Privacy Policy

Effective date: January 1, 2026

1. Overview

Metaphi, Inc. ("Metaphi," "we," "our," or "us") is committed to protecting the privacy of every individual who interacts with our services. This Privacy Policy describes how we collect, use, disclose, retain, and safeguard personal information when you visit our website at metaphi.ai, use our platform surfaces including Simhub, Evals, and our API (collectively, the "Services"), or otherwise interact with us.

Metaphi builds reinforcement learning environments and evaluation infrastructure for coding agents. Our users are primarily researchers, AI engineers, and domain experts who author, review, and annotate benchmark tasks. This Privacy Policy is tailored to those interactions and to the data flows specific to our operations.

By accessing or using our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use our Services.

2. Information We Collect

We collect information in the following categories:

2.1 Account Information

When you create an account on Simhub or other authenticated Metaphi surfaces, we collect:

Your name and email address via Google OAuth or Firebase Authentication
Your Firebase user identifier (UID)
Your display name and profile information as provided by Google

2.2 Expert Profile Information

If you participate as a subject matter expert (SME) through Simhub, we collect additional profile information:

Full name and display name
Email address
Country of residence and timezone
Programming language proficiencies and expertise domains
Address information (if provided for payout purposes)
Payout account details (bank name, account type, beneficiary name, and last-four digits of account and routing numbers; full payout details are stored encrypted)
Pre-qualification assessment responses

2.3 Benchmark and Task Data

Through the operation of our platform, we collect and process:

Code snippets, prompts, and ground-truth solutions authored or submitted by experts
Expert annotations, reviews, verdicts, difficulty ratings, and rationale text
Task metadata including language, type, and environment context
Files uploaded as part of code project submissions, including source code and related materials
Data from proprietary codebases acquired under data purchase agreements for benchmark construction

2.4 Agent Execution and Evaluation Data

When coding agents are executed against benchmark tasks, we collect:

Model outputs, trajectories, and tool call logs
Execution scores, metrics, and evaluation artifacts
Agent configuration details (harness type, model identifier)
Token usage statistics and execution timing

2.5 Usage and Analytics Data

We automatically collect:

Pages visited, features used, and actions taken within our Services
Browser type, operating system, device type, and screen resolution
IP address, referring URL, and general geographic location
Timestamps and session duration

2.6 Contact and Inquiry Data

When you submit a contact form, join our waitlist, or request access to our platform, we collect:

Your email address
Any message or inquiry text you provide
Your stated interest or use case

2.7 Agreement and Signature Data

When you execute agreements through our platform (such as data purchase agreements or contributor agreements), we collect:

Signer name and email address
Agreement type and version
Signature status and timestamps
DocuSign envelope metadata

3. How We Use Your Information

We use the information we collect for the following purposes:

Providing Services: To operate Simhub, Evals, and our API; to authenticate your identity; to manage your account; and to deliver benchmark evaluation results and leaderboard data.
Expert Task Workflows: To assign, manage, and track benchmark task authoring and review workflows; to facilitate expert reviews and annotations; and to process expert compensation.
Benchmark Construction: To build, validate, and publish coding agent benchmarks using expert-authored tasks and purchased codebase data; to compute evaluation metrics and leaderboard rankings.
Agent Evaluation: To execute coding agents against benchmark tasks, capture execution artifacts, and compute scores for research and leaderboard publication.
Research and Analysis: To analyze benchmark results, agent performance trajectories, and task difficulty distributions for the advancement of AI evaluation methodology.
Communication: To respond to your inquiries, send service-related notices, and provide updates about our platform and research.
Security and Integrity: To detect and prevent fraud, abuse, and unauthorized access; to enforce our Terms of Service; and to maintain the security of our infrastructure.
Legal Compliance: To comply with applicable laws, regulations, and legal processes.
Service Improvement: To analyze usage patterns, diagnose technical issues, and improve the functionality and user experience of our Services.

4. Legal Basis for Processing

We process personal information based on the following legal grounds:

Performance of a Contract: Processing necessary to provide you with the Services you have requested, including account management, task assignment, and expert compensation.
Legitimate Interests: Processing necessary for our legitimate business interests, including benchmark research, service improvement, security, and fraud prevention, where those interests are not overridden by your rights.
Consent: Where you have given explicit consent, such as when you submit a contact form or join our waitlist.
Legal Obligation: Processing necessary to comply with applicable laws and regulations.

