Privacy.
Last updated: 23 June 2026
1. Who we are
Octi is operated by All Models Are Wrong Ltd (“we”, “us”, “our”). We are the data controller for the personal data described in this policy. Our service is available at octi.allmodelsarewrong.xyz.
Questions about this policy or how we handle your data should be directed to privacy@octi.ai.
2. What personal data we collect
We collect the following categories of personal data:
- Account data — your name and email address, provided when your account is created or invited.
- Research content — the research briefs, questions, and instructions you submit; the findings, dossiers, and reports Octi produces in response; chat messages and conversation history.
- Uploaded knowledge — documents (PDF, DOCX, TXT) and other files you upload to your workspace knowledge base.
- Connected source data — content fetched from external data sources you connect (Google Drive, AWS S3, Postgres, REST APIs), at your instruction.
- Usage data — session identifiers, authentication timestamps, and request logs generated automatically when you use the service. We do not use third-party analytics or advertising trackers.
We do not knowingly collect data from individuals under 16. Octi is a business research tool and is not directed at consumers or minors.
3. How we use your data
| Purpose | Legal basis |
|---|---|
| Providing the Octi research service — running briefs, storing findings, enabling chat | Contract (Art. 6(1)(b)) |
| Sending transactional emails — brief completion notifications, morning brief, stakeholder reports you choose to share | Contract (Art. 6(1)(b)) |
| Maintaining security, detecting abuse, and fraud prevention | Legitimate interest (Art. 6(1)(f)) |
| Improving the reliability and quality of the platform (aggregated, de-identified) | Legitimate interest (Art. 6(1)(f)) |
| Responding to your support queries and security disclosures | Legitimate interest (Art. 6(1)(f)) |
| Complying with legal obligations | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, we have balanced those interests against yours and concluded they do not override your rights. You can object to processing based on legitimate interests at any time (see Section 8).
4. Your data is not used to train AI models
Your brief content, uploaded documents, and chat messages are not used to train any AI model — ours or our providers’. All inference providers in our standard configuration (Together AI, Anthropic, Google AI Studio, OpenAI) have confirmed this by contractual commitment for API customers. Research you commission through Octi stays yours.
5. How long we keep your data
| Data | Retention |
|---|---|
| Account data (name, email) | Until you request deletion or your account is closed |
| Research briefs, findings, chat history | Indefinite by default; deletable per item at any time in your workspace |
| Uploaded knowledge | Until you delete the file from your knowledge base |
| LLM call audit log (internal) | Retained for platform stability and debugging. A formal retention policy is in review; contact us to request deletion of specific entries. |
| Session tokens | Expire on sign-out or after the session lifetime |
6. Who we share your data with
We share data with the following sub-processors who act on our instruction. We do not sell your data to third parties. We do not share your data with advertising networks.
| Sub-processor | Purpose | Location |
|---|---|---|
| Neon | Database hosting | EU (London) |
| Render | Application hosting | US (Oregon) |
| Together AI | LLM inference | US (SOC 2 Type II) |
| Anthropic | LLM inference | US |
| Google AI Studio | LLM inference | US |
| OpenAI | Text embeddings | US |
| Exa / Brave | Web search (triggered by research briefs) | US |
| Resend | Transactional email | US |
| Stripe | Payment processing (where applicable) | US / EU |
We may also disclose personal data to law enforcement or regulators when required by applicable law. We will notify you of such requests where legally permitted to do so.
7. International data transfers
Several of our sub-processors are located in the United States. When we transfer personal data from the UK or European Economic Area to the US, we rely on appropriate safeguards — including Standard Contractual Clauses (SCCs) approved by the European Commission, and the UK International Data Transfer Agreement (IDTA) where applicable.
You can request a copy of the relevant SCCs or DPAs by emailing privacy@octi.ai.
8. Your rights
Under UK GDPR and EU GDPR, you have the following rights regarding your personal data:
- Access — request a copy of the personal data we hold about you.
- Rectification — request correction of inaccurate personal data.
- Erasure — request deletion of your personal data in certain circumstances.
- Restriction — request that we limit how we use your data while a dispute is resolved.
- Portability — request your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interests or for direct marketing purposes.
- Complaint — lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk, or with your local supervisory authority in the EEA.
To exercise any of these rights, email privacy@octi.ai. We will respond within one month. We may ask you to verify your identity before fulfilling a request.
9. Cookies
Octi uses only essential cookies required to provide the service. We do not use advertising cookies, tracking pixels, or third-party analytics.
| Cookie | Purpose | Type |
|---|---|---|
| authjs.session-token | Maintains your authenticated session | Essential — no consent required |
Essential cookies are necessary for the service to function. Under UK PECR and the EU ePrivacy Directive, strictly necessary cookies do not require your consent.
10. Automated decision-making
Octi produces research outputs — findings, briefs, and analysis — using AI. These outputs are advisory: they are made available to you, not used to make automated decisions about you or other individuals. No legally significant decisions are made automatically through Octi.
11. Changes to this policy
We may update this policy from time to time. Material changes will be communicated to active account holders by email at least 14 days before they take effect. The “Last updated” date at the top of this page reflects the most recent revision.
12. Contact
For privacy questions, data subject requests, or to report a concern, contact us at: