Privacy Policy

1. Introduction

THINNESTAI PRIVATE LIMITED ("Company", "we", "us") operates Preval (preval.dev), an AI agent observability platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

2. Information We Collect

We collect the following categories of information:

• + Account Information: Name, email address, and authentication credentials (via Auth0)
• + Trace Data: LLM call inputs/outputs, latency metrics, token counts, cost data, and tool execution logs sent via our SDK or OTLP ingestion
• + Evaluation Data: Quality scores, evaluation results, and prompt experiment outputs
• + Usage Data: Feature usage patterns, page views, and API call frequency for service improvement
• + API Keys (BYOK): Third-party API keys you provide, stored encrypted at rest

3. How We Use Your Information

• + To provide, maintain, and improve the Service
• + To process traces and generate evaluations and analytics
• + To authenticate users and manage accounts
• + To send transactional emails (alerts, billing, onboarding)
• + To detect and prevent fraud, abuse, or security incidents
• + To comply with legal obligations

4. What We Do NOT Do

• + We do not sell your data to third parties
• + We do not use your trace data to train AI models
• + We do not use your BYOK API keys for any purpose other than executing your requests
• + We do not share your data with advertisers

5. Data Storage & Security

Trace data is stored in ClickHouse with configurable retention (7 to 90 days depending on plan). Account data is stored in PostgreSQL. All data is encrypted in transit (TLS 1.2+) and sensitive fields (API keys, credentials) are encrypted at rest using AES-256. Infrastructure is hosted on Google Cloud Platform and Microsoft Azure with SOC 2 compliant practices.

6. PII Detection

Preval includes built-in PII detection powered by Microsoft Presidio. This feature scans trace data for 50+ personally identifiable information entity types (emails, phone numbers, SSNs, credit cards, etc.) and flags them in the dashboard. PII detection runs on your data within our infrastructure and results are not shared externally.

7. Third-Party Services

We use the following third-party services:

• + Auth0 — Authentication and user management
• + PostHog — Product analytics (anonymized usage data)
• + Sentry — Error monitoring and crash reporting
• + Google Cloud Platform — Infrastructure hosting

8. Data Retention

Trace data is retained according to your plan's retention period (7, 30, or 90 days). Account data is retained for the duration of your account plus 30 days after deletion. Billing records are retained for 7 years as required by law. You can request data export or deletion at any time by contacting us.

9. Self-Hosted Deployments

For Enterprise customers using self-hosted deployments, all data remains within your infrastructure. No trace data, API keys, or evaluation results are transmitted to THINNESTAI PRIVATE LIMITED servers. Only license validation and optional anonymized usage telemetry (which can be disabled) communicate with our systems.

10. Your Rights

You have the right to:

• + Access your personal data
• + Request correction of inaccurate data
• + Request deletion of your data
• + Export your data in a machine-readable format
• + Withdraw consent for optional data processing

To exercise these rights, contact us at hello@preval.dev.

11. Cookies

We use essential cookies for authentication and session management. We use analytics cookies (PostHog) to understand usage patterns. You can disable non-essential cookies in your browser settings.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a prominent notice on the Service. Continued use after changes constitutes acceptance.

13. Contact

For privacy-related questions or requests, contact our Data Protection team:

THINNESTAI PRIVATE LIMITED
Email: hello@preval.dev
India