What Pharos collects, and what it deliberately does not.

The controller for account data and the processor for workspace data is [NEEDS COUNSEL: registered entity name and address], governed by the laws of [NEEDS COUNSEL: governing jurisdiction].

Privacy questions go to [NEEDS COUNSEL: monitored privacy contact address]. For workspace data processed on your behalf, the data processing agreement governs.

Account data. Your email address, your name if you supply one, your workspace name and shape, and the role and organizational details you enter during setup. This is used to create and secure your workspace.

Provider credentials. The reporting or admin billing keys you choose to connect. These are encrypted with AES-256-GCM before storage and are used only to call the usage and cost endpoints listed on the security page.

Spend and usage records. The aggregates those endpoints return: token and request counts, line items, and amounts, grouped by model, project, key, team, or member where the provider supplies that dimension. Plus any invoice or usage export you upload.

Operational logs. Sign-in events, sync outcomes, and error diagnostics, used to keep the service running and to investigate incidents.

Pharos does not read prompts, completions, embeddings, uploaded files, or any other content you send to a model provider. This follows from which APIs it calls: the connectors request billing and usage aggregates, and those endpoints do not return message content.

Pharos does not sell personal data, does not use your workspace data to train models, and does not use it to serve advertising.

Where you opt into peer benchmarks, Pharos contributes aggregate figures from your workspace to a cohort of companies matching your industry and size. A cohort is published only once it reaches the minimum cohort size, one vote per company, and is reported as percentiles rather than averages. No provider account, key, project, person, or workspace name enters a cohort.

Pharos relies on the subprocessors named on the security page: managed PostgreSQL and identity, a cache, transactional email, and an inference router used by the advisor with zero-data-retention handling requested. That list is the complete set, and changes to it are notified under the data processing agreement.

Spend and usage records are retained for the life of your workspace, because the product’s purpose is historical comparison and a deleted period cannot be reconciled later. Specific retention windows for operational logs, deleted workspaces, and backups are [NEEDS COUNSEL: retention periods for logs, deleted workspaces, and backups].

Deleting a connection removes its stored credential immediately. Deleting a workspace removes its records within [NEEDS COUNSEL: deletion window].

Depending on where you live, you may have rights to access, correct, export, or delete personal data, and to object to or restrict processing. Requests go to [NEEDS COUNSEL: monitored privacy contact address] and are answered within [NEEDS COUNSEL: statutory response window for the governing jurisdiction].

Data is processed in [NEEDS COUNSEL: hosting regions]. Transfer mechanisms for processing outside your region are [NEEDS COUNSEL: SCCs or equivalent transfer mechanism].

Material changes to this policy are notified in-product and by email before they take effect. This document was last revised on [NEEDS COUNSEL: publication date, set at review].