Privacy Notice

Effective 20 August 2026 · Version 2026-08-19

1. Who we are

COVIBES LABS AS, doing business as The Open Engine Company, organization number 937 377 266, is the controller for the account, billing, security, website, and business-administration processing described here. Its address is Romsdalveien 78, 9537 Tverrelvdalen, Norway. Contact legal@theopenengine.com about privacy.

When we process data inside Customer Content solely to provide the Service on a business customer’s instructions, that customer is the controller and we are its processor. The DPA governs that processing, and requests about it should normally go to the customer.

2. Scope

This Notice covers Zeroshot Cloud websites, accounts, APIs, command-line tools, support, billing, and invitations. The Service is intended for people acting in a business or professional capacity and is not directed to children.

Third-party identity, payment, model, source-control, and cloud services have their own privacy notices for processing they control.

3. Data we handle

We receive data from users, customer administrators, identity providers, connected services, payment providers, and normal use of the Service. An invitation address is supplied by the inviting customer, used for one delivery attempt, and not persisted by Company.

Account data: name, email address, avatar, identity-provider identifiers, and account settings.
Organization data: organization name, memberships, roles, invitations, and administrative actions.
Technical data: session and device labels, IP address or prefix, user agent, timestamps, logs, and audit records.
Service data: run names, status, usage, metering, inputs, code, prompts, results, and connection metadata.
Connection data: encrypted credentials or references for integrations Customer chooses to connect.
Billing data: plan, usage, billing contact, tax details, provider identifiers, invoices, and payment status. Our payment provider, not Company, collects full payment-card details.
Communications: support messages, legal or abuse reports, feedback, and invitation recipient addresses.

4. Why we use it

Our legitimate interests are operating a secure B2B service, supporting customers, preventing abuse, improving reliability, and managing our business. We balance those interests against individual rights and do not use this basis where those rights override our interests.

Identity, authentication, billing, and Service data marked as required are needed to create an account or provide the requested Service. Without them, we cannot provide the relevant account, transaction, or feature; other data is optional unless we say otherwise.

Provide accounts and the Service — contract where the user is the customer; otherwise legitimate interests.
Administer organizations, support users, and communicate service information — legitimate interests and contract.
Measure usage, bill customers, and keep financial records — contract and legal obligations.
Protect accounts, investigate abuse, prevent fraud, and maintain reliability — legitimate interests and law.
Handle legal or abuse reports, comply with legal requests, and enforce agreements — legal obligations and legitimate interests.
Improve the Service using limited telemetry and feedback — legitimate interests, not Customer Content training.

6. Locations and international transfers

Company stores and primarily processes Service data, including account data and Customer Content, in AWS regions in the European Union. Support may access data from Norway and the European Union. AWS and customer-selected providers may process data in other countries as described below.

Processor-side subprocessor entities, locations, and safeguards are listed in DPA Schedule 3. Stripe Payments Europe, Limited (Ireland) and its affiliates process payment and billing data in the EEA, United States, and other countries under Stripe’s DPA and Data Transfers Addendum. Stripe acts as a processor for some processing and as an independent controller for other processing. Customer-selected identity and connected-service providers are subject to their own transfer terms. Contact us for a copy of an applicable safeguard.

7. Retention

We keep each category only for the period below, then delete or de-identify it unless law requires more:

Deleting a user removes the live user and memberships but may leave organization-level run and audit records without the live account identifiers, for the applicable period listed here. Deletion from backups follows the backup cycle.

Account records, identities, and memberships: deleted when a successful account-deletion request completes; account-bound connection credentials are then removed through retrying cleanup.
Organization data: while active; after closure, organization-level run and audit records follow the metadata period below without live account identifiers.
Run input: scrubbed when the run reaches a terminal state; encrypted results: up to 24 hours afterward.
Expired or terminated web-session security data: retained for 24 hours, then scrubbed through routine cleanup.
Invitation recipient addresses: used for one delivery attempt and not persisted by Company.
Application process and load-balancer access logs: 14 days.
Database logs, run metadata, and audit metadata: while the Service operates.
Automated database backups: up to 35 days.
Billing and tax records: retained for the periods required by applicable accounting and tax law.
Support and business communications: retained while needed to resolve the matter, handle follow-up or disputes, or comply with law.

8. Your rights

Depending on location and context, individuals may ask to access, correct, delete, restrict, object to, or receive a portable copy of personal data, and may withdraw consent without affecting earlier processing. The right to object applies to processing based on legitimate interests.

Submit a request to legal@theopenengine.com. We may verify identity and authority and may direct a request about Customer Content to the relevant customer. Where applicable, a person may appeal our decision by replying to it.

EEA individuals may complain to Datatilsynet or their local supervisory authority. We encourage contacting us first so we can address the issue.

9. United States notices

Where a US state privacy law applies, residents may have rights to know, access, correct, delete, or obtain personal data, and to appeal a denied request. Because we do not sell personal data, use it for targeted advertising, or conduct qualifying profiling, there is presently no such processing to opt out of.

Where applicable, an authorized agent may submit a request on a resident’s behalf. We will not discriminate against a person for exercising an applicable privacy right.

10. Cookies and local storage

We use strictly necessary cookies for login, session security, CSRF protection, and device flows. We use local storage for the selected theme and session storage for short-lived navigation state. These technologies are not used for advertising.

11. Security and automated decisions

We use technical and organizational measures designed for the nature and risk of the data, but no system is completely secure. Current measures are summarized in DPA Schedule 2.

We do not make solely automated decisions about users that produce legal or similarly significant effects. Customer-directed AI runs generate requested work product; they are not decisions by us about the user.

12. Changes and contact

We will post updates here and change the effective date. We will give additional notice where a change materially affects rights or is otherwise required.

Privacy contact: legal@theopenengine.com. Postal contact: COVIBES LABS AS, Romsdalveien 78, 9537 Tverrelvdalen, Norway.