Privacy Policy

Last updated: July 26, 2026

o10 (“o10”, “we”, “us”) operates an AI model-routing platform available at app.o10.io and through the o10 app for Slack. This policy explains what data we process, why, and the choices you have. It applies to both the web application and the Slack app.

What we process

• Message content you send to o10. When you mention @o10, DM the bot, or call our API, the text of that request (and only the context you direct at o10) is processed to generate a reply. We do not read channels o10 is not invited to, and we do not ingest your workspace history in bulk.
• Workspace & account metadata. Slack team/workspace ID and name, the installing user’s ID, channel IDs where o10 is used, and (for web accounts) your email and organization.
• Usage & billing records. For each request: the model routed to, token counts, cost, latency, and a content hash — used for your receipt, usage dashboard, and billing.
• OAuth tokens. Slack access/refresh tokens are stored encrypted at rest and used only to post replies and operate the features you enabled.

How we use it

• To route your request to an appropriate AI model and return the answer.
• To produce your usage receipt, savings dashboard, and invoices.
• To operate, secure, and debug the service (rate limiting, abuse prevention, error diagnosis).

We do not sell your data, and we do not use your message content to train our own models.

Sub-processors

To deliver the service we share the minimum necessary data with:

• AI model providers — primarily Amazon Bedrock (AWS); or, if you supply your own key (“BYOK”), the provider you chose (e.g. Anthropic, OpenAI, Mistral, Google). Your request text is sent to the selected provider to generate the response.
• Supabase — database and authentication hosting.
• Vercel — application hosting and edge delivery.
• Stripe — payment processing (we never store full card numbers).

Quality & cost telemetry

o10 records quality and cost metrics about routed calls and Tune runs — for example model names, pass/judge scores, token or call costs, task-type labels, and timestamps. These metrics power an aggregated public “quality–cost frontier” index (cheapest model that clears a quality bar for a task type), published only when minimum-sample and minimum-organization thresholds are met (k-anonymity). Organization identifiers in this telemetry are stored only as a salted hash, never as a raw org id.

This telemetry does not store the content of prompts, examples, or model outputs. Tune example retention (separate from this telemetry) remains as already described for optimization runs and is purged on its own schedule.

Retention

Prompt content captured for your usage history is encrypted at rest and purged on a rolling schedule; it is not retained indefinitely. Usage and billing metadata (token counts, cost, timestamps) is retained for as long as needed for accounting and legal obligations. You can request deletion at any time (see below).

Your choices & rights

• Uninstall. Removing o10 from your Slack workspace stops all processing and revokes our tokens.
• Access & deletion. Email privacy@o10.io to access or delete data associated with your workspace or account.
• BYOK. Bring your own provider key so requests are billed to, and processed under, your own provider agreement.

Security

Data is encrypted in transit (TLS) and OAuth tokens and stored prompts are encrypted at rest. Access to production systems is restricted and audited. Slack token rotation is enabled.

Children

o10 is a business tool and is not directed to children under 16.

Changes

We may update this policy; material changes will be reflected by the “last updated” date above.

Contact

Questions or requests: privacy@o10.io · Support: o10.io/support.