Privacy policy

If you choose Google sign-in, Google provides basic account information to our authentication provider, Clerk. Obol uses your Clerk account identifier and the email address Clerk confirms at signup to create and protect your account and workspace. The requested Google permissions are limited to your identity, email address, and basic profile. We do not request access to Gmail, Drive, or your Google contacts.

GitHub sign-in is a separate account login option. Signing in with GitHub does not connect a GitHub repository or give Obol an agent credential for GitHub. Any vendor connection you later authorize is managed separately within your workspace.

We process the account, workspace, policy, connection, usage, billing, approval, and audit information needed to operate Obol. Calls sent through the gateway may contain prompts, tool arguments, and responses. We route them to the model or tool providers selected by your workspace and retain records needed for security, accounting, and audit. A receipt describes the evidence Obol has for a call; its evidence class depends on the route.

Your workspace supplies its own vendor credentials. Obol stores those credentials encrypted and sends them only to the selected vendor on an authorized outbound call. We do not give vendor credentials to an agent or to the website. Vendor providers process traffic under your separate relationship with them.

On the marketing website, optional measurement and advertising tools run only after you choose to allow them in Privacy choices. These tools may receive page activity and campaign identifiers. You can change that choice using the Privacy choices control. The signed-in dashboard is not instrumented with the marketing site's analytics or session replay.

If you request access, a demo, or support, we use the contact details and message you provide to respond and manage that request. We do not use your Google sign-in profile or email address for advertising targeting or to train AI models.

We use service providers for authentication, hosting, email delivery, billing, and, with your website consent, measurement. They receive only the information needed for those services. We do not sell Google sign-in data. We may disclose information when required by law or to protect the service and its users.

We keep account and service records while needed to provide the service, maintain security and audit history, resolve disputes, and meet legal obligations. The end of a trial or a cancelled plan stops new execution but does not immediately erase dashboard or audit records. You can ask about your information, request a correction, or request deletion by contacting us. Some records may need to remain for security, accounting, or legal reasons.