Privacy Policy

Draft — pending legal review.

Last updated: 29 October 2026

1. Who is responsible

The controller under the Swiss Federal Act on Data Protection (revFADP / revDSG) and the EU General Data Protection Regulation (GDPR) is:

Company

[not configured: legal name]

Address

[not configured: postal address]

Register

[not configured: commercial register]

UID / VAT

[not configured: UID / VAT number]

Email

[not configured: legal contact email]

Privacy questions and requests: [not configured: legal contact email].

EU representative (Art. 27 GDPR)

[not configured: EU representative]

2. Controller or processor

• Controller: for data about visitors of this website, license buyers, Gauntlet Cloud users (accounts, organizations, billing, security and usage records), people who email us, and the emails we send.
• Processor: for personal data in our customers' test environments and run results (the apps they deploy, the data in them, recordings and logs). The customer is the controller; we process it only on their instructions under the Data Processing Agreement. Ask that customer about such data.

3. What we process, why, and on what basis

Legal bases refer to Art. 6(1) GDPR: (b) contract, (c) legal obligation, (f) legitimate interests. Under the revFADP we process data in line with its principles (Art. 6 revFADP); no consent is needed for the processing described here. You need to give the data marked (b) to buy or use Gauntlet; without it we cannot provide the service. Nothing else is required.

Website (usegauntlet.dev)

• Visiting: our hosting infrastructure receives your IP address and request details to deliver pages. The website application does not log your IP address or set cookies for visitors. Basis: (f) operating and securing the site.

Email to us

• Sales and support: when you write to hello@usegauntlet.dev or hello@usegauntlet.dev, your address, name and message, to answer you and, for customers, to perform the contract. Support messages may contain Customer Content (logs, screenshots); we use it only to resolve the request. Basis: (b), otherwise (f) answering inquiries.

License store and license account

• Purchase: the email, company name and (optional) installation ID you enter; your Stripe customer and subscription IDs; plan, status, currency and paid-through date; the licenses issued (they contain the company name, plan, term and installation ID). Basis: (b).
• Payment: name, billing address, tax ID and card details are entered on Stripe's checkout page and kept by Stripe, not by us. Basis: (b), and (c) for tax records.
• Sign-in by email link: your email; we store only a hash of each link and session secret, with its expiry. Basis: (b).
• Emails: licenses, renewal and cancellation notices, failed-payment notices and sign-in links. Basis: (b).
• License renewal: a self-hosted installation renewing its license sends its installation ID and current license; we also see the connection's IP address. Basis: (b).

Gauntlet Cloud console (app.usegauntlet.dev)

• Invitations to Gauntlet Cloud: access is by invitation; we keep the email addresses or domains we have invited. Basis: (f) controlling access to the service.
• Account: from your identity provider (Google): email, name, profile picture URL and account identifier; when you signed up and last signed in; session revocations. If the provider gives one, its refresh token, stored encrypted, so we can re-check periodically that the account is still valid. Basis: (b).
• Organizations and projects: names, memberships, roles and invitations (invitees' email addresses). Basis: (b); for invitees, (f) enabling the inviting customer to collaborate.
• Credentials: model API keys you store (encrypted, never shown again) and API tokens (only a hash is stored). Model usage per person (requests and tokens). Basis: (b).
• Billing: the organization's Stripe customer ID, billing email, plan and subscription state, trial use per person; card and address details stay with Stripe. Basis: (b), (c).
• Audit log: who did what and when for security-relevant actions (e.g. members added, keys stored, billing changes). Basis: (f) security and accountability.
• Product usage events: a few first-party events (e.g. project created, environment ready, run finished, walkthrough steps) with your user and project ID, stored in our own database to improve onboarding. No third-party analytics. Basis: (f); you may object (section 8).
• Security: failed API-token sign-ins are counted per IP address in memory for one minute to limit abuse, and logged with the IP address and the token's non-secret prefix. Basis: (f).

Test environments and run results (as processor)

What customers deploy and test: blueprints and configuration, the apps and their data, and run results: agent steps, findings, logs, screenshots, desktop video, Playwright traces, network captures (which can include request and response bodies) and repro scripts. The agent's model requests (page text, screenshots, logs) pass through our model proxy to the customer's chosen provider with the customer's own key; we do not store their content, only usage counts. Recognizable credentials in text results are masked before storage; video, screenshots, traces and network captures are not. Customers should use test or synthetic data.