5. How We Share Your Information

We do not sell your personal information. We share information only in the following circumstances:

5.1 Sub-Processors and Service Providers

We use the following third-party service providers to operate our Services. Each processes data only as necessary to provide services to us:

Sub-Processor	Purpose	Data Processed
Google Cloud Platform (GCP)	Cloud infrastructure: CloudSQL (PostgreSQL), Google Cloud Storage, Vertex AI	Account data, task data, execution artifacts, expert profiles
Modal	Serverless compute for API hosting and agent execution	Task prompts, agent execution inputs/outputs, API request data
HuggingFace	Dataset hosting for benchmark tasks and ground truth	Task content, ground-truth solutions, benchmark metadata
Anthropic	Claude API for agent evaluation and execution	Task prompts and model-generated outputs during evaluation runs
OpenAI	GPT models for agent evaluation and execution	Task prompts and model-generated outputs during evaluation runs
Firebase (Google)	User authentication	Email address, display name, authentication tokens
Google Analytics	Website analytics	IP address (anonymized), browser metadata, page views, session data
DocuSign	Agreement execution and signature management	Signer name, email address, agreement documents

5.2 Published Benchmark Results

Aggregate and anonymized evaluation results, including leaderboard rankings, model scores, and benchmark statistics, are published publicly on evals.metaphi.ai and may be included in research publications. Published results do not contain personal information.

5.3 Legal Requirements

We may disclose personal information if required to do so by law, regulation, legal process, or governmental request, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

5.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information.

6. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Account Information: Retained for the duration of your active account. Upon account deletion request, we delete your account data within 30 days, except as required for legal or compliance purposes.
Expert Profile and Payout Data: Retained for the duration of your engagement with Metaphi plus 7 years thereafter for tax and financial compliance purposes.
Benchmark Task Data: Expert-authored tasks, annotations, and reviews that have been incorporated into published benchmarks are retained indefinitely as part of the benchmark dataset. Attribution information may be pseudonymized upon request.
Agent Execution Artifacts: Retained for the useful life of the benchmark, typically indefinitely, as they form part of published evaluation records.
Usage and Analytics Data: Retained for up to 26 months, consistent with Google Analytics data retention settings.
Contact and Inquiry Data: Retained for up to 2 years after your last interaction with us.
Agreement Records: Retained for the term of the agreement plus 7 years for legal compliance.

7. Data Security

We implement technical and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, and destruction. These measures include:

Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher. API communications are encrypted end-to-end.
Encryption at Rest: Data stored in Google Cloud SQL and Google Cloud Storage is encrypted at rest using AES-256 encryption managed by Google Cloud.
Authentication and Access Control: Platform access requires authentication via Firebase/Google OAuth. Internal access to production systems is restricted to authorized personnel on a need-to-know basis.
Sensitive Data Handling: Expert payout account details are stored using application-level encryption with separate key management. Only last-four digits of account numbers are stored in plaintext for display purposes.
Infrastructure Security: Our backend runs on Modal and Google Cloud Platform, both of which maintain SOC 2 Type II compliance. Database access is restricted to application-level service accounts.
Monitoring: We monitor our infrastructure for anomalous access patterns and security events.

No method of transmission over the Internet or electronic storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

Access: You have the right to request a copy of the personal information we hold about you.
Correction: You have the right to request correction of inaccurate or incomplete personal information.
Deletion: You have the right to request deletion of your personal information, subject to certain legal exceptions (such as data required for compliance or incorporated into published benchmark datasets).
Data Portability: You have the right to receive your personal information in a structured, commonly used, machine-readable format.
Restriction: You have the right to request that we restrict the processing of your personal information in certain circumstances.
Objection: You have the right to object to processing of your personal information based on our legitimate interests.
Withdraw Consent: Where processing is based on your consent, you have the right to withdraw consent at any time without affecting the lawfulness of prior processing.
Revoke OAuth Access: You may revoke Google OAuth access at any time through your Google Account permissions.

To exercise any of these rights, please contact us at legal@metaphi.ai. We will respond to your request within 30 days, or within the timeframe required by applicable law. We may ask you to verify your identity before processing your request.

