1. Who we are
The Service is operated by Overwing (operated by its owner as a sole proprietor). For any privacy question or request, email support@overwing.ai.
2. What we collect
- Account data. Email address, password hash (held by our authentication provider), organization name, and the IP address used at programmatic signup, kept only to throttle abuse. An account created with no email (an agent’s account) holds none of the first two; if it proves control of a domain, we keep that domain name. Such an account is deleted after seven days if its key is never used.
- API content. The text you submit for evaluation, any metadata you attach, and the resulting verdicts, scores, and confidence values. We store these so you can retrieve and audit evaluations. You can turn off storage of the text and context for one request (
"store": false) or for your whole organization; the verdict and your metadata are then kept without them. - Evaluations without a key, or paid per request. If you call the evaluation API with no key, or pay per request over x402, the text and any context you send are passed to the model to produce a verdict and are not stored. We keep the verdict, a count against a one-way hash of your IP address to enforce the daily allowance, and nothing that identifies you.
- Beacon checks. The address of the site you ask us to check and the report we produce, kept so the report can be read again at its address. A check started with no account is counted against a one-way hash of your IP address to enforce the daily allowance. A check you start or save while signed in, or with a key, is linked to your organization so it appears on your dashboard. A check paid over x402 records the paying wallet address. Reports describe public pages of the site checked.
- Preflight checks. For each Solana transaction you ask us to check we keep the wallet address you named, the policy you sent, what the simulation showed, the programs the transaction would run, and a digest of the transaction, so that a transaction reported later can be judged against the verdict. The transaction itself is not kept. We publish each verdict’s id, decision, reason codes, programs, digest and our signature; we do not publish the wallet, the policy or the amounts. A landed transaction reported against a verdict is published by its signature, which is already public on the Solana chain and shows the wallet that signed it.
- Usage data. Request counts, verdict counts, latency, token counts, timestamps, and API key identifiers, aggregated per organization per day.
- Billing data. Plan, subscription status, and Stripe customer and subscription identifiers. Card numbers never reach our servers; Stripe holds them.
- Technical data. Standard server logs (IP address, user agent, request path, status) retained briefly for security and debugging. We also keep a request log to understand which people and automated agents use the Service: the user agent, the path without its query string, the kind of credential presented (never the credential), the country, the first language the client asks for (such as “es”, never the full list), the host of the referring site, and a one-way hash of the IP address rather than the address itself. When an automated client names itself, we may check the address it calls from against the ranges, reverse-DNS names or signing keys its operator publishes, and record only the outcome.
We do not use cookies for advertising. The dashboard uses only the session cookies needed to keep you signed in.
3. Why we process it
- To provide the Service you asked for: evaluating text, storing results, enforcing plan limits, and delivering webhooks (performance of a contract).
- To bill you and prevent fraud and abuse (contract and legitimate interests).
- To secure and improve the Service, including debugging failed requests (legitimate interests).
- To meet legal obligations such as tax and accounting rules.
We do not sell personal data and we do not use your submitted text to train models.
4. Who else processes it
We use these subprocessors. Each receives only what its role requires.
- TypeSafe — Evaluates submitted text with the Jev model (United States).
- Supabase — Database and authentication hosting (United States).
- Vercel — Application hosting and edge network (United States).
- Stripe — Payments, invoicing, and card storage (United States).
Text you submit is sent to TypeSafe to produce the evaluation. TypeSafe’s published privacy policy (effective November 19, 2025) says it does not train or fine-tune models on input and does not disclose input to third parties other than its service providers; it does not publish a fixed retention period for input. Do not submit data you are not permitted to share with these providers. If you need to evaluate regulated data, redact it first or contact us before doing so.
5. Retention
- Evaluation records (input text, results, metadata) are kept while your organization exists, so you can retrieve them, unless you set a retention window: evaluations older than the number of days you choose are then deleted daily. You can delete any or all of them yourself at any time, and everything is deleted within 30 days of a deletion request or account closure.
- Daily usage aggregates are kept for accounting for up to 7 years, without input text.
- Server logs and the request log are kept for up to 30 days.
- Daily counts taken from the request log are kept after that: for each automated client, the user agent it sent, how many requests it made, from how many distinct clients and countries, what kind of address it asked for, and how many of its requests were confirmed or contradicted by its operator's published evidence. These counts hold no IP address and no hash of one. Browsers are counted together as one total a day, without their user agents.
- Billing records are kept as long as tax law requires.
6. Your rights
Depending on where you live you may have rights to access, correct, export, restrict, or delete your personal data, to object to processing, and to complain to a supervisory authority. To exercise them, email us from the address on the account. We will respond within 30 days. You can delete API keys, rule sets, and webhooks yourself in the dashboard or through the API.
7. International transfers
Our providers are located in the United States. If you are outside the United States, your data is transferred there and protected by our contracts with those providers, including standard contractual clauses where they apply.
8. Security
API keys are stored only as SHA-256 hashes, and a key can be limited to running evaluations. Traffic is encrypted in transit with TLS, and the database and its backups are encrypted at rest with AES-256. Webhooks are signed so you can verify they came from us. Access to production data is limited to the operator. No system is perfectly secure; if we learn of a breach affecting you we will notify you without undue delay. More detail is on the security page.
9. Children
The Service is not directed at children and we do not knowingly collect data from anyone under 18.
10. Changes
We will post changes here and update the effective date. Material changes will also be announced by email to account holders.