Privacy policy
How JsonEval handles your data when you visit the website, use the application or run an evaluation.
Last updated :
Who this policy applies to
JsonEval is published by EQOLUX SAS, registered with the Saint-Malo Trade and Companies Register under number 883 206 146, with its registered office at 37 rue de l’ancienne gare, 22240 Plévenon, France. EQOLUX SAS is the data controller for account data and service operations.
This policy covers visitors to jsoneval.com and users of the JsonEval application. It describes processing related to accounts, workspaces and evaluation features. It does not replace the terms of AI service providers.
The organisation using a workspace determines which documents and information it uploads. It must check that it is authorised to process them and send them to the chosen providers. Avoid importing personal data that is not needed for your evaluation.
The data we process
The data processed depends on the features you use:
- Account: email address, account identifier and profile information, including the name supplied by Google if you choose Google sign-in. Supabase manages the authentication session.
- Workspace: members, project names, uploaded PDFs, images or text, JSON structures, prompts, reference values (gold), predictions and evaluation results.
- Operations: versions, task statuses, selected models, call estimates and costs, correction history, assistant conversations and technical logs needed for operations and security.
Why we use this data
Account and project data is used to provide the requested service: signing in, sharing a workspace, keeping references, comparing models and displaying results. This processing is based on performing the contractual relationship connected with your use of the service.
Information needed for support, abuse prevention and security is processed on the basis of our legitimate interests. Some information may also be retained to meet an applicable legal obligation. An account is required to use the application; project content depends on what you choose to add.
What is sent to AI models
A paid model call requires confirmation after a visible cost estimate. This cost confirmation authorises the action; it is distinct from GDPR consent. Extraction sends selected documents and the prompt through OpenRouter to the model and its provider. Semantic scoring sends gold values and predictions to a judge model. Assisted schema preparation sends the prompt to a model; gold prefilling uses the documents and prompt.
The pilot assistant receives your message, conversation history, initial requirement and prepared project context: schema, prompt, relevant metadata and summaries. Its automatic context does not directly read binary files, gold values or predictions from the workspace. The prompt, messages, history, metadata and diagnostics may, however, contain data supplied in the service and be sent.
JsonEval does not use your content to train its own models. Retention rules and possible use for training depend on OpenRouter and the model provider. Review their policies before selecting a model for your documents.
Who can access the data
Workspace members can access projects, documents, references, results and collaboration information, including member names, email addresses and presence. Assistant conversations are private to their author in the application. Authorised support or operations personnel may access information needed for their work.
Providers used are Supabase (authentication, database, storage), Netlify (website), Railway (workers), OpenRouter and the model provider (AI), Google (optional sign-in), and jsDelivr (fonts). The CDN receives your IP address when fonts load. Documents are stored in private Supabase storage with workspace access controls.
Processing outside Europe
Some operations are processed outside the European Economic Area. Processing locations and protection frameworks are described in the relevant providers’ documents linked below. You can ask our contact for details about transfers applicable to the service.
Retention and deletion
Content is retained while accounts and projects are maintained in the service. You can delete documents in the application. Contact us to request deletion of data, an account or a workspace.
Deleting an item in the interface does not necessarily purge all related files. Gold correction histories, including values before and after edits, may remain, as can logs and backups. Retention depends on security, traceability, technical constraints and legal obligations. Deletion requests are assessed against these criteria.
Browser storage and the demo
Your browser stores your session, language and theme preferences, and certain prompt, JSON and message drafts and selections. A draft’s recovery period does not guarantee automatic deletion. You can clear this through browser settings, which may remove drafts or sign you out.
The website and app currently include no advertising tracker or audience-measurement SDK. Hosting providers keep technical logs. The public demo uses only static fictional data and makes no AI calls.
Your rights and how to contact us
Subject to the conditions set by applicable law, you can request access, rectification, erasure, restriction, objection or portability of your data. Where processing is based on consent, you can withdraw it without affecting previous processing.
Email the address below with your request and information that lets us identify the relevant account. Identity verification may be necessary. We respond within one month, subject to extensions and exceptions provided by law. You can also lodge a complaint with the French data protection authority, the CNIL.