privacy policy

Privacy contact: privacy@blackbit.sh. Payment-provider information: Stripe Privacy Policy.

Operator and Scope

BlackBit is operated by orgn.dev, inc., a Delaware, United States corporation. This policy covers our website, AI inference gateway, cloud agent sandboxes, payments, and communications. orgn.dev, inc. is responsible for the personal information described here. Contact privacy@blackbit.sh for privacy questions or requests.

API-Key Access and Payments

Access is API-key-only; we do not require a name or email registration for gateway access. Our billing records link an account UUID to payment amounts and dates. We do not store the payer’s name in those records. An identifier linked to payments does not guarantee anonymity.

You can pay using cryptocurrency or Stripe. Stripe processes payment and transaction information under its own privacy policy and legal obligations. Payments are not anonymous to Stripe, banks, or payment networks merely because BlackBit does not retain a payer name. Cryptocurrency transactions may be visible on public blockchains.

Confidential Inference

Customer content includes prompts, outputs, files, code, targets, and agent task context. We host inference on our own GPU fleet using trusted execution environments and end-to-end encryption designed to prevent orgn.dev, inc. personnel from accessing plaintext customer content. Computation takes place inside the protected environment.

Inference requests are processed in memory. We do not retain prompts, outputs, or content traces after processing, route inference requests to external model providers, use customer content to train shared models, or sell it or use it for advertising.

Cloud Sandboxes and Local Agents

Agents can run on your own machine or in our cloud TDX encrypted sandboxes. A cloud sandbox holds files and agent state for the active task. Sandbox files, agent state, and disks are deleted after each task. Task-lifetime storage is distinct from inference request processing.

BlackBit does not provide a retained archive of your findings or task history. You must save results you need on systems you control. Local agents and tools or integrations you select may retain or transmit data under their own settings and policies.

Communications and Connection Information

If you contact us, we receive your address and the information you provide. Do not send API keys or sensitive task content in correspondence. Support communications are separate from the inference service and its retention commitments.

Network delivery necessarily involves processing connection information such as an IP address while communicating with your device. Content confidentiality does not mean network intermediaries and payment providers cannot observe connection or transaction metadata.

Purposes and Legal Grounds

We process information to provide requested services, attribute payments to the correct UUID, respond to inquiries, and comply with legal obligations. Where the GDPR applies, the relevant grounds are contract performance for requested services, legal obligations for required records, and legitimate interests in operating and protecting the service and addressing inquiries, subject to your rights. Where consent is required, we obtain it separately.

When we process personal information in customer tasks on the customer’s instructions, the customer remains responsible for its purposes and lawful use. Any applicable data processing agreement governs that processing.

Locations and Recipients

orgn.dev, inc. is incorporated in Delaware, United States. Our GPU fleet and cloud sandboxes operate in Norway, Iceland, and the United States. Tasks may therefore be processed outside your country. Confidential computing does not remove applicable international data-transfer requirements.

Payment providers and their financial partners process information needed for payments. Tools or integrations you choose may send information to destinations you select. Their policies apply independently.

We may disclose information we actually hold where required by applicable law or binding legal process. We do not promise to disregard legal obligations. We cannot provide historical customer content that we do not hold.

Retention

Inference content is not retained after processing; cloud sandbox data is deleted after each task. Payment records are separate. Accounting records subject to Swiss statutory requirements must generally be retained for ten years from the end of the relevant financial year. Credit expiry after 90 days does not require deletion of legally required accounting records.

We retain correspondence only as long as needed to handle the inquiry and related obligations or claims. Stripe and blockchain systems have their own retention practices.

Security

We use encryption, confidential computing, and task-limited processing to protect content. These measures do not protect an exposed API key, a compromised customer device, or information sent to external tools. No system guarantees protection against every security risk.

Your Rights

Depending on applicable law, you may request access, correction, deletion, portability, or restriction of personal information, or object to processing. Where we rely on consent, you may withdraw it. You may complain to the Swiss Federal Data Protection and Information Commissioner or another competent supervisory authority.

Contact privacy@blackbit.sh. We may need proportionate evidence connecting you to the relevant record; do not send your full API key. We cannot recover lost keys or identify records using information we do not hold. Deletion remains subject to mandatory retention requirements.

Adults Only and Policy Changes

BlackBit is only for people aged 18 or older. Contact us if you believe a child has provided personal information. We will publish policy changes with an updated date and provide additional notice where legally required.

Contact

orgn.dev, inc., a Delaware, United States corporation. Email: privacy@blackbit.sh.