Privacy Policy

1. Overview

FactoryOS (“we”, “us”, or “our”) is committed to protecting the personal information you share with us. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use the FactoryOS platform.

2. Information We Collect

We collect information you provide directly, such as your name, email address, and organisation name, when you create an account or use our services. We also collect usage data, log data, and integration metadata (e.g. Slack workspace IDs, GitHub repository names) necessary to operate the platform.

Authentication is handled by our identity provider, Stytch. FactoryOS does not store your credentials.

3. How We Use Your Information

We use collected information to:

• Provide, operate, and improve the FactoryOS platform.
• Attribute costs per tenant, team, agent, and run.
• Maintain audit logs required for SOC 2 compliance.
• Send service notifications and product updates.
• Respond to support requests.

4. Data Retention

We retain your data for as long as your account is active or as required to provide services. Audit log entries are append-only and hash-chained, so they cannot be deleted without breaking the chain. Operational data may be deleted on account termination subject to your contractual terms.

5. Data Sharing

We do not sell your data. We share data with sub-processors only as necessary to operate the platform. During the beta, the platform is hosted on Oracle Cloud Infrastructure in Sydney, Australia. Our current sub-processors are:

• Oracle Cloud Infrastructure (hosting: application, database and secrets store; Sydney, Australia)
• Anthropic (model inference for the platform default, through our LLM gateway; United States)
• Voyage AI (text embeddings for search over your decisions and documents; United States)
• Stytch (identity and authentication; United States)
• Resend (transactional email, such as sign-in codes and notifications; United States)

If you connect your own model provider key, that provider processes the requests made with it under your own agreement with them.

6. Security

FactoryOS is pursuing SOC 2 Type I certification from week one (Vanta-monitored). Secrets are stored in HashiCorp Vault. Data is encrypted in transit and at rest.

7. Your Rights

Depending on your jurisdiction, you may have rights to access, correct, or delete your personal data. To exercise these rights, contact us at privacy@agentfactoryos.com.au.

8. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email or an in-app notice at least 30 days before taking effect.