Privacy policy

Project enquiries

The project form collects your name, work email, company, a description of your data and the task you want to improve. We use it to reply and scope an engagement. It is delivered by email to the Attempts intake inbox through our email provider. Describe your data in the form; do not paste personal records, confidential documents or API keys.

Your account

Signing up collects your name, work email and password. The password is sent over HTTPS to our authentication provider, which stores it; we do not keep it. Sign-in sets session cookies that are HttpOnly (not readable by page scripts), SameSite=Lax and Secure on HTTPS; the refresh cookie lasts up to 30 days. You must confirm your email before the workspace opens.

If you choose Continue with Google, Google confirms your identity and shares your name, email address, profile picture link and Google account id with our authentication provider. We do not receive your Google password, and we ask for no access to your Google data beyond this basic profile. Your email counts as confirmed because Google has verified it. During sign-in a cookie that is HttpOnly and lasts at most 10 minutes holds a one-time check value; it is deleted when you return.

If you are invited to a team, we store your email, role and the invitation (only a hash of the invitation token is stored). Invitations are sent by email and expire after 7 days.

Datasets, training and evaluation

• Uploads. A JSONL dataset of up to 50 MB is uploaded from your browser directly to our cloud storage through a signed link that is valid for 15 minutes. We store the file and its name, size and row count for your workspace. Uploading a file with the same name adds a new version; each version is kept with a SHA-256 fingerprint of its contents and the email of the person who uploaded it, and is never overwritten.
• Preparation. Creating a run requires you to confirm that you have the rights to use the data. We split it into training, validation and held-out test sets, keeping rows that share a group together, and store the splits and a manifest (file name, counts, exact duplicates) with the run. A cost estimate prepares the splits in memory only: nothing is stored and nothing is sent to the training provider.
• Training. Only after you approve a plan and start the run, the training split is uploaded to our training provider. If you choose to evaluate on your validation split, the validation examples are also sent. The held-out test split is never sent for training. The fine-tuned model is created and stored in our account with that provider.
• Evaluations. When you evaluate a deployed model, up to 100 examples from the run's held-out test split are sent to your own deployment for answers. The scores and the answers (each field cut to 2,000 characters) are stored with the run so you can review them.

Deployments and API calls

A deployment serves your fine-tuned model on dedicated GPUs run by our inference provider. Requests made with your workspace API keys pass through our website's servers and our backend to that deployment, and the answer comes back the same way. We do not store the prompts or answers of API calls. Our backend request logs record only the method, route, status and duration, not request bodies.

To stop password guessing and spam, we rate-limit sign-in, sign-up, password reset, the guided access code and the contact form. For this we store a keyed hash of your IP address (not the address itself) with the time of each attempt, and delete it within a day.

API keys are stored as a hash for verification and in encrypted form so they can be revealed and copied again in the workspace (members only for keys they created). Revoking a key clears its encrypted value. Older keys stored only as a hash cannot be recovered. A dedicated deployment does not by itself place data inside your own network.

Billing

Payments are handled by our payment processor. Card details are entered on its hosted page and stored by it. We keep the card brand, last four digits and expiry, the billing name and address from the card, your credit balance and holds, every transaction, monthly spend alert amounts, your spend limit and automatic top-up settings. Spend alert emails go to the workspace owner, only for amounts you set. If you pay by invoice, we keep and send to the payment processor the company name, billing address, billing email, PO number and tax ID you enter, and it emails and hosts the invoice.

Guided evaluation workspace

The guided workspace at /app uses a shared access code and a cookie that lasts up to 7 days and is not readable by page scripts. It does not provide separate customer accounts or workspaces, and a self-service login does not grant access to it. It measures a baseline on your held-out test examples, trains, evaluates the tuned model on the same examples on a temporary deployment and then tears that deployment down. Agree access arrangements with us before uploading confidential or personal data there.

Website analytics

Public pages of this website (the home page, Learning, Docs and these legal pages) measure visits with two tools. Sign-in (including the Google sign-in return), the workspace, the guided workspace, password reset and email confirmation pages load neither.

• Our hosting provider's web analytics counts page views, referrers, country, browser and device type. It sets no cookies and identifies visitors only by a hash that changes daily.
• Google Analytics, loaded through Google Tag Manager, records page views, the referring page, approximate location, browser and device. It sets first-party cookies (named _ga and _ga_*) that last up to two years. Advertising features are switched off. For visitors in the EEA, the UK and Switzerland, analytics cookies are not set; Google may still receive cookieless page measurements.

Some Learning articles include videos hosted on YouTube. Nothing is loaded from YouTube until you press play; the player then loads from YouTube's privacy-enhanced domain (youtube-nocookie.com), and Google handles what it receives under its own privacy policy.

We use these reports only to understand which pages are read. You can block them with your browser's tracking protection or a content blocker without affecting the site.

Who receives data

We use subprocessors for hosting, storage, authentication and database, training and inference, payments, email and website analytics. The Subprocessors page lists each one and what it receives. We do not sell personal information, use advertising trackers, or use your datasets to train models for anyone else.

Retention and deletion

• Stored workspace data has no automatic expiry: it is kept until you ask us to delete it. Stopping a deployment ends serving; it does not delete datasets, runs, reports or evaluations.
• Ask support@attempts.ai to delete a workspace. We delete its data within 30 days of a verified request from the workspace owner: datasets and stored files, prepared splits, run records and reports, deployments, evaluations, team members and invitations, spend alert settings and API keys (revoked, with their encrypted values cleared). Your saved card is removed and detached from the payment processor. Work that is running must be stopped, and pending bills settled, first.
• Billing and ledger records are kept as required for accounting: the credit ledger, top-ups and payment records, job and settlement records, and the account record with its billing name, address and login email.
• Copies held in our training provider's account (uploaded training and validation splits and fine-tuned models) are covered by the same request; we will confirm what was removed.
• Database backups roll off on our database provider's schedule. Enquiry emails remain in the intake mailbox and our email provider's records until deleted.

Your choices

You can ask for a copy of, correction of, or deletion of your information by emailing support@attempts.ai. Include a run identifier if relevant, without copying the underlying dataset into your message. Only upload data you have permission to use for the proposed processing and training.

Security

The measures in place today are listed in the Data processing addendum.

Changes

We update this policy when the service changes how data is handled, and post the new version here.