Privacy Policy

This policy explains how Round3 AI, Inc. ("three.dev", "we", "us") handles personal data. three.dev is an evaluation and experimentation platform for teams shipping AI features.

The short version

• We are a business tool. Most of the personal data we touch belongs to our customers' end users, and we only handle it on our customers' instructions.
• We do not use our customers' production traffic to train or improve anything for anyone else.
• We do use the evaluation signal our platform generates, things like judge scores, human assessments, and experiment statistics, to make the platform better for everyone. We strip customer content and personal data out of that first.
• We do not sell personal data and we do not share it for cross-context behavioral advertising.

The detail is below.

---

1. Two different roles

When we are the controller. For people who visit our website, sign up for an account, contact us, or work at a customer, we decide why and how their data is processed. This policy covers that.

When we are the processor. For the production traffic our customers send into the platform, our customer decides why and how, and we act on their instructions. Their privacy policy governs that data, not this one. Our commitments are in our Data Processing Addendum at /dpa. If you are an end user of a product built by one of our customers and you want your data accessed or deleted, contact that company. We will forward any request we receive directly to them.

2. What we collect when we are the controller

Account data. Name, work email, job title, company, password credentials, and profile settings.

Usage data. Pages viewed, features used, experiments and evaluations run, API calls, and timestamps.

Device and log data. IP address, browser and device type, operating system, referring page, and approximate location derived from IP.

Billing data. Company billing details, plan and usage records, and invoices. Card details are handled by our payment processor. We do not store full card numbers.

Support and communications. Emails, support tickets, and notes from calls and meetings with you.

Marketing data. If you subscribe, join a waitlist, or attend an event: your contact details and engagement with our emails and site.

Cookies and similar technologies. See Section 8.

3. What we process on our customers' behalf

Our customers send us the production inputs and outputs of their AI features so we can evaluate them. This is "Customer Traffic" in our Terms of Service. It can contain personal data about their end users, because it is often free text those end users wrote.

We also process what the platform generates about that traffic: AI judge scores and reasoning, human assessments submitted by the customer's team, failure cluster assignments, experiment statistics, and operational telemetry like latency and cost.

We process all of it on the customer's documented instructions and under the DPA. We do not decide what it is used for beyond delivering the service, with the one exception described in Section 5.

4. Why we process controller data

Where we rely on legitimate interests, we have assessed that our interest is not overridden by your rights. You can object at legal@round3.ai.

5. AI training: exactly what we do and do not do

This is the section most people came here for.

We do not train on our customers' production traffic. Customer Traffic and customer-authored materials, meaning a customer's own prompts, system prompts, scenario and dataset definitions, and models we build for that specific customer, are used only to deliver the Service to that customer. We do not use them to train, fine-tune, benchmark, or improve any model, dataset, or feature made available to any other customer or to the public.

We do use evaluation signal to improve the platform. Evaluation signal is what our platform generates in the course of running an evaluation: judge scores and verdicts, reason codes, human assessments and labels, agreement and calibration data between judges and human assessors, failure cluster structure, experiment statistics, and operational telemetry. We use this to make our judges better calibrated, our clustering sharper, and our statistics more reliable, for every customer.

We also use the evaluation apparatus we build. Our platform generates the judges, output schemas, reason-code vocabularies, and rubric structures used to evaluate a customer's use case, including where it composes them from criteria a customer supplies. That apparatus is our own work product and we use it across the platform. It contains no customer traffic.

We also use the quality criteria customers give us. When a customer tells us what a good output looks like for their use case, that describes their standard of quality, not what any end user said. We use it to improve the platform.

Structured values are always usable. Free prose is not, unless we strip it first. Two kinds of field are always usable. Values drawn from a fixed set, such as scores, labels, confidence values, cluster identifiers and sizes, failure taxonomy labels, statistics, and reason codes from our own vocabulary, cannot carry customer content. And the label, title, and description we generate for a failure cluster describe what a group of requests has in common rather than any single request, so we treat them like the aggregated statistics they resemble; we only generate them over clusters above a minimum size and we screen them so they do not repeat material from an individual request. Free-prose fields about an individual item, such as judge rationales and free-form assessor notes, frequently quote the underlying traffic, so they are excluded from platform-wide use by default. Such a field only becomes eligible once we have removed from it every excerpt of customer traffic, every excerpt of customer materials, and all personal data. Unless and until that has been done to a given field, we treat it as customer traffic and it is not used platform-wide.

If a customer pastes traffic somewhere it does not belong, it stays protected. If customer traffic or personal data ends up inside a criteria field or a structured field, we treat that field as customer traffic until the content is removed.

We will not re-identify de-identified data. We do not attempt to re-identify data we have de-identified, we do not attempt to link it back to any customer or individual, and we require the same commitment by contract from every vendor that receives it.

We will not let this reproduce anyone's data. We do not use evaluation signal in a way that would let the platform, or any model we train, reproduce a customer's traffic or materials, or identify a customer or its end users.

