Privacy Policy

Spare Parts Labs, Inc., doing business as OutcomeCI (“OutcomeCI,” “we,” “us,” or “our”), provides software and cloud services for orchestrating agent-powered workflows. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal data when you use the OutcomeCI website, documentation, command-line tools, APIs, managed runners, workflow services, and related support (collectively, the “Services”).

This policy is a notice about our data practices, not a contract requiring consent to every form of processing. Where applicable law requires consent, we request it separately.

1. Our roles

OutcomeCI is a controller when it determines why and how personal data is processed, including account, website, security, support, and billing data.

When an organization uses the Services to process workflow inputs, connected-service data, traces, or other content on its behalf, OutcomeCI generally acts as its processor or service provider. That organization is responsible for its instructions, notices, permissions, and lawful basis. Contact us to arrange a Data Processing Addendum where one is required.

2. Information we collect

Account and workspace data

• Name, email address, profile image, account identifier, workspace membership, role, and authentication records.
• Information received from sign-in providers such as Google, including the information shown during the provider’s consent flow.
• Invitations, access requests, configuration choices, and records of administrative actions.

Customer content and workflow data

Depending on how you configure the Services, we may process:

• Workflow definitions, instructions, files, trigger payloads, schedules, webhook and email data, repository content, and connected-service data.
• Agent prompts, model inputs and outputs, tool requests, human approvals, policy-review records, execution events, traces, transcripts, artifacts, and error diagnostics.
• Information a workflow reads from or writes to services such as code hosts, chat systems, email providers, business applications, and customer-controlled APIs.

Credentials and secrets

If you use the OutcomeCI Vault, we process credentials, API keys, OAuth tokens, signing keys, and related configuration that you deposit. We encrypt Vault values at rest, limit access according to workspace grants, and release credentials to authorized workflow executions through time-limited leases. Workflows may also use credentials stored only in your local environment.

Usage, billing, and transaction data

• Runner duration and resource configuration, token counts and reference rates, storage and automation usage, and other metering records.
• Billing contact details, invoices, payment status, tax-related information, credit balances and ledger entries, purchase status, and identifiers returned by our payment processor. We do not intend to store complete payment-card numbers.

Support, feedback, and communications

We collect messages, feedback, screenshots or attachments you choose to provide, support history, and contact preferences.

Device, log, and analytics data

• IP address, browser and device type, operating system, timestamps, requested URLs, referring pages, and session or authentication events.
• Product interactions, feature usage, diagnostics, crash reports, performance measurements, and security events.
• Cookies and similar technologies needed for authentication, preferences, security, and—where permitted—analytics.

Sources

We receive data directly from you, your organization and workspace members, your devices, authentication providers, payment providers, connected services and APIs, and workflow activity you instruct the Services to perform.

3. Why we process information and our legal bases

• Contract: to create accounts, execute workflows, provide managed infrastructure, support collaboration, meter and bill usage, provide support, and otherwise deliver the Services.
• Legitimate interests: to secure and operate the Services, prevent abuse and fraud, diagnose failures, understand product performance, improve reliability, and communicate about the Services. We balance these interests against your rights.
• Consent: for optional analytics, marketing, or uses of customer content for model training where consent is the appropriate basis. You may withdraw consent prospectively.
• Legal obligations and claims: to comply with tax, accounting, sanctions, law-enforcement, and other legal duties and to establish, exercise, or defend legal claims.

4. Agents, model providers, and integrations

Workflows can send customer content to the agent, model provider, connector, or third-party API selected by you or your organization. This can occur using your credentials or an OutcomeCI-managed credential. We send the information reasonably needed to carry out the requested workflow. Those third parties process data under their applicable terms, privacy notices, and enterprise or API commitments.

OutcomeCI does not use customer workflows, prompts, model outputs, traces, transcripts, artifacts, or connected-service data to train or fine-tune generalized artificial-intelligence models unless the customer affirmatively opts in through a separate setting or written agreement. We may use aggregate or de-identified operational information that cannot reasonably be linked back to a customer or individual to improve reliability, safety, and cost efficiency.

