Iron Octopus

Legal

Privacy Policy

What personal information Iron Octopus collects, why, who it's shared with, and your choices.

Last updated: 25 October 2026

This policy explains what personal information Iron Octopus collects, why, who it's shared with, and the choices you have. It covers our website (ironoctopus.ai) and the Iron Octopus service (app.ironoctopus.ai).

"Iron Octopus", "we" and "us" mean Iron Octopus Inc., 849 W 18th St, Ste C, Costa Mesa, CA 92627.

The short version

  • We collect what we need to run your account, bill you and do the work you ask for.
  • Your ideas, code and project content belong to you. We use them only to provide the service to you.
  • We don't use your content to train AI models, and we don't let our AI providers train on it either.
  • We don't sell your personal information or use it for advertising.
  • Our website and app use only the cookies needed to sign you in and take payment. No analytics or advertising cookies.
  • You can ask us to see, correct, export or delete your information at any time.

Two kinds of information

Account information is about you as a customer: your name, email address, organization, plan and billing details. We decide how this is used, so we are its "controller" under data protection law.

Customer content is what you and your team put into Iron Octopus, plus what Iron Octopus produces for you. That includes ideas, requirements, plans, conversations, code, tests, review notes and release records. We process customer content only on your instructions, to provide the service. For customer content we act as your "processor".

What we collect

When you create an account: your name, email address and password or sign-in method (for example, signing in with Google or GitHub). Our sign-in provider, Clerk, handles this for us.

When you subscribe: your plan, seat count and billing history. Payments are handled by Stripe. We never see or store your full card number.

When you use the service: the customer content described above. If you connect a third-party service, such as your own AI provider account, GitHub or Jira, we store the access details needed to connect to it. Credentials are encrypted before they're stored.

Automatically: technical information needed to run and secure the service, such as IP address, browser type, the pages and features you use, timestamps and error logs.

When you contact us: whatever you choose to include in your message.

We don't knowingly collect sensitive information such as health, financial account or government ID data. Please don't put it in your projects unless your app genuinely needs it.

How we use it

We use personal information to:

  1. Provide the service: create your workspace, run Iron Octopus on your projects, and store and release your work.
  2. Bill you and manage your subscription.
  3. Keep the service secure, prevent abuse and fix problems.
  4. Send service messages, such as receipts, security alerts and changes to these terms. You can't opt out of these while you have an account.
  5. Send occasional product news, only if you agree. You can unsubscribe at any time.
  6. Improve the service using usage information, such as which features are used and where errors happen. We don't read your customer content to do this unless you ask us to help with a specific problem.
  7. Meet legal obligations, such as tax records.

If you're in the EU or UK, our legal bases are: performing our contract with you (1, 2, 4), our legitimate interests in running a secure, working service (3, 6), your consent (5), and legal obligation (7).

How Iron Octopus uses AI with your content

To do its work, Iron Octopus sends parts of your customer content to AI model providers and receives their responses. This happens through the providers' business APIs.

  • No training. We don't use your customer content to train or fine-tune any AI model. We use AI providers under terms that don't allow them to train on what we send them.
  • Limited retention by providers. AI providers may keep requests for a short period to detect abuse, as their business terms allow, and then delete them.
  • Your own provider. If you connect your own AI provider account, your content is sent to that provider under your agreement with them.

Who we share it with

We share personal information only with service providers that help us run Iron Octopus, and only what each one needs:

  • Google Cloud — hosting, databases and storage (United States)
  • Clerk — sign-in and account management
  • Stripe — payments and billing
  • GitHub — hosting the code repositories Iron Octopus creates and manages for your projects
  • AI model providers (OpenAI and Anthropic) — generating plans, code, tests and reviews

Each provider is bound by a contract to protect your information and use it only to provide its service to us. We'll update this list before adding a new provider that handles customer content.

We also share information when you tell us to (for example, by connecting an integration), when the law requires it, to protect people's safety or our rights, or as part of a merger or sale of the business, in which case this policy will continue to apply.

We don't sell your personal information, and we don't share it for cross-context behavioral advertising.

How long we keep it

  • Account information: for as long as your account is open.
  • Customer content: for as long as your account is open. After you close your account, you have 30 days to export your code and content. We then delete it from our systems within a further 30 days, and from backups within 90 days.
  • Billing records: for as long as tax and accounting law requires, usually up to 7 years.
  • Logs: up to 90 days, unless needed longer to investigate a security issue.

How we protect it

All data is encrypted in transit. Stored data is encrypted at rest, and connection credentials are separately encrypted. Access to production systems is limited to the people who need it. No system is perfectly secure, but if a breach affects your personal information, we'll tell you without undue delay and as the law requires.

Where it's stored

Iron Octopus is hosted in the United States. If you're outside the US, your information will be transferred there. For transfers from the EU, UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum) or another lawful transfer method.

Your rights

Depending on where you live, you may have the right to:

  • know what personal information we hold about you and get a copy
  • correct it
  • delete it
  • export it in a portable format
  • object to or restrict how we use it
  • withdraw consent at any time, where we rely on it
  • not be treated differently for using these rights

To use any of these rights, email privacy@ironoctopus.ai. We'll reply within 30 days, and may need to confirm your identity first. You can also ask someone to make a request on your behalf.

If you're in the EU or UK, you can also complain to your local data protection authority. If you're a California resident, these rights include those under the California Consumer Privacy Act.

If your request is about customer content that belongs to an organization, such as your employer's workspace, we may refer you to that organization, because it controls that content.

Cookies

We use only the cookies needed to make the site and service work: keeping you signed in, protecting against fraud and completing payment. We don't use analytics, advertising or tracking cookies, so there's no cookie banner. If that changes, we'll update this policy and ask for your consent where the law requires it.

Children

Iron Octopus is for businesses and adults. It isn't intended for anyone under 18, and we don't knowingly collect information from children. If you think a child has given us information, contact us and we'll delete it.

Data processing agreement

If your organization needs a data processing agreement (DPA) for GDPR or similar laws, email privacy@ironoctopus.ai and we'll provide one.

Changes to this policy

If we make a material change, we'll tell you by email or in the app at least 30 days before it takes effect. The date at the top shows when this policy last changed.

Contact us

Questions or requests: privacy@ironoctopus.ai

Iron Octopus Inc.
849 W 18th St, Ste C
Costa Mesa, CA 92627