What customers can and cannot opt out of. The measurements our own system produces, meaning scores, labels, confidence values, cluster identifiers, statistics, and reason codes from our own vocabulary, plus the quality criteria a customer gives us, are part of how the Service works and are not subject to opt-out. None of them can contain a customer's content or anyone's personal data, so there is no consent involved and nothing to withdraw. Customers can opt out of the platform-wide use of free-prose fields, meaning judge rationales and free-form assessor notes, which permanently excludes them even after stripping. See Section 6.6 of our Terms of Service.

Third-party model providers, and whose account they run on. There are two paths and we describe both honestly.

When a customer runs an evaluation against a third-party model, we send the request using the API credentials that customer supplied, against their own account with that provider. Their agreement with that provider governs what it may do with the traffic, including any no-training terms they negotiated. We do not substitute our account for theirs, and we store those credentials encrypted per organization.

Parts of our own machinery run on our account instead, specifically the AI judges we operate and the labeling of failure clusters. Those calls send content derived from customer traffic to a provider we contract with, which makes that provider our subprocessor. It is still customer traffic, and it is still never used to improve anything for another customer or the public.

Which providers sit on which path is at /subprocessors.

6. Who we share data with

• Subprocessors and vendors, listed at /subprocessors, including cloud hosting, model providers, analytics, payment processing, email, and support tooling. Each is bound by contract and processes data only on our instructions.
• Professional advisers, such as lawyers and accountants, under confidentiality.
• Authorities, where legally required. We will notify the affected customer before disclosing their data unless we are legally prohibited.
• A successor, in a merger, acquisition, or sale of assets. Our commitments in Section 5 above bind any successor.

We do not sell personal data. We do not share personal data for cross-context behavioral advertising. We have not done either in the preceding twelve months.

7. International transfers

We are based in 285 W Wieuca Rd NE STE 67913, Atlanta, GA 30342 and our subprocessors operate in several countries. Where we transfer personal data out of the European Economic Area, the UK, or Switzerland to a country without an adequacy decision, we rely on the European Commission Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism. Details are in our DPA.

8. Cookies

We use strictly necessary cookies to run the site and keep you signed in. We use analytics cookies to understand how the product and site are used. Where required by law, we ask for consent before setting non-essential cookies, and you can change your choice at any time through the cookie settings link in our footer.

Fill before publishing. List the actual analytics and product tooling in use, including PostHog, and confirm the consent banner behavior matches this paragraph.

9. How long we keep things

Backups follow their ordinary rotation schedule and are deleted with it.

10. Security

We encrypt data in transit and at rest, enforce role-based access and multi-factor authentication for administrative access, log access, separate each customer's data logically, review vendors before onboarding them, and maintain a tested incident response plan. No system is perfectly secure. Report a suspected issue to legal@round3.ai.

11. Your rights

Depending on where you live, you may have the right to access, correct, delete, port, restrict, or object to processing of your personal data, to withdraw consent, and to complain to a supervisory authority.

If you are in California, you also have the right to know what we collect and disclose, to delete, to correct, to opt out of sale or sharing (we do neither), to limit use of sensitive personal information (we do not use it for purposes that trigger this right), and not to be discriminated against for exercising your rights. You may use an authorized agent.

To exercise any of these, email legal@round3.ai. We will verify your identity and respond within the time the law requires, generally thirty days for GDPR and forty-five days for CCPA. If you are an end user of a customer's product, contact that customer, and we will assist them.

You can complain to your local supervisory authority. In the UK that is the ICO.

12. Automated decision-making

We do not use personal data to make decisions about individuals that produce legal or similarly significant effects without human involvement.

The Service produces AI judge verdicts and evaluation results for our customers. Those are estimates about model output quality, and how a customer acts on them is the customer's decision.

13. Children

Our own users. three.dev is a business tool. It is not directed at anyone under sixteen, and we do not knowingly collect personal data from children through our website or account signup. If you believe we have, contact legal@round3.ai and we will delete it.

Children who use our customers' products. Some of our customers build products used by children, including education and language learning apps. When that happens, their end users' data can reach us inside customer traffic. In that situation:

• the customer, not three.dev, is the controller of that data, and is responsible for age assurance and for any verifiable parental consent required by GDPR Article 8, COPPA, the UK Age Appropriate Design Code, or equivalent law;
• we see only what the customer sends us and cannot determine the age of any end user, so we rely on the customer to tell us;
• where a customer tells us its traffic includes children's data, or we otherwise become aware of it, that traffic and everything derived from it is excluded from platform-wide use in full, including the metadata carve-out;
• we do not knowingly use children's personal data to train or improve any model, we do not profile children, and we do not use their data for marketing;
• if you are a parent or guardian, contact the company whose product your child used. We will assist them promptly with any access or deletion request.

These commitments are in Section 3.7 of our Data Processing Addendum.

14. Changes

We will post updates here with a new "last updated" date. For material changes we will give notice by email or in-product at least thirty days before they take effect.

15. Contact

Round3 AI, Inc. 285 W Wieuca Rd NE STE 67913, Atlanta, GA 30342 Privacy: legal@round3.ai Security: legal@round3.ai