Privacy Policy

01. Overview & Core Commitment

OverFit LLC ("OverFit", "we", "us", or "our") respects the privacy of our corporate clients, research partners, and teleoperation dataset contributors. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit overfitlab.dev, interact with our APIs, or transact within our Physical AI multimodal dataset exchange.

We adhere to the privacy principles of data minimization and purpose limitation under the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and applicable United States commercial privacy laws.

02. Industrial Telemetry vs. Personal Data

03. Information We Collect

• Contact & Inquiry Data: Your name, business email address, organization/university affiliation, and inquiry specifications submitted via our direct contact modal or email.
• Commercial & Transactional Information: SOW contractual metadata, billing corporate entity name, jurisdiction, and payment confirmation IDs processed via PCI-DSS compliant banking networks (e.g. SWIFT/ACH wire transfer references, Stripe).
• Device & Network Telemetry: IP addresses, browser user agent, referral headers, and server access timestamps collected for DDoS mitigation, bot defense, and Cloudflare security edge filtering.
• Auto-QA Verification Signatures: Ed25519 cryptographic hashes, dynamic task nonces, and trajectory kinematics metadata generated during dataset validation.

04. How We Use Your Information

• To execute B2B data licensing contracts, generate formal invoices, and settle bounty payouts.
• To authenticate and run Serverless Auto-QA physics validation algorithms against uploaded dataset packages.
• To respond to technical inquiries, sample requests, and customer support communications.
• To fulfill mandatory United States tax, accounting, and anti-money laundering (AML/KYC) compliance obligations.

We never sell, rent, or trade your personal or corporate contact information to third-party advertisers or data brokers.

05. Third-Party Service Providers

We share relevant technical and transactional data with reputable, enterprise-grade service providers operating under strict confidentiality and security terms:

• Cloudflare Inc. — Edge DNS, Pages hosting, D1 database, and R2 zero-egress encrypted object storage.
• Modal Labs / Cloud Compute — Ephemeral serverless containers for automated physics verification.
• Regulated Banking & Payment Partners — US banking partners (Mercury) and payment gateways (Stripe) for B2B financial settlement.

06. Your Data Privacy Rights (GDPR & CCPA)

Depending on your location, you have the right to:

• Request confirmation of whether we hold your personal contact information and obtain a copy.
• Request rectification of inaccurate corporate contact details.
• Request deletion of your non-transactional personal records ("Right to be Forgotten"), subject to mandatory statutory tax and accounting retention laws.
• Opt-out of any non-essential communications.

To exercise any of these rights, email us at contact@overfitlab.dev. We respond to all verified requests within 30 days.

07. Data Security & Storage

We maintain technical and organizational safeguards including TLS 1.3 encryption in transit, AES-256 encryption at rest on Cloudflare R2, isolated least-privilege infrastructure credentials, and cryptographic integrity validation on all dataset files.