Privacy, Data Use, and Retention: Interim Guidance

OBIE uses your content and your users’ responses to deliver their experience, not to train AI models for other people. You retain ownership of your uploaded content and intellectual property, and you can remove uploaded documents and user accounts.

Interim notice: This article is a temporary explanation of OBIE’s current data practices while our Terms of Service are being written. It isn't our Terms of Service, a final legal Privacy Policy, or a Data Processing Addendum. Our Terms of Service should be public shortly. This overview describes current practices and separates them from future plans.

What information OBIE saves

As a creator, you provide the prompts, documents, and other information used to build and operate your AI Hubs. OBIE saves the information you enter and upload, along with the content generated through the application.

OBIE’s Hub Builder can suggest what to ask your users and write questions for your program’s Steps and Conversations. As the creator, you should always review those questions before using them, including what information they ask users to share. You decide which questions to use and can edit them to fit your program.

OBIE saves your users’ inputs and the responses generated for them so their experience can continue with relevant context.

This means your users’ work is part of the experience you manage, not an anonymous interaction that disappears after each response.

How OBIE uses data with AI

OBIE doesn't train on user data, either internally for other people or through third-party models.

We currently use OpenAI models for generation. Our intention is to use the models that are most effective for creators, so the models we use may change as the service develops.

We've configured our internal settings and AI-provider settings to prevent training on submitted data. Our agreements with those providers cover that processing.

Using information as context isn't the same as training a model. For example, a user might explain a goal in one response. OBIE can use that information to make a later response more relevant to that same user. It isn't using that answer to train a model for someone else.

Creator-provided documents similarly supply reference material for the experiences you build. Providing that material doesn't transfer its ownership to OBIE.

Where data is stored and how it's protected

OBIE uses different service platforms for different functions, so data isn't all stored in one place.

Data exchanged with the service is protected using SSL. That protection applies while information is being transmitted. Stored application data isn't currently encrypted at rest.

These are different protections. A secure connection protects information in transit; it doesn't mean stored information is encrypted or inaccessible to authorized people.

We haven't yet undergone independent third-party security testing or assessment. See the roadmap below for our intention to introduce third-party testing.

This overview isn't a complete inventory of storage providers, processing locations, or security controls. If you need those details for a vendor review, contact OBIE support with your requirements.

Who can access user data

Trusted OBIE staff

Certain trusted OBIE staff can access user data. Internally, we only inspect it when investigating bugs or at a user’s request.

Everyone on the OBIE staff with access to user data has signed strict nondisclosure agreements covering that data.

You and your account’s team members

As a creator, you can access the user information and generated content within your account.

Your account’s team members have different permissions for the actions they can perform. Those permission levels don't currently restrict access to user data. Don't assume that giving someone a more limited team role prevents them from seeing users’ information.

Invite team members with that distinction in mind: permission to perform an action and permission to see user data aren't the same thing.

Login and authentication

OBIE supports email-based login, including an emailed magic link. A magic link lets a user sign in using a link sent to their email.

OBIE doesn't currently offer multi-factor authentication, or MFA. An emailed login link isn't a separate additional authentication factor.

Who owns your content and users’ outputs

You retain ownership of the content and intellectual property you upload or enter as a creator. Putting your material into OBIE doesn't transfer that ownership to us.

For content generated through a user’s interaction, our intent is that the user owns their outputs, while you, as the creator, can access them within your account.

This describes our ownership intent. The final legal documents will set out the applicable contractual terms.

Retention, removal, and deletion requests

Our retention approach is to keep inputs and generated content for the duration of the account’s existence, or until the creator deletes the relevant data.

You can remove uploaded documents and delete individual user accounts. Removing a user account and completing a request to erase every historical record are different scopes of work. Don't treat account removal as confirmation that every saved response or historical copy has been erased.

If you need an individual’s complete data removed, or you're closing your creator account, contact OBIE support so we can clarify the scope and handling of the request.

This interim overview doesn't specify deletion timeframes for logs, backups, or copies held by service providers. It also doesn't promise that removing an account or document immediately erases every historical copy across those systems.

Data exports

A complete individual-user data export isn't currently available as a feature. A full-account export of the data entered into the application also isn't currently available.

Both are roadmap items. Don't rely on either export capability being available today when planning a migration or offboarding process.

Our data and privacy roadmap

We're intending to develop the following capabilities and documentation:

• Individual-user exports: A way to export an individual user’s data. This is on our short-term roadmap.
• Full-account exports: A way to export the data entered into your creator account.
• Independent third-party security testing: External testing and review of our security practices. This is a future intention, not a completed assessment or certification.
• Formal Terms of Service: The legal terms currently being written, which should be public shortly.

These are planned improvements, not current features or dated delivery commitments. This section doesn't mean OBIE has already passed an external audit or obtained a security certification.

Questions or specific requirements

If you need information about data handling, deletion, access, or a particular compliance requirement, contact OBIE support through the help panel. Tell us what you need to confirm so we can address that request directly rather than ask you to infer it from this overview.