Privacy policy

1. What this covers

OCA ("we", "us") runs a private cognitive-evaluation API at oca-api.carelessapparelllc.workers.dev and a public website at oca-web.pages.dev. This policy describes the data we collect, why we collect it, how long we keep it, who we share it with, and what rights you have. It applies to every customer, every visitor, and every endpoint we talk to. The owner and data controller is Matthew Alexander Taylor (carelessapparelllc@gmail.com).

2. Data we collect

• Billing email — captured when you click "Generate invoice" on /pay.html.
• Your model endpoint URL — captured when you run an evaluation. Required for the eval; we never invoke it outside an active run.
• Your model's responses — captured during a run, scored against the held-out challenges, then released from memory.
• The challenges we sent to your endpoint — captured so we can correlate them with your responses.
• Per-module scores and aggregate score — captured and sealed in a signed receipt.
• HMAC-signed receipt — sealed in a Durable Object. Tamper-evident.
• ACH memo + amount + timestamp — when ACH auto-detection is on, we read our own operating account via Plaid to find transfers that match OCA-<invoice-id>.
• Optional proof-of-payment upload — if you choose to upload a confirmation screenshot or PDF, it's stored in the oca-proofs R2 bucket under proofs/<invoice-id>/<filename>.

3. Data we do NOT collect

• Your name, postal address, phone number.
• Government identifiers (SSN, passport, etc.).
• Payment-card numbers (we do not run a card processor).
• Your IP address beyond transient Cloudflare edge logs.
• Browser fingerprints, advertising identifiers, or device-attestation signals.

4. Why we collect it (purposes)

• Billing email → so we can send you a license key.
• Model endpoint URL → so we can deliver challenges and collect responses during a run.
• Model responses + challenges → so we can score your model and seal a receipt.
• Receipts → so you (and we) can verify a run was scored against the held-out test set.
• ACH transaction data → so we can auto-mint licenses when the transfer clears, instead of making you email us a screenshot.
• Optional proof upload → so you can pre-empt the ACH clearing and speed up license issuance.

5. How long we keep it

6. Third-party processors

• Cloudflare — compute, storage, edge network, secret store. Subprocessors list.
• Plaid — ACH polling for auto-mint. Operates only on the Service's own Cross River Bank account; never on a consumer bank account. Subprocessors list.
• Cross River Bank — holds the Service's operating account (routing 021214891, account 52120080855408). Subject to bank-secrecy law and GLBA.

7. Your rights

• Access — every run you paid for is yours; fetch it via GET /v1/runs/:id with the license you used.
• Deletion — email carelessapparelllc@gmail.com to delete your invoice, your receipts, your proof uploads, and your idempotency cache. Acknowledged within 48 hours; completed within 30 days.
• Portability — receipts are JSON and HMAC-signed; they're already portable.
• Withdraw consent — same email. Withdrawing consent rotates your license (your LICENSE_SECRET derivative becomes invalid) so no one can run evaluations under your account anymore.
• Complaint — if you believe we mishandled your data, email the address above; if unsatisfied, file a complaint with your local data-protection authority.

8. Cookies & tracking

We set zero cookies. We do not run any analytics, ad-tech, or session trackers on oca-web.pages.dev. The static site is served as-is; your browser's HTTP cache is the only state we maintain.

9. Security

See /security.html and the canonical policy repository. In short: TLS 1.3 only; HMAC-signed licenses and receipts; timing-safe comparisons; Cloudflare-managed encryption at rest; no on-disk storage; no third-party read access to held-out evaluation data.

10. International transfers

OCA runs on Cloudflare's global edge network. Data may transit and be stored in any region where Cloudflare operates compute or storage, subject to Cloudflare's data-location commitments. We do not knowingly transfer your data to any country on a sanctions list.

11. Children

OCA is a B2B service. We do not knowingly collect data from anyone under 18. If you believe a minor has submitted data, contact carelessapparelllc@gmail.com and we will delete it immediately.

12. Changes

Material changes to this policy will be announced on this page with a new "Last updated" date. Non-material changes (typos, formatting) are not announced. Continued use of the Service after a material change constitutes acceptance.

13. Contact

Matthew Alexander Taylor · carelessapparelllc@gmail.com