// LEGAL
Privacy Policy
Effective date: 3 August 2026 · JHOSEN AI CONSULTANCY (Reg. No. 202503255365 / JR0181827-X)
1. Who we are
JHOSEN AI CONSULTANCY (Registration No. 202503255365 / JR0181827-X), operating the OAG platform at jhosen.com. Contact: me@jhosen.com.
2. What we collect
Account data: email address, organisation name, API key usage metrics.
Audit data: the repository URL you submit, audit findings, severity classifications, and Merkle roots.
Technical data: IP address and request logs, retained up to 30 days for security and abuse prevention.
3. What we never collect
Your source code is not retained. Repositories are processed in ephemeral workspaces and purged on job completion. We do not use customer code for model training, benchmarking, or any secondary purpose. We do not sell personal data. We have no advertising business.
4. Why we process it
To deliver the audit service you requested, to enforce subscription limits, to maintain the integrity of the Merkle audit chain, and to meet our own legal obligations. Processing is grounded in contract performance and legitimate interest.
5. Retention
Audit findings and Merkle roots: retained while your account is active, deletable on request. Request logs: 30 days. Billing records: as required by Malaysian tax law (generally 7 years).
6. Your rights
Depending on your jurisdiction (Malaysia PDPA 2010, EU GDPR, California CCPA/CPRA), you may have rights to access, correct, export, or delete your personal data, and to object to processing. Exercise them by emailing me@jhosen.com. We respond within 30 days.
7. International transfers
Data may be processed in Malaysia and, where you choose cloud-hosted model providers, in the provider's region. Self-hosted Enterprise deployments process data exclusively within your infrastructure.
8. Cookies
This site uses no advertising or tracking cookies. We use only the storage strictly necessary to operate the service (e.g., session state).
9. Changes
Material changes will be announced on this page and, for account holders, by email, at least 14 days before taking effect.