OctOpus Octoopus, Inc.
Privacy Policy
This policy explains what OctOpus collects, why we use it, who receives it, and the choices you have.
For privacy questions or a data-access or deletion request, email ceo@octoopus.dev. Please include your account email and the relevant workspace or project reference, but no password or secret key.
1. Scope and responsibility
Octoopus, Inc. operates the hosted OctOpus service. We determine how account, support, security and billing information is used to operate that service. When an organization supplies data for processing under its own instructions, its agreement and privacy responsibilities also apply. Ask your organization's administrator about its controls. Local or customer-managed deployments can have different storage and provider configurations.
2. Information we process
- Account and access: name, email, password hash, sign-in and connection records, workspace membership, permissions and subscription status. Connected services may provide identity details needed to sign you in.
- Your work: datasets and files, prompts and messages, project names, generated code, profiles, analysis, trained models, predictions, metrics and saved artifacts. Their contents depend on what you choose to submit.
- Usage and security: request paths, timestamps, response status, job references, usage duration, credit accounting, error reports, device or browser information and IP addresses where used for security, rate limiting and the guest allowance.
- Billing: payment-provider customer and transaction references, plan, invoice and payment status, and usage balances. Payment-card collection is handled by the payment provider; the ChatGPT tools do not request or return card details.
- Support and feedback: information you choose to send us, including email correspondence, screenshots and issue descriptions.
3. Why we use information
We use information to authenticate users, apply permissions, run requested analysis and training, save and return results, meter usage, manage subscriptions, support users, investigate failures and abuse, and meet legal obligations. Product activity records help us understand whether features work and diagnose failures.
Where data-protection law requires a legal basis, we rely on performance of our agreement for requested service operations, legal obligations for required records, and legitimate interests in service reliability, security and support where those interests do not override your rights. Where consent is required for an optional activity, we rely on that consent and you may withdraw it.
4. The ChatGPT connection
Connecting OctOpus authorizes the permissions shown on the consent screen. Tools can return requested project details, dataset profiles, analysis, results, training status and credit balance to ChatGPT. A file uploaded in ChatGPT is downloaded into the selected OctOpus project when you request attachment. Your instructions and the data needed to carry them out are processed by OctOpus and its configured service providers.
OctOpus account passwords, payment details and private infrastructure credentials are not returned by these tools. OpenAI processes information it receives under its own terms and privacy settings. Disconnecting OctOpus does not delete your ChatGPT conversation or copies already received by OpenAI.
When requested, the connection can create private download links for a saved report, model or prediction file. Each link authorizes access to that one artifact for 15 minutes; anyone holding the link can use it during that period. Expiry ends link access and does not delete the underlying saved work.
5. Recipients and service providers
We disclose information needed to run the requested service to these categories of recipients:
- Hosting, storage and compute: Railway hosts the application; configured database and object-storage providers store records and artifacts; Modal can run isolated computational work and store its artifacts.
- AI processing: configured model providers, including OpenAI, Anthropic and Moonshot AI (Kimi), may receive instructions, data context, samples or generated artifacts necessary for the selected workflow. Which provider is used depends on the feature and configuration. Training workers may receive the full dataset. Model and package repositories may receive requests to retrieve dependencies.
- Payments and email: Stripe handles payment-related operations; our configured email provider delivers account and support communications.
- Connected services and collaborators: OpenAI when you use the ChatGPT connection, external systems you authorize, and users you or your organization give access to a workspace or shared project.
- Other necessary recipients: professional advisers or authorities where required by law, to protect rights or security, or in connection with a business reorganization subject to applicable safeguards.
Provider processing and retention depend on the applicable service configuration and agreements. We do not promise that every workflow stays on your device or in a particular country. Contact us before submitting data that requires a specific region, processor agreement or restriction.
6. Storage and retention
The following describes current application behavior. Credential expiry is an access limit, not necessarily deletion of the associated record.
| Information | Retention and deletion |
|---|---|
| Projects, datasets and results | Saved while the project or account remains in use; no fixed automatic expiry is applied to saved project content. Project deletion removes the project's active state and exclusive results. Files shared with another live project and retained storage copies may require separate removal. Contact support for complete account or dataset erasure. |
| Account and workspace records | Kept while the account is active. Account closure and erasure requests are handled through support, with any records that must remain for legal, billing or security purposes identified separately. |
| ChatGPT credentials | Authorization codes expire after two minutes, access tokens after one hour, refresh tokens after 30 days, and connection grants after at most 90 days. Revoking a connection prevents further use. Hashed credential and connection records can remain after expiry or revocation until removed through account erasure or maintenance. |
| Product activity events | The hosted application is configured to prune events older than 180 days through its background activity writer. Other operational and security logs are separate. |
| Operational logs and support records | Retained as needed to investigate and resolve the issue, maintain security and handle related disputes. A single automatic deletion period is not configured across these records; the incident's duration and any applicable legal obligations determine retention. |
| Billing and transaction records | Retained for the applicable accounting, tax and legal recordkeeping periods and to resolve payment disputes. Requirements depend on the transaction and jurisdiction. |
| Backups and recovery copies | Deleting an active record does not immediately remove every backup or recovery copy. These copies may persist under the relevant storage configuration until replaced or removed. No single automatic expiry is enforced by the application across all backup stores. Include backup copies in an erasure request so we can identify retained copies and explain any legal or technical limits. |
We do not present disconnecting a connection, cancelling a run or deleting a chat as complete erasure. Contact us for the retention information applicable to your account and deployment.
7. Your controls and rights
- Choose which datasets and instructions to submit and which services to connect.
- Manage project access and remove projects using the OctOpus application.
- Cancel active training separately from revoking the connection at OctOpus in ChatGPT.
- Request access, correction, deletion or export through support. Depending on applicable law, you may also have rights to restrict or object to processing, portability, or withdrawal of consent.
- Use unsubscribe controls in optional feedback emails or contact support to opt out. Necessary service and security communications may still be sent.
- Manage ChatGPT conversations and privacy settings separately with OpenAI.
We may need to verify that a request comes from the account holder or an authorized representative. Do not send your password. We respond within the periods required by applicable law. You may also complain to your local data-protection authority.
8. Browser storage and international processing
The web application uses browser storage for sign-in state, preferences and saved working context, and cookies where needed for secure authorization. Clearing browser storage does not delete server-side projects. IP addresses and request metadata may be processed by hosting and security systems.
Information may be processed outside your country by us and the providers used for your workflow. Applicable contractual or other legal safeguards depend on the arrangement. Contact us if you need details of a transfer or a deployment with particular data-residency requirements.
9. Security, children and changes
We use access controls and other technical measures to protect information, but no system guarantees perfect security. Report suspected unauthorized access through support. The service is not directed to children under 13; contact us if you believe such a child's personal data has been provided.
We will update this page when our practices change and show the effective date. Where required, material changes will also be communicated through an appropriate channel.