logs redact tokens, keys and file-link signatures.
- The console sets a strict Content Security Policy and loads no third-party fonts or analytics.
No system is perfectly secure, and we cannot guarantee absolute security. We do not claim any security certification or audit.
Cookies and browser storage#
The console itself sets no cookies. It saves your light or dark theme choice in your browser’s local storage under the key console-theme. Clerk, our sign-in provider, sets its own cookies and browser storage to keep you signed in and to protect sign-in from bots; these are needed for the service to work. We do not use advertising cookies.
Your choices and rights#
You can ask us to give you a copy of, correct, or delete the personal data we hold about you, or to export your organization’s data, by emailing privacy@observolabs.com from the address on your account. We will check it is you, handle the request by hand, and tell you if we must keep something and why. Depending on where you live you may have further rights under local law, and you may complain to your local data protection authority.
Organization admins can revoke API keys at any time. You can change your name and email at Clerk through your account menu.
Children#
The service is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has an account, contact us and we will act on it.
Changes#
We may update this policy. The date and version at the top show the latest change. For significant changes we will take reasonable steps to tell account holders.