5. How we disclose information

We may disclose information to:

• Your organization and workspace members, according to their roles, permissions, and workflow grants.
• Infrastructure and service providers that provide cloud hosting, storage, databases, email delivery, authentication, monitoring, customer support, analytics, and payment processing. These currently may include Amazon Web Services, Google, Sentry, and our payment processor when billing is enabled.
• Model and integration providers selected for a workflow, including providers reached through OutcomeCI-managed model access.
• Professional advisers, auditors, insurers, and financing partners subject to appropriate confidentiality duties.
• Authorities or other parties when reasonably necessary to comply with law, protect rights or safety, investigate abuse, or enforce our agreements.
• A successor in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, subject to applicable notice requirements.

We do not sell personal data. We do not use personal data for cross-context behavioral advertising. We provide notice of material subprocessor changes where required by law or contract and make additional subprocessor details available to customers on request.

6. International data transfers

OutcomeCI is based in the United States, and we and our providers may process information in the United States and other countries. Where the European Economic Area, United Kingdom, or Switzerland restricts an international transfer, we rely on an applicable adequacy decision, the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum or Agreement, or another legally recognized safeguard. You may contact us for information about the safeguard relevant to your data.

7. Retention and deletion

We retain information only for as long as reasonably necessary for the purposes described above, considering the type and sensitivity of the data, workspace settings, security needs, contractual commitments, and legal requirements.

• Account, workspace, workflow, artifact, and Vault data is generally retained while the relevant account or workspace remains active, until an authorized user deletes it, or as specified in an order or workspace setting.
• Hosted trace spans are retained according to the workspace’s retention setting; the standard setting is currently 30 days.
• Short-lived leases, upload links, and session credentials expire according to their security time limits. Revoked Vault credentials are no longer issued to new executions.
• Billing, tax, fraud-prevention, and transaction records may be retained for the period required by applicable law or reasonably needed to resolve a charge or legal claim.
• Security logs and backup copies are deleted or overwritten on operational cycles, unless preservation is required for an active incident, legal obligation, or claim.

You may request account deletion at legal@outcomeci.com. Deletion from active systems may not immediately remove limited backup, security, billing, or legal records that we are permitted or required to retain.

8. Security

We use technical and organizational safeguards designed for the nature of the Services, including tenant authorization, encryption in transit, encryption or cryptographic protection for sensitive stored data, scoped credentials, short-lived execution leases, access controls, logging, and monitoring. No system is completely secure, and we cannot guarantee absolute security. You are responsible for selecting appropriate workflow permissions, protecting local credentials, and promptly revoking compromised access.

9. Your privacy rights

Depending on your location and our role, you may have the right to access, correct, delete, restrict, or obtain a portable copy of your personal data; object to processing based on legitimate interests; and withdraw consent without affecting earlier lawful processing. You may also have the right to appeal our response.

Residents of the EEA, United Kingdom, and Switzerland may complain to their local data-protection authority. Where we process data only on behalf of your organization, we may refer your request to that organization.

Submit a request to legal@outcomeci.com. We may verify your identity and authority before acting. We will not discriminate against you for exercising an applicable privacy right.

10. Automated workflows

OutcomeCI executes workflows and policy checks configured by customers. OutcomeCI does not itself use personal data to make solely automated decisions about individuals that produce legal or similarly significant effects. Customers that configure workflows for such decisions are responsible for providing required notices, lawful bases, safeguards, and human review.

11. Cookies and communications

We use necessary cookies or local storage for authentication, security, preferences, and core functionality. With your permission, we use Google Analytics to understand public-page visits and product milestones, including signup, connecting an account, and running a workflow. We do not send your email, credentials, workspace names, or workflow contents. Analytics stays off unless you allow it. With your separate permission, we also use Google advertising measurement to connect ad clicks to signup and workflow milestones. This uses ad-click identifiers and your consented analytics identity. Personalized advertising and remarketing remain disabled. You can change your choice through the Cookie settings link in the footer. Transactional and security communications are part of the Services; you can opt out of marketing communications using the instructions in those messages.

12. Children

The Services are intended for business and professional use and are not directed to anyone under 18. We do not knowingly collect personal data from children. Contact us if you believe a child has provided personal data to the Services.

13. Changes to this policy

We may update this policy to reflect changes in the Services, law, or our practices. We will update the effective date and provide additional notice of material changes where required. Material changes apply prospectively unless applicable law permits otherwise.

14. Contact us

Spare Parts Labs, Inc. is the controller for the OutcomeCI account, website, security, support, and billing activities described above. For privacy questions, requests, our current mailing address, a DPA, or information about transfer safeguards or subprocessors, contact: