Privacy Policy

Who we are

OpenLeash provides controls for supported AI-agent actions, including approvals, secret protection, policy enforcement, optional provider usage visibility, and activity records. This policy covers the OpenLeash website, OpenLeash Cloud, and the desktop client. It also applies to an optional mobile approval client if and when OpenLeash makes one available.

Privacy contact: privacy@openleash.com. General support: support@openleash.com.

Data we collect

• Account information, such as name, email address, sign-in provider, and authentication metadata.
• Business directory information, such as organization domain, member names and work emails, administrator role, group or team membership, and enrollment state when an authorized administrator connects an identity source.
• Device and client information, such as platform, app version, device name, API endpoint, and notification registration state.
• Security event data, such as agent name, project name, supported requested action, policy match, approval decision, timestamp, and audit context.
• Provider usage metadata, such as request counts, token counts, connected provider names, and cost estimates where enabled.
• Optional provider-administration credentials supplied by a Business administrator to retrieve organization usage and cost data.
• Public organization-profile information, such as a company-domain website, page metadata, name, and logo used to prepare a new Business workspace.
• Subscription and trial information, including package, seat count, trial dates, and evaluation allowance usage.
• Support messages and operational communications you send to us.
• Website analytics from Google Analytics, such as pages viewed, referral source, approximate location, and browser or device information, together with basic telemetry from hosting, security, and server logs.

How we use data

• To authenticate users and connect them to a personal account or Business workspace.
• To deliver approval notifications and let users approve or deny agent actions.
• To enforce security policy, protect secrets, maintain audit logs, and show usage information.
• To populate a Business workspace from a company domain and sync authorized directory or provider-usage sources.
• To provide support, debug reliability issues, prevent abuse, and secure the service.
• To understand website use and improve our content, navigation, and product.
• To comply with legal obligations and enforce our terms.

Individual, organization, and service roles

For direct Personal accounts and for account administration, billing, security, abuse prevention, and product operations, OpenLeash determines why and how the relevant information is processed. For a Business workspace, the customer generally determines which employees, devices, agents, protections, and optional provider-usage sources are enrolled; OpenLeash processes that workspace data to deliver the configured service. The exact controller or processor role can depend on the customer, jurisdiction, and written terms.

Business customers are responsible for giving users legally required notice, establishing a lawful basis for workplace monitoring, and limiting administrator access. Employees should direct requests about employer-controlled workspace records to their organization administrator first; they may also contact privacy@openleash.com for help identifying the appropriate route.

Planned mobile approval client

Optional mobile approvals are not part of current product availability. If a mobile approval client is offered, this policy will be updated to describe its permissions and data handling before customers are asked to use it.

Sharing and processors

We do not sell personal data. We share data only with service providers needed to run OpenLeash, such as infrastructure, sign-in, email, analytics, monitoring, and support providers, or when required by law.

The current categories include hosted infrastructure, managed AI evaluation, authentication, subscription billing, public website analytics, operational communications, and release distribution. Current named services and the change-contact process are listed on our external services page. OpenLeash does not currently publish a pre-signed DPA template; Business customers that require one should contact privacy@openleash.com before sending production organization data and confirm applicable terms in writing.

For Business workspaces, authorized organization administrators may access enrolled-user, device, agent, policy, security-event, approval, and optional usage information for their workspace. Your employer or organization may separately control that information under its own policies.

Security

We use encryption in transit, access controls, least-privilege operational practices, and audit logging appropriate to the sensitivity of security event data. These measures reduce risk but cannot guarantee that every system, integration, or transmission will be error-free or immune from attack.

Retention and deletion

Cloud account, workspace, device, event, approval, and usage records are currently retained while needed to operate an active account or workspace; the product does not currently expose a universal customer-configurable retention period or promise automatic deletion after a fixed number of days. A 30-day dashboard view is a reporting window, not a storage-retention promise. You can request account and associated personal data deletion at openleash.com/account/delete.

After identity and authority are verified, we remove account-associated personal data from active product systems that is not required for another lawful purpose. Residual copies may remain in provider backups until those backups rotate. Billing, security, abuse-prevention, dispute, or legal records may be retained where required or permitted by law. Because the current implementation does not enforce one published maximum deletion period across every system, contact privacy@openleash.com if your procurement or legal requirements need a written retention schedule before purchase.

Your choices

• You can sign out of OpenLeash Cloud and remove enrolled desktop clients.
• You can request access, correction, export, or deletion by contacting privacy@openleash.com.

Children

OpenLeash is not directed to children and should not be used by children under 13.

Changes

We may update this policy as the product changes. If changes are material, we will provide reasonable notice through the website, product, or account email where appropriate.