Privacy Policy

This Privacy Notice for ReasonBlocks Inc. (“we,” “us,” or “our”), describes how and why we might access, collect, store, use, and/or share (“process”) your personal information when you use our services (“Services”), including when you:

• Visit our website at reasonblocks.com or any website of ours that links to this Privacy Notice
• Use ReasonBlocks to capture requests or upload datasets, review evaluations, train candidate models, test outputs, and explicitly enable a limited traffic canary
• Engage with us in other related ways, including any marketing or events

This notice describes our handling of account, website, support, billing, and workflow information. When an organization submits data for a workflow, that organization determines what it submits and the processing it requests. If your information is in a customer's dataset or captured request, you can contact that organization or us about your request. Questions about this notice can be sent to sajeev@reasonblocks.com.

Table of Contents

1. 1. What Information Do We Collect?
2. 2. How Do We Process Your Information?
3. 3. What Legal Bases Do We Rely On to Process Your Personal Information?
4. 4. When and With Whom Do We Share Your Personal Information?
5. 5. Do We Use Cookies and Other Tracking Technologies?
6. 6. Do We Offer Artificial Intelligence-Based Products?
7. 7. How Do We Handle Your Social Logins?
8. 8. How Long Do We Keep Your Information?
9. 9. How Do We Keep Your Information Safe?
10. 10. Do We Collect Information from Minors?
11. 11. What Are Your Privacy Rights?
12. 12. Controls for Do-Not-Track Features
13. 13. Do United States Residents Have Specific Privacy Rights?
14. 14. Do We Make Updates to This Notice?
15. 15. How Can You Contact Us About This Notice?
16. 16. How Can You Review, Update, or Delete the Data We Collect from You?

1. What Information Do We Collect?

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Workflow content and credentials: Captured requests and uploaded datasets may contain personal or sensitive information, source code, or confidential business content. The capture gateway receives your provider credential to forward original provider traffic using your own key. Credential filtering is not anonymization and may not detect every secret or personal detail. Minimize and review what you send; do not submit content you are not authorized to share for the requested processing and training.

Optional saved-data filtering: Before collection begins, a data source can be configured to remove detected personal details or replace them with consistent, source-specific aliases. Filtering runs in our backend before saving training copies, without an additional model provider. Our backend receives the submitted content; original live requests still go unchanged to your original provider. Detection is best-effort, can miss personal information, and may affect training quality. Pseudonymized data is not guaranteed anonymous. These settings do not retroactively clean existing data or change account, billing or operational records.

Payment Data: Hosted checkout and billing services are provided by Stripe. Payment details entered in Stripe checkout go to Stripe. We receive information used to record purchases, payments, account credits, and billing activity; our application does not collect full card numbers or security codes through its own forms.

Information Automatically Collected

In Short: Some information — such as your IP address and/or browser and device characteristics — is collected automatically when you visit our Services.

When you use the website and APIs, service providers may receive your IP address, browser and device characteristics, request timing, referring URLs, pages visited, and diagnostic information. We also record run status, usage, credit reservations, errors, and administrative actions. These records can be personal information and may be associated with an account or organization. Website analytics are described in our Cookie Policy.

2. How Do We Process Your Information?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To facilitate account creation and authentication
• To capture or accept workflow data, prepare evaluations, and perform the training, evaluation, and candidate inference you request
• To record purchases, meter usage, reserve credits, enforce run budgets, and maintain billing and audit records
• To request feedback and to contact you about your use of our Services
• To identify usage trends and improve our Services
• To prevent abuse, investigate errors, manage access, and meet applicable legal obligations

3. What Legal Bases Do We Rely On?

In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason (i.e., legal basis) to do so under applicable law.

If you are located in the EU or UK, the General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on in order to process your personal information:

• Consent: for processing where consent is required. You may withdraw consent for future processing.
• Performance of a Contract: to provide your account and requested services and administer billing.
• Legitimate Interests: to secure, maintain, and support our service, where those interests are not overridden by your rights.
• Legal Obligations: to comply with applicable recordkeeping, tax, and legal requirements.

If you are located in Canada, we may process your information if you have given us specific permission (express consent) to use your personal information for a specific purpose, or in certain situations where we can infer consent.

4. When and With Whom Do We Share Your Personal Information?

In Short: Service providers process information to deliver the hosted service; other disclosures may be needed for legal or business purposes.

Supabase provides authentication, Postgres metadata, and private artifact storage in the rb-pipeline-private bucket. Render hosts the API and worker that process requests and jobs and produce service logs. Tinker, provided by Thinking Machines Lab, receives training and evaluation inputs for remote on-policy distillation (OPD), model inference, and checkpoint storage. OpenAI or Anthropic receives original provider traffic forwarded using your own provider key. Stripe processes payments. Google provides optional Google sign-in and website analytics as described in our Cookie Policy. These providers process information under the applicable service settings and agreements.

Authorized members of your organization can access workflow information according to their roles, and authorized service administration may access information to operate and support the service. Information may be processed outside your country of residence. This notice does not promise a particular hosting region or that all providers process data only in one country. Contact us about the arrangements relevant to your use.

We may also need to share information in the following situations:

• Business Transfers — we may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company
• Affiliates — we may share your information with our affiliates, in which case we will require those affiliates to honor this Privacy Notice
• Legal and security purposes: to comply with applicable law or valid legal process, protect rights, investigate misuse, or address security issues

5. Do We Use Cookies and Other Tracking Technologies?

In Short: We may use cookies and other tracking technologies to collect and store your information.

The website uses local storage for Supabase authentication, theme and privacy preferences, and session storage for account and transaction state. Optional Google Analytics is enabled for this website. When enabled, it loads only after you accept, on selected public pages. Private platform routes and URLs with query strings or fragments are excluded. You can change your choice in Cookie preferences. Details and browser controls are described in our Cookie Policy.

