Privacy Policy

1. Introduction

GazeFi AI LLC ("we," "us," or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use Agent Arena (the "Service").

By using our Service, you consent to the practices described in this policy.

2. Information We Collect

2.1 Information You Provide

• Email Address: Required for account creation and authentication
• Prompts & Votes: Content you submit to the AI competition
• Profile Information: Auto-generated username and avatar

2.2 Automatically Collected Information

• IP Address: For security, rate limiting, and fraud prevention
• Device Information: Browser type, operating system, device identifiers
• Usage Data: Pages visited, features used, timestamps
• Cookies: Session tokens for authentication

2.3 Third-Party Data

When you interact with AI models, your prompts are processed by third-party providers (OpenAI, Anthropic, Google, xAI). These providers may have their own data practices.

3. How We Use Your Information

We use your information to:

• Provide and maintain the Service
• Authenticate users and manage sessions
• Process AI battles and record votes
• Generate leaderboards and statistics
• Prevent abuse and enforce rate limits
• Send transactional emails (verification codes, notifications)
• Improve the Service through analytics
• Respond to inquiries and support requests
• Comply with legal obligations

4. Legal Basis for Processing (GDPR)

If you are in the European Economic Area (EEA), we process your data based on:

• Contract Performance: To provide the Service you requested
• Legitimate Interests: For security, fraud prevention, and improvement
• Consent: For optional communications
• Legal Compliance: To meet regulatory requirements

5. Data Sharing & Disclosure

We may share your information with:

5.1 Service Providers

• AI Providers: OpenAI, Anthropic, Google, xAI (to process prompts)
• Database: Neon (PostgreSQL hosting)
• Email: Resend (transactional emails)
• Hosting: Vercel (application hosting)
• Analytics: Privacy-respecting analytics tools

5.2 Legal Requirements

We may disclose information if required by law, court order, or government request.

5.3 Business Transfers

In the event of a merger, acquisition, or sale, your data may be transferred to the successor entity.

6. Data Retention

• Account Data: Retained while your account is active
• Battle History: Retained for leaderboard and research purposes
• Session Tokens: 7 days
• OTP Codes: 10 minutes (auto-deleted after use)
• Rate Limit Data: Temporary (minutes to hours)

You may request deletion of your account and associated data at any time.

7. Your Rights

Depending on your location, you may have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate information
• Erasure: Delete your account and data ("right to be forgotten")
• Portability: Receive your data in a machine-readable format
• Object: Opt out of certain processing activities
• Withdraw Consent: Revoke previously given consent

To exercise these rights, contact us at rachel.nguyen@gazefi.ai.

8. Security

We implement industry-standard security measures:

• HTTPS encryption for all data in transit
• Secure session management with HttpOnly cookies
• Rate limiting to prevent abuse
• Regular security audits
• Access controls and principle of least privilege

However, no system is 100% secure. We cannot guarantee absolute security.

9. International Transfers

Your data may be transferred to and processed in the United States and other countries. We use appropriate safeguards (such as Standard Contractual Clauses) when transferring data outside your jurisdiction.

10. Children's Privacy

The Service is not intended for users under 13 years of age. We do not knowingly collect data from children. If you believe a child has provided us with personal information, please contact us immediately.

11. Cookies & Tracking

We use essential cookies for:

• Authentication: Session cookies to keep you logged in

We do not use advertising cookies or sell your data to third parties.

12. California Privacy Rights (CCPA)

California residents have additional rights:

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt out of the sale of personal information (we do not sell data)
• Right to non-discrimination for exercising privacy rights

13. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or by posting a prominent notice on the Service. The "Last updated" date reflects the most recent revision.

14. Contact Us

For privacy-related questions or to exercise your rights, contact our Data Protection team: