Privacy notice

Eben Green, Inc. runs ebengreen.com and the Eben Green app. This notice covers people who visit the site, book a demo, or use a workspace.

A workspace’s content belongs to the organisation that owns it. That organisation decides what goes in and why, and we process it on their behalf. If you test or review for an organisation, its own privacy notice applies too, and it’s the best place to send questions about that content. For everything else here, we decide how your data is used.

• Account details: your name, email address, role and workspace, and a hash of your password, never the password itself.
• Workspace content: what your organisation and its people put in or connect: prompts, model replies, ratings, reviews, corrections, documents, eval suites, agent tools, and conversations sent through the API. It holds personal data about others only if the organisation puts it there.
• Keys: model, judge and tool keys, encrypted at rest. Workspace API keys are kept only as hashes.
• Billing: the plan, billing history, and Stripe’s references to the customer and subscription. Stripe takes the card; we never see or store the full number.
• Demo bookings: your name, work email, company, phone if you give it, your answers, the time you pick, and how you found us (the referring site and the campaign tags in the link). We keep the contact details you enter even if you don’t finish booking.
• Logs: the time and IP address of API requests, and the server logs our host keeps to run and protect the service.
• Messages: what you send us by email.

• To run Eben Green: sign you in, run evals and agents, and send invites, password resets, alerts and billing emails.
• To bill workspaces through Stripe.
• To keep it secure: limit abuse, investigate problems and protect accounts.
• To answer you, and to arrange and follow up on demos.
• To meet legal duties, such as tax records.

We don’t sell personal data, show ads, or use workspace content to train AI models.

If you’re in the EU or UK, our legal bases are: running our contract with you or your organisation, our legitimate interests in securing and growing Eben Green, legal duties, and your consent where we ask for it.

Your organisation chooses the models and judges its workspace calls. Those requests go to the addresses it sets, under its own agreement with those providers.

A few features use our own AI provider: suggested tasks and eval suites are written from the project description, and if you ask AI to read an eval document, that document is sent for that request. Our provider doesn’t train its models on it.

Companies that run parts of Eben Green for us, under contracts that limit what they can do with it:

• Google Cloud: hosting, in Northern Virginia. Google Workspace also carries our email and demo calendar invites.
• A managed Postgres provider: the database, in AWS US East.
• Stripe: payments.
• An email delivery provider: the emails the app sends.
• An AI provider: only for the features above.

Your organisation’s admins can see what you do in its workspace. We may also disclose data when the law requires it, to protect people’s rights and safety, or to a buyer if Eben Green is sold, who must then keep to this notice.

One cookie keeps you signed in. The app can’t work without it, so there’s no cookie banner. We use no advertising or analytics cookies and no third-party trackers. When you arrive from a link with campaign tags, the page notes them and the referring site while you browse, and sends them with a demo booking if you make one. Nothing is stored on your device for that.

• Account details: while your account exists.
• Workspace content: until an admin deletes it or the workspace is deleted. Admins can delete a project and everything in it at any time. A closed workspace keeps its data so it can come back, until an admin asks us to delete it.
• Billing records: as long as tax and accounting law requires.
• Model health checks: 30 days.
• Demo bookings: while we’re talking with you about Eben Green, or until you ask us to delete them.

You can change your password on Account, and admins can export and delete workspace content. For anything else, email support@ebengreen.com to get a copy of your data, correct it, delete it, or object to how we use it. We reply within 30 days. If the data sits in an organisation’s workspace, we may pass your request to it.

Depending on where you live, including the EU, the UK and California, the law gives you these rights, and you can complain to your data protection authority. Using them won’t change how we treat you.

Each workspace is kept apart by row-level security, keys are encrypted, passwords are hashed, and everything travels over HTTPS. The Trust page has more. No system is perfect: if a breach affects your data, we’ll tell you promptly, as the law requires.

Your data is stored and processed in the United States. If you use Eben Green from elsewhere, it’s transferred there. If your organisation needs a data processing agreement, email support@ebengreen.com.

Eben Green is for work, not for anyone under 16. We don’t knowingly collect children’s data; if you think we have, email us.

When this notice changes, we update the date at the top. For changes that matter, we email admins before they apply.