Data processing
How Preworld Review handles personal data under the UK GDPR. For the legal terms, see the draft Data Processing Agreement and Privacy Policy; for the technical measures, the security overview.
Roles
- Your content (projects, tests, test files, what your agent did, reports, repository code in a sandbox): you are the controller of any personal data in it and NICETO LTD is your processor. We process it only to provide the service, on your instructions.
- Account and billing data (who uses the service and who pays): NICETO LTD is the controller.
The service is built for test environments and test data. Our Acceptable Use Policy asks you not to put production systems or real customers' personal data into it, so your content should hold little or no real personal data.
What personal data we process
| Category | Examples | Why | Role |
|---|---|---|---|
| Account data | Email address, name (optional), organization membership and role, language preference | Sign-in, access control, contacting you about the service | Controller |
| Sign-in and device data | Sessions, CLI devices and test runners (with the label you or the machine's hostname gives them) | Keeping you signed in; letting your tools act for you | Controller |
| Service logs | IP addresses and requests in the control plane's logs; assistant usage counters | Security, abuse prevention, troubleshooting, spending limits | Controller |
| Your content | Tests, test files, datasets and their rows, conversations with your agent or chat AI, tool calls, data snapshots from your test backend, reports, experiments and their scores, human reviews, assistant conversations; source code while a sandbox runs; the traces your app sends through the SDK, OpenTelemetry or the AI Gateway (the inputs and outputs of its model and tool calls) | Running the tests, storing and scoring the traces, and producing the reports you ask for | Processor |
| Billing data Planned | Billing contact, company details, invoices. Card details are held by Stripe, never by us | Charging for the service | Controller |
| Usage analytics Planned | Only for visitors who accept it in the cookie banner: page addresses, clicks, scrolling, page layout (in the web app with every text hidden), browser and device | Seeing how people use the web app and this site (cookies) | Controller |
Sub-processors
| Sub-processor | What for | Data involved | Location | Status |
|---|---|---|---|---|
| Google Cloud | Hosting: servers, database, object storage, backups, secrets, logs, sandbox virtual machines (unless a project chooses Azure). Vertex AI: the platform's models Gemini 4 Argon and Gemini 3.8 Flash, for a project that uses one (its judge, its platform AI, its agent's model calls, a chat AI tested on it), and the embeddings for the similarity checks | Hosting: everything the service stores. Gemini 4 Argon and Gemini 3.8 Flash: what is sent to the model and what it replies (as for Microsoft Azure's models below). Embeddings: the texts compared, such as a reply and its reference answer | Hosting and embeddings: London, UK (europe-west2). Gemini 3.8 Flash: Vertex AI's global endpoint, which may process data in any region Google serves it from | In use |
| OpenAI | No longer the platform's default for the judge, the assistant or your agent's model calls: since 9 October 2026 these use the project's model (Microsoft Azure or Google Cloud). Used only where a setup still names an OpenAI model, such as an older review.yaml judge setting | The text being graded (questions, replies, excerpts of evidence), where such a setup names an OpenAI model | United States | Only where a setup names an OpenAI model |
| Anthropic | Judge model or assistant, when configured to use a Claude model | As for OpenAI | United States | When configured |
| Microsoft Azure (Azure AI Foundry; virtual machines) | Azure AI Foundry: the platform's models GPT-6.1 Sol and GPT-6 Luna, for the judge, the platform AI (the assistant and its other steps), your agent's model calls when its project has no OPENAI_API_KEY, and a chat AI you test on a platform model. Sandbox virtual machines: the runs of a project whose sandbox cloud is set to Azure | Models: what is sent to the model and what it replies: the system prompt, the questions and conversation turns, the text being graded (questions, replies, excerpts of evidence), assistant conversations and what the platform AI reads for its steps, and what your agent sends its model. Sandbox virtual machines: what such a run needs and produces while it runs (the repository code or container image, the tests and test files, the project secrets, what your agent does and outputs), deleted with the virtual machine when the run ends | Models: Global Standard deployments, which may process data in any Azure region. Sandbox virtual machines: Sweden Central (EU) until UK South (London) is available to us | Models: in use. Sandbox virtual machines: only for a project you set to Azure |
| Microsoft Clarity | Usage analytics of the web app and this site | Only for visitors who accept it: page addresses, clicks, scrolling and mouse movement, page layout with every text hidden in the web app (pages with reports, logs, tests or projects are never recorded), browser, device and screen size, IP address. Never names, email addresses or our identifiers | [to be confirmed]: Microsoft's data centres, possibly the United States | Planned; only with the visitor's consent |
| Stripe | Payments, subscriptions and invoices | Billing contact, company details, payment method | [to be confirmed] | Planned |
| Email provider [to be confirmed] | Sign-in links and run notifications | Email address and the message | [to be confirmed] | Planned |
| Status page provider [to be confirmed] | Public status page and incident notices | Email address, if you subscribe | [to be confirmed] | Planned |
Not sub-processors: GitHub (your own provider; we read the repositories you select, with your permission), and the model providers your agent under test calls with your keys (you choose them and contract with them). The platform's models are different: the platform calls them with its own accounts, so Microsoft Azure and Google Cloud are our sub-processors for them, including when they answer your agent because its project has no OPENAI_API_KEY (your agent's model); the same goes for sandbox virtual machines on Azure, which run in our Azure subscription.
We will tell customers before adding or replacing a sub-processor, so you can object; the notice period is in the DPA.
Where data is stored
Everything we store stays in Google Cloud's London region (europe-west2), including backups. Sandbox virtual machines run there too, unless a project chooses Azure as its sandbox cloud: that project's runs then use virtual machines in Microsoft Azure's Sweden Central region (EU), moving to UK South (London) once it is available to us. Such a virtual machine holds the run's code, test data and output only while the run lasts and is deleted afterwards; what the run keeps (the run bundle) is stored in London like any other. Auto, the default, and Google Cloud keep sandboxes in London.
Personal data leaves the UK only when it is sent to a sub-processor located elsewhere (the providers of the platform's models: Microsoft Azure's Global Standard deployments and Google's Vertex AI global endpoint, which may process it in any of their regions; Microsoft Azure when you set a project's sandbox cloud to Azure; an OpenAI or Anthropic model where a setup names one; Microsoft Clarity for visitors who accept it; and Stripe once billing starts); those transfers rely on the safeguards set out in the Privacy Policy.
Retention
- Evidence files and sandbox logs: 90 days by default, set per organization.
- Reports and verdicts: for as long as your account exists.
- Source code cloned into a sandbox: deleted with the virtual machine when the run ends.
- Deleted projects: permanently deleted 30 days after deletion; on a written request, at once.
- Backups: up to 90 days.
Some of these are still being automated; the retention table shows what is in place today.
Personal data breaches
If a personal data breach affects your data, we notify you without undue delay and at the latest 72 hours after we become aware of it, with what we know, what we are doing and whom to contact, and we keep you updated. You remain responsible for notifying the ICO and individuals where your data is concerned; we help you with the information you need.
Requests and questions
Write to huanting.w@nice2.io to exercise a data protection right, to ask for deletion, or to request the signed DPA. For security issues, write to huanting.w@nice2.io.