Privacy Policy

Last updated: September 27, 2026

This Privacy Policy explains what information Origin (“we”) collects, how we use it, and the choices you have. Origin is a prototype. The public demonstration uses synthetic data. Any external evaluation requires a separate agreement. The public reference check runs a deterministic synthetic policy evaluation in your browser; it does not contact or execute the named agent, and the declared configuration is not uploaded. Runtime policy enforcement and a controlled tool-call proxy are proposed pilot architecture, not deployed general production enforcement. By using Origin, you agree to this Policy.

Information we collect

• Account information — your name and email when you create an account, and authentication data handled by our identity provider.
• Browser reference-check inputs — declared model, tools, context, harness, scenario, and selected policy remain in your browser in the public demo. The browser can generate a downloadable synthetic evidence artifact, but Origin does not intentionally receive or store those fields through this flow.
• Authorized pilot data — only when separately scoped with a pilot participant, we may process agreed workflow metadata, policies, tool-call requests or responses, approval metadata, system identifiers, and evidence logs needed for that authorized evaluation. The applicable agreement defines purpose, access, and retention; the public demo does not establish that pilot authority.
• Usage and security logs — basic logs, IP address, and diagnostics needed to operate and secure the Service, plus aggregated usage analytics.
• Contact and lead information — details you submit through a form or an evidence-review request, such as your name, work email, company, role, and the workflow you describe.

Foundry image processing

The public Foundry sample is local to your browser and sends no image. Only a separately authorized local/backend demo can transmit a selected image to Cerebras after affirmative consent. Origin handler code does not intentionally persist that image; provider terms and retention apply. Do not submit personal, confidential, regulated, or customer data. Foundry produces deterministic simulated evaluation, not robot training, deployment, or execution.

How we use information

• To run the deterministic reference check — binding an agent configuration and returning deterministic verdicts over a scenario battery. (A runtime policy gate evaluating live proposed actions is proposed pilot architecture, not a deployed capability.)
• Where a controlled tool-call proxy is used in a pilot, to record what passed through it. The proxy is proposed pilot architecture and is not deployed as general production enforcement.
• When separately authorized for a pilot, to produce a tamper-evident evidence record of the scoped evaluation. A public browser artifact does not prove that a named agent or provider effect occurred.
• To operate, maintain, and secure the Service and your account.
• To surface human-in-the-loop controls — human approval for risky actions, scope and budget limits, and kill switches to pause a workflow or revoke a scope.
• To communicate with you about your account, security, and changes to the Service.
• To detect, prevent, and respond to abuse, fraud, and security incidents.

Human-in-the-loop controls

The public repository contains deterministic approval-binding, scope, budget, and kill-switch demonstrations. Where those controls are separately integrated into an authorized pilot, the pilot design can hold a proposed risky action for a named risk owner and record that decision. This source capability is not proof that a customer workflow is integrated, that an action was executed, or that distributed replay protection and production operations are in place.

Tamper-evident evidence

Public demo artifacts can use canonical JSON, signatures, digests, and hash chains so later alteration is detectable under the named verifier. The public reference-check artifact is browser-session-signed and unpinned, and it records that execution was not attempted. Separately authorized pilot evidence may have different storage and issuer-trust controls documented in the pilot agreement.

How we share information

We do not sell your personal information. We share it only with: (a) sub-processors that help us run the Service, such as hosting, identity, analytics, email, and—only for an affirmatively consented Foundry local/backend demo—Cerebras; (b) authorities when required by law; and (c) a successor in the event of a merger or acquisition, subject to this Policy. Provider terms and retention may apply to data sent to a provider.

Security

Public demonstration artifacts use the verification mechanisms identified with each artifact.

Data retention and deletion

We retain account, lead, operational, and authorized pilot information for the engagement, the period agreed with the participant, and as required by law. Browser-only reference-check inputs are not intentionally received by Origin. Origin handler code does not intentionally persist a Foundry image, but Cerebras terms and retention apply to an image deliberately transmitted in the local/backend demo. To request removal of your account or associated data held by Origin, contact us below.

Your rights

Depending on your location, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise these rights, contact us using the details below. You may also have the right to lodge a complaint with your local data-protection authority.

Cookies and analytics

We use only essential cookies and local storage needed to keep you signed in and operate the Service. We also use Google Analytics configured in Consent Mode v2 with analytics_storage denied by default, so no non-essential analytics or advertising cookies are set unless you grant consent.

Children

The Service is not directed to children under 16, and we do not knowingly collect their personal information.

Origin's role

Changes

We may update this Policy. If we make material changes, we will take reasonable steps to notify you and update the “Last updated” date above.

Contact

Questions about privacy? Reach us at bohueilin@originphysicalai.com or through the contact section of our website.