9. California Consumer Privacy Act (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA):

Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the business or commercial purpose for collecting it, and the categories of third parties with whom we share it.

Right to Delete: You have the right to request deletion of personal information we have collected from you, subject to certain exceptions.

Right to Correct: You have the right to request correction of inaccurate personal information.

Right to Opt Out of Sale or Sharing: Metaphi does not sell personal information and does not share personal information for cross-context behavioral advertising purposes.

Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

Categories of Personal Information Collected:

Category	Examples	Collected
Identifiers	Name, email address, Firebase UID, IP address	Yes
Professional or employment-related information	Expertise domains, programming language proficiencies	Yes
Internet or electronic network activity	Browsing history, interaction with Services	Yes
Geolocation data	Country, timezone (as provided by user)	Yes
Financial information	Payout account details (encrypted)	Yes (experts only)
Inferences	Task difficulty assessments, expertise qualifications	Yes

To exercise your CCPA rights, contact us at legal@metaphi.ai or legal@metaphi.ai. You may also designate an authorized agent to make a request on your behalf.

10. Cookies and Tracking Technologies

Google Analytics: We use Google Analytics to collect anonymized data about how visitors interact with our website. Google Analytics uses cookies to track page views, session duration, traffic sources, and general user behavior. Data collected by Google Analytics is processed by Google in accordance with Google's Privacy Policy.

Essential Cookies: We use essential cookies and local storage for authentication state management (Firebase session tokens) and OAuth state validation (CSRF prevention). These are strictly necessary for the operation of our Services and cannot be disabled.

How to Manage Cookies: You can control cookies through your browser settings. Most browsers allow you to block or delete cookies. Please note that disabling essential cookies may impair your ability to use authenticated features of our Services. For Google Analytics, you may install the Google Analytics Opt-Out Browser Add-on.

11. International Data Transfers

Metaphi, Inc. is incorporated in Delaware, United States. All personal information is stored and processed in the United States using infrastructure provided by Google Cloud Platform and Modal.

If you access our Services from outside the United States, please be aware that your information will be transferred to, stored, and processed in the United States. The data protection laws of the United States may differ from those of your jurisdiction. By using our Services, you consent to the transfer of your information to the United States.

For users in the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on the following transfer mechanisms where applicable: Standard Contractual Clauses (SCCs) as adopted by the European Commission, and the EU-U.S. Data Privacy Framework, to the extent applicable to our sub-processors.

12. Data from Purchased Codebases

As part of our benchmark construction process, Metaphi acquires proprietary codebases from third parties under data purchase agreements. These codebases are used to create benchmark tasks for evaluating coding agents. This data:

Is acquired with explicit written consent from the data owner under contractual agreements
Is used solely for the purpose of benchmark task creation, agent evaluation, and related research
May contain source code, documentation, and related technical artifacts
Does not contain personal information of the data seller's end users unless separately disclosed and consented to in the data purchase agreement
Is subject to provenance tracking and audit requirements as specified in each agreement

13. Breach Notification

In the event of a data breach that affects your personal information, we will:

Investigate and contain the breach as promptly as possible
Assess the risk of harm to affected individuals
Notify affected individuals without unreasonable delay, and no later than 72 hours after becoming aware of a breach that poses a risk to your rights and freedoms, except where law enforcement requests a delay
Notify applicable regulatory authorities as required by law
Provide you with a description of the nature of the breach, the categories of data affected, the likely consequences, and the measures taken to address and mitigate the breach

Breach notifications will be sent via email to the address associated with your account.

14. Children's Privacy

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided personal information to us, please contact us at legal@metaphi.ai. If we become aware that we have collected personal information from a child under 18 without verification of parental consent, we will take steps to delete that information promptly.

15. Third-Party Links

Our Services may contain links to third-party websites and services, including HuggingFace, GitHub, LinkedIn, and Substack. We are not responsible for the privacy practices of these third-party services. We encourage you to review the privacy policies of any third-party service you visit.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

Update the "Effective Date" at the top of this page
Post the revised policy on this page
For material changes that affect how we handle your personal information, make reasonable efforts to notify you via email or through a prominent notice on our website at least 30 days before the changes take effect

Your continued use of our Services after any changes to this Privacy Policy constitutes your acceptance of the revised policy.

17. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

legal@metaphi.ai

We aim to respond to all privacy-related inquiries within 30 days.