6. Do We Offer Artificial Intelligence-Based Products?

In Short: We offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies.

We use submitted or captured workflow content to prepare evaluations and, after your explicit evaluation approval and subject to available credits and a run budget, train and evaluate a candidate model using Tinker. Candidate testing and an explicitly enabled traffic canary also involve remote inference. This processing can include prompts, messages, tool content, and feedback that contain personal information. Original provider traffic uses your own provider account and its terms. Evaluation results and fallback mechanisms do not guarantee that every outcome is correct or that unfamiliar requests will be detected.

7. How Do We Handle Your Social Logins?

In Short: If you choose to register or log in to our Services using a social media account, we may have access to certain information about you.

Our sign-in page offers email and password authentication and optional Google sign-in through Supabase. When you choose Google sign-in, we receive account information made available for authentication, which may include your name, email address, and profile picture. Google's own privacy notice governs its handling of information.

We will use the information we receive only for the purposes described in this Privacy Notice. Please note that we do not control, and are not responsible for, other uses of your personal information by your third-party social media provider. We recommend that you review their privacy notice to understand how they collect, use, and share your personal information.

8. How Long Do We Keep Your Information?

In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless otherwise required by law.

We keep account information, workflow datasets and captures, evaluation reports, and billing and audit records for the purposes described in this notice. Retention depends on the information, the service activity, support and security needs, and applicable legal or accounting requirements. Some records may remain after an account closes. There is no universal automatic deletion period for all pipeline artifacts.

Model checkpoints have configured lifetimes. Their expiry does not delete related datasets, logs, reports, or provider records. Contact us to request deletion or ask about retention for your workflow. We delete information when it is no longer needed for the purposes described here, subject to applicable requirements and exceptions. Provider systems and backups may have separate handling periods; we do not offer zero retention or an instant account-wide purge.

9. How Do We Keep Your Information Safe?

In Short: We aim to protect your personal information through a system of organizational and technical security measures.

The service uses authentication, organization membership and role checks, and private artifact storage accessed through the backend. Credential filtering can reduce exposure of known secrets but is not anonymization. No electronic transmission or storage system can be guaranteed secure. The Trust page describes the current architecture without making a certification or security guarantee.

10. Do We Collect Information from Minors?

In Short: We do not knowingly collect data from or market to children under 18 years of age.

The Services are intended for adults aged 18 or older, consistent with our Terms of Use. We do not knowingly solicit accounts from or market to children. If you believe a child has provided personal information, contact us so that we can investigate and take appropriate action.

11. What Are Your Privacy Rights?

In Short: Depending on your state of residence in the US or in some regions, such as the European Economic Area (EEA), United Kingdom (UK), Switzerland, and Canada, you have rights that allow you greater access to and control over your personal information.

In some regions (like the EEA, UK, Switzerland, and Canada), you have certain rights under applicable data protection laws. These may include the right to request access and obtain a copy of your personal information, to request rectification or erasure, to restrict the processing of your personal information, and if applicable, to data portability. In certain circumstances, you may also have the right to object to the processing of your personal information.

Withdrawing your consent: If we are relying on your consent to process your personal information, you have the right to withdraw your consent at any time. You can withdraw your consent by contacting us at sajeev@reasonblocks.com.

Account Information: You can update supported account fields in account settings. Contact us for access, correction, portability, or deletion requests, including account closure. We may need information to verify your identity and authority. Exceptions may apply to records needed for fraud prevention, investigations, legal claims, or applicable recordkeeping. You may also complain to your local data protection authority where that right applies.

12. Controls for Do-Not-Track Features

Browser signals such as Do Not Track (DNT) and Global Privacy Control (GPC) keep our optional analytics integration off, even if a saved preference previously allowed it. You may also reject analytics in Cookie preferences. These controls affect future collection through our integration; they do not delete information already sent to a provider or prevent storage needed for account functions.

13. Do United States Residents Have Specific Privacy Rights?

In Short: If you are a resident of certain US states, you may have the right to know what personal information we collect, request its deletion, and opt out of certain processing activities.

Depending on where you live and whether the relevant law applies, you may have rights over the information described here. The current service processes identifiers and account details, commercial and credit records, internet or network activity, and the contents of submitted workflows. Workflow content may include additional categories, including sensitive information, depending on what you submit.

Section 1 describes what we collect, Section 2 describes the purposes, Section 4 identifies recipients, and Section 8 explains retention. We do not currently serve targeted advertising on this website. Google Analytics is configured for website measurement; its collection and your available controls are described in the Cookie Policy.

We may also collect other personal information outside of these categories through instances where you interact with us in person, online, or by phone or mail in the context of receiving help through our customer support channels, participation in customer surveys or contests, and facilitation in the delivery of our Services and to respond to your inquiries.

Your rights: You may have the right to request access to your personal information, details about how we have processed it, correct inaccuracies, delete your personal information, receive a copy in a portable format, opt out of the sale or sharing of personal information, and limit the use of sensitive personal information. We will not discriminate against you for exercising your rights.

To exercise these rights, you may contact us at sajeev@reasonblocks.com. We will respond to your request within the timeframes required by applicable law.

14. Do We Make Updates to This Notice?

In Short: We may update this notice when our practices or the service change.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated “Last updated” date at the top of this Privacy Notice. If we make material changes to this Privacy Notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.

15. How Can You Contact Us About This Notice?

If you have questions or comments about this notice, you may email us at sajeev@reasonblocks.com or contact us by post at:

16. How Can You Review, Update, or Delete the Data We Collect from You?

Based on the applicable laws of your country or state of residence in the US, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. To request to review, update, or delete your personal information, please contact us at sajeev@reasonblocks.com.