Privacy Policy

Last updated November 1, 2026

The short version

• We collect what we need to run Evalban: your email, your name if you add one, and the work your team puts in it.
• We don't sell your data, show ads, or use tracking or analytics cookies.
• We don't use your workspace content, eval results or examples to train AI models.
• A few service providers help us run Evalban. They're listed below.
• You can ask us to see, correct, export or delete your data at [email protected].

Who we are

Evalban is project management for AI product teams, offered at evalban.com and app.evalban.com. Evalban is currently operated by its founder as an individual (a sole proprietorship) based in Utah, United States. In this policy, "Evalban", "we" and "us" mean that operator. You can reach us at [email protected].

This policy explains what personal information we collect, why, who we share it with, and the choices you have. It covers our website, the waitlist, the Evalban app and its APIs (together, the "Service").

What we collect

When you join the waitlist

• Your email address, which form you used, and how many times you've signed up.
• A scrambled form of your network (IP) address. We store only a salted hash, never the address itself, to stop the form being flooded. It can't practically be turned back into your address.
• In your own browser, the site remembers the email you joined with, so it can show "You're on the list". This stays on your device; you can clear it with "Use a different email" or by clearing your browser's site data.

When you use the app

• Account details: your email address and the display name you choose. We sign you in with a one-time link or code sent to your email; we don't use passwords.
• Workspace content: everything your team adds, such as issues, comments, subtasks, sprints, experiments, eval runs and scores, failing examples, eval-set cases, model versions, and production feedback sent through our API.
• Invitations: the email addresses of people you invite.
• Activity history: a log of changes in your workspace (who moved what, and when), which powers issue history and notifications.
• API keys: we store only a fingerprint (hash) of each key, plus when it was last used. We can't see the key itself after it's created.
• Sign-in session: your browser stores a session token and your last-used workspace so you stay signed in. These are needed for the app to work; they aren't used for tracking.
• Technical data: our hosting and database providers process request data such as IP addresses, browser type and timestamps to deliver and secure the Service, and keep short-term logs.

Data your team sends about other people

Eval examples and production feedback can contain text written by your own users, such as prompts and model answers. For that data, your organization decides what to send and why, and we process it on your behalf to provide the Service. Please don't send highly sensitive data, such as government ID numbers, payment card numbers or health records, in eval examples or feedback. Where the law requires it, we can sign a data processing agreement with your organization; ask at [email protected].

How we use it

• To provide the Service: sign you in, show your workspace, run eval checks, file bugs and send the alerts you set up.
• To send service emails: sign-in links, invitations, waitlist confirmations, and important notices about your account or these policies.
• To reply when you write to us, and to invite people from the waitlist.
• To keep the Service secure and working: preventing abuse, enforcing rate limits, and fixing problems.
• To improve Evalban using what you tell us directly. We don't run analytics or tracking tools on the site or app today. If that changes, we'll update this policy first.

We don't sell or rent personal information, don't use it for advertising, and don't share it for cross-context behavioral advertising. We don't use your workspace content to train AI models.

If you're in the European Economic Area or the United Kingdom, our legal bases are: performing our contract with you or your organization (running the Service), our legitimate interests (security, preventing abuse, replying to you, and telling waitlist sign-ups about early access they asked for), and your consent where we ask for it.

Who we share it with

We use these service providers ("subprocessors") to run Evalban. They may only use the data to provide their service to us.

If you connect GitHub or Slack, we exchange data with them to do what you asked, such as reading pull request events or posting alerts to your channel. Their own privacy policies apply to data held on their side.

We may also disclose information if the law requires it, to protect people's safety or our rights, or as part of a merger, sale or transfer of the business. If Evalban is transferred, this policy will continue to apply to your data, or we'll tell you before anything changes.

How long we keep it

• Waitlist: until you ask us to remove you, or until we stop running the waitlist.
• Account and workspace data: for as long as your account or workspace exists. When a workspace is deleted, we delete its content within 30 days, apart from copies in backups.
• Backups and logs: kept for up to 30 days, then overwritten.
• We may keep limited records longer where the law requires it, or to resolve a dispute.

Security

All traffic uses HTTPS. The database enforces workspace boundaries itself, so one customer can't read another's data even if the app has a bug. API keys are stored only as hashes, and access to production systems is limited to the people who run Evalban. No system is perfectly secure. If we learn of a breach that affects your personal information, we'll tell you as the law requires.

Your choices and rights

You can update your name in the app at any time. Wherever you live, you can ask us to:

• tell you what personal information we hold about you and give you a copy;
• correct it;
• delete it, or remove you from the waitlist;
• export your workspace data in a common format.

Depending on where you live, you may also have the right to object to or restrict certain processing, to withdraw consent, and to complain to your data protection authority. Residents of California, Colorado, Utah and other US states with privacy laws have similar rights; we don't sell personal information or use it for targeted advertising, so there's nothing to opt out of. We won't treat you differently for using these rights.

To make a request, email [email protected] from the address on your account. We'll reply within 30 days, and may need to confirm your identity first. If your workspace belongs to an organization, some requests about its content may need to go through that organization's admin.

International transfers

Evalban is run from the United States and our main providers store data there. If you use Evalban from elsewhere, your information is transferred to and processed in the United States, using safeguards such as standard contractual clauses where the law requires them.

Children

Evalban is a tool for work and isn't meant for anyone under 16. We don't knowingly collect information from children. If you think a child has given us personal information, contact us and we'll delete it.

Changes to this policy

If we make material changes, we'll update the date at the top and tell account holders by email or in the app before they take effect.

Contact

Questions or requests: [email protected].