01. Who We Are
Anomalytica, Inc. ("Anomalytica," "Halios," "we," "us," or "our") operates Halios, an evaluation, testing, regression gating, and improvement platform for AI software agents.
Our services include our marketing website at https://halios.ai, our web application at https://app.halios.ai, our APIs, CLI, SDKs, and related developer tools (collectively, the "Service").
02. Scope & Our Role
This Privacy Policy describes our practices regarding information we collect through our website, user accounts, billing interactions, communications, and platform telemetry. In those contexts, Anomalytica generally determines how and why that information is processed.
When we process personal information contained in Customer Data to provide the Service (such as agent traces, spans, prompts, or messages submitted by our customers), we generally process it on behalf of the customer.
03. Information We Collect
We collect information in the following categories:
A. Account and Registration Information
- Contact and Account Details: Name, work email address, organization name, authentication identifiers (such as GitHub or Google OAuth tokens), and workspace preferences.
- Billing Information: Billing contact details, subscription tier, and transaction records. Payment card details are processed directly by our payment processor, Stripe; Halios does not store full credit card numbers.
- Communications: Messages, support inquiries, and feedback you send to us.
B. Customer Data
Information, telemetry, and evaluation datasets submitted by or on behalf of customers, described in Section 4 below.
C. Usage and Technical Telemetry
- Platform and Feature Usage: Product interaction telemetry, feature engagement counts, error logs, and navigation metrics collected through product analytics (PostHog).
- Device and Connection Details: IP address, browser type, operating system, and language settings.
04. Customer Data & Traces
When you connect your agents to Halios via our SDK, CLI, or OpenTelemetry (OTEL) endpoints, we receive trace telemetry necessary to evaluate agent behavior, detect regressions, and compute scores:
- Traces and Spans: Interaction graphs, span timestamps, status codes, latency, and token counts.
- Prompts and Messages: User messages, agent responses, system prompts, turn context, and conversation history submitted for testing.
- Tool Calls and Outputs: Tool definitions, function arguments, execution outputs, and retry sequences.
- Scenario Configurations: Test scenarios, check rules, custom evaluators, and baseline assertions.
Customers are responsible for ensuring that Customer Data they submit to Halios is collected and provided in accordance with applicable law and for configuring appropriate redaction, masking, or filtering where needed.
05. How We Use Information
We use the information we collect for the following operational purposes:
- Providing the Service: Ingesting traces, running evaluations, computing scores, displaying diagnostic telemetry, and generating diff analysis.
- Account and Billing Administration: Authenticating users, managing organization memberships, issuing API keys, and processing subscriptions.
- Security & Abuse Prevention: Monitoring system stability, preventing abuse, detecting unauthorized access, and enforcing rate limits.
- Support and Communications: Responding to inquiries, sending service notices, security alerts, and technical updates.
06. Model & Evaluation Processing
We use third-party model providers in connection with certain evaluation features:
- No Public Model Training: We do not use Customer Data to train generalized public foundation models.
- Managed Model Processing: Certain evaluation features may send relevant Customer Data to third-party model providers through OpenRouter. Data handling and retention may vary depending on the selected model, provider, and configuration. Additional retention controls, including zero-data-retention options, may be available for certain providers or configurations.
- Bring-Your-Own-Key (BYOK): Where supported, customers may configure their own model provider credentials. In those cases, inference requests use your provider credentials and are governed by your direct agreements and data policies with those providers.
Aggregated & De-identified Data
We may create and use aggregated, de-identified, or anonymized statistics derived from use of the Service to operate, analyze, benchmark, and improve Halios (including evaluation algorithms, scoring rubrics, automated judges, and specialized evaluation harnesses), provided such information does not identify Customer or any individual and does not disclose Customer's confidential content.
We will not attempt to re-identify de-identified data.
07. How We Disclose Information
We do not sell personal information or Customer Data. We may disclose information under the following circumstances:
- Service Providers: We use third-party service providers to operate the Service, including cloud hosting and storage providers, analytics providers, managed model-processing providers, and payment processors. Certain managed evaluation features use OpenRouter for model processing, and payments are processed through Stripe.
- Compliance and Protection: When required by applicable law, regulation, subpoena, or lawful request, or to protect the safety, rights, and property of Anomalytica, our users, or the public.
- Corporate Transactions: In connection with an actual or prospective merger, acquisition, financing, reorganization, or sale of company assets.
08. Security & Data Retention
Security: We use reasonable administrative, technical, and organizational measures designed to protect information against unauthorized access, loss, misuse, or alteration. No system or method of transmission or storage is completely secure.
Data Retention: Account records are retained while your account remains active or as required for legal compliance. Customer trace data is retained according to the retention period applicable to the customer's account. Our standard trace retention period is currently 14 days, unless otherwise configured or agreed.
09. International Processing & Your Rights
International Processing: Anomalytica is based in the United States, and information may be processed and stored in the United States and other countries where we or our service providers operate.
Your Choices and Rights: Depending on where you live, applicable law may provide rights regarding certain personal information, such as access, correction, deletion, or objection to certain processing. You may contact us at privacy@halios.ai to make a request. We may need to verify your identity and may deny or limit requests where permitted by law.
- No Cross-Context Behavioral Advertising: We do not share personal information for cross-context behavioral advertising.
10. Children
The Service is intended for business users and is not directed to children under 13. We do not knowingly collect personal information directly from children under 13.
11. Changes & Contact Information
We may update this Privacy Policy from time to time. We will post the updated policy on this page and update the "Last Updated" date above.