4. How long we keep it

• Email sign-in links (license account): 15 minutes, or until used; then deleted automatically
• License account sessions: 7 days; then deleted automatically
• Console session: 7 days (cookie); revocation records until the session would have expired
• License purchases, licenses issued: for the customer relationship, then as long as accounting law requires (up to 10 years)
• Cloud account, organizations, projects: until you or the organization delete them, or you ask us to delete your account
• Invitations to Gauntlet Cloud: until we remove the invitation
• Organization invitations: until accepted or revoked, or the organization is deleted
• Trial use per person: as long as the account exists (to allow one trial per person)
• Test environments: deleted with everything in them when their time limit runs out (the plan's maximum lifetime) or when destroyed
• Runs and their artifacts: until the customer deletes the run or its project
• Stripe webhook events (Cloud): 30 days; then deleted automatically
• Audit log, product usage events: 24 months
• Security log (failed API-token sign-ins): 14 days
• Hosting access logs (IP address, request): 14 days
• Email to sales or support: 2 years after the last message, longer where it is part of contract or accounting records
• Backups: weekly snapshots, each deleted after 4 weeks

5. Recipients

• Service providers who process data for us under contract: hosting (Amazon Web Services), payments (Stripe), email delivery and our mailbox. The current list, with locations, is on the sub-processor page.
• Stripe also processes payment data as an independent controller for its own legal duties (e.g. fraud prevention, anti-money-laundering); see Stripe's privacy policy.
• Google authenticates you for the console under its own terms and privacy policy, as an independent controller.
• Your model provider receives the agent's requests under your contract with it, not as our processor.
• Other members of your organization or project see your name, email and activity there.
• Authorities, where the law requires.

We do not sell personal data or share it for advertising.

6. International transfers

Gauntlet Cloud and this website are hosted by AWS in the EU (Stockholm, Sweden, region eu-north-1). Switzerland and the EU recognize each other's data protection as adequate. Where a provider processes data outside Switzerland and the EEA, for example Stripe in the United States, transfers rely on an adequacy decision (such as the EU-US or Swiss-US Data Privacy Framework, where the recipient is certified) or on the EU Standard Contractual Clauses with the Swiss addendum. Ask us for a copy of the safeguards.

Two flows go to the United States under the providers' own terms: sign-in with Google (Google LLC), and, on Gauntlet Cloud, the test agent's model requests, which we forward to your model provider (Anthropic) with your key.

7. Cookies and browser storage

We use only cookies needed for sign-in. No analytics, advertising or third-party cookies.

• gauntlet_web (this website): license account session, only after you sign in. 7 days.
• gauntlet_session (console): signed session. 7 days.
• gauntlet_oauth (console): protects the sign-in flow. 10 minutes.
• gauntlet_signed_out (console): after you sign out, asks the provider to choose an account again. 1 hour.

The console also keeps preferences in your browser's local storage (theme, layout, sorting, which runs you are watching) and unsent form drafts in session storage. They stay on your device. Stripe sets its own cookies on its checkout and billing pages.

8. Your rights

You can ask for access to your data, correction, deletion, restriction, a copy in a portable format, and object to processing based on legitimate interests (including product usage events). These rights exist under the GDPR and, in substance, the revFADP (Arts. 25–28 and 32). Write to [not configured: legal contact email]; we answer within 30 days and may need to verify your identity. For data in a customer's test environment, contact that customer; we will forward your request.

You may complain to a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch); in the EU the authority of your country of residence, work or the alleged infringement.

9. Security

Connections are encrypted (TLS). Stored model keys are encrypted with AES-256-GCM; API tokens and sign-in secrets are stored only as hashes. Each test environment runs in its own Kubernetes namespace and is deleted when it expires. Environments can reach the public internet; private address ranges, other environments and the cloud metadata service are blocked. The model key never enters an environment. Details: security and the DPA's security annex.

10. Children, automated decisions, changes

• Gauntlet is a business service and not directed at children under 16.
• We make no decisions based solely on automated processing that have legal or similarly significant effects on you.
• We update this policy when our processing changes and announce material changes by email or in the console. The date at the top shows the current version.