Privacy Policy

Olio LLC operates DotMock and is responsible for personal information covered by this Privacy Policy ("Policy"). This Policy applies to dotmock.com, mock.new, DotMock applications, APIs, command-line tools, MCP services, mock runtimes, and related services (collectively, the "Service").

For privacy questions or requests, email [email protected] or use the DotMock contact page.

Account and identity information

• Name, email address, password hash, profile image, and company information you provide.
• GitHub or Google account identifiers and profile information when you use OAuth.
• Organization memberships, team invitations, roles, permissions, and selected workspace.

Customer Content and configuration

• API definitions, schemas, fixtures, examples, state, rules, test cases, environment configuration, and workspace settings.
• Content submitted through the dashboard, API, CLI, MCP, imports, support requests, or collaboration features.
• Secrets or credentials you intentionally configure for an integration. Sensitive values may be encrypted, masked, or excluded from browser responses depending on the feature.

Runtime, traffic, and delivery information

• Request method, URL or path, query parameters, headers, cookies, request body, response, status, timing, and source IP address.
• Realtime connection, message, and duration metadata; webhook triggers and outbound attempts; proxy interactions; and inspection records.
• State changes, audit events, errors, retry behavior, and other runtime diagnostics.

Dot and provider-backed information

• Prompts, instructions, selected workspace context, tool calls, attachments, provider inputs, outputs, and feedback.
• Model, provider, token and caching metadata, latency, reported cost, reserved cost, reconciliation status, and error information.

Billing and usage information

• Plan, billing interval, Stripe customer and subscription identifiers, invoice and payment status, tax-related information, and billing contact details.
• Usage-balance grants, charges, reservations, reloads, expiration, auto-reload settings, monthly caps, and idempotency records.
• Stripe processes payment-card information. DotMock does not store complete payment-card numbers.

Device, analytics, and communications information

• IP address, browser, operating system, device information, referring page, pages viewed, interactions, and approximate location derived from IP address.
• Error reports, performance traces, and limited session diagnostics. Where session replay is enabled, configured controls mask text and block media.
• Contact requests, support conversations, email delivery events, newsletter choices, and service notifications.

We collect information:

• Directly from you and your organization administrators.
• Automatically when you use the website, product, APIs, CLI, MCP, and mock runtimes.
• From authentication, payment, infrastructure, analytics, error monitoring, email, and model-provider services.
• From collaborators and systems that send traffic or content to a workspace you control.

• Provide, authenticate, secure, meter, support, and maintain the Service.
• Create and run mock environments, process Customer Content, route provider-backed requests, and return outputs.
• Process subscriptions and reloads, maintain usage-balance records, prevent duplicate charges, and reconcile provider costs.
• Diagnose failures, prevent fraud and abuse, enforce the Terms, and protect users and infrastructure.
• Measure product reliability and usage, improve workflows, and understand website performance.
• Send transactional messages, respond to requests, and send marketing communications when permitted.
• Comply with law, legal process, tax requirements, and enforceable government requests.

Where applicable, we process personal information based on:

• Contract: to provide the Service, authenticate accounts, process requested operations, and administer billing.
• Legitimate interests: to secure and improve the Service, prevent abuse, support users, and understand product performance, balanced against your rights.
• Consent: for optional processing when we specifically ask for your consent. You may withdraw consent at any time.
• Legal obligation: to satisfy accounting, tax, compliance, and lawful-request requirements.

Dot and other provider-backed features use OpenRouter. Inputs may be routed by OpenRouter to a downstream model provider selected by DotMock, OpenRouter, or you. Inputs can include prompts, workspace context, tool arguments, attachments, and personal information included in that content. Outputs and usage metadata return through the same provider path.

OpenRouter and downstream providers have their own retention, training, security, and geographic-processing practices. Provider practices can vary by model and endpoint. Do not submit personal, confidential, regulated, or production data unless you have authority to do so and the selected provider path is appropriate.

Olio LLC does not use Customer Content to train a general-purpose model unless we first provide a separate notice and obtain any consent required by law.

We disclose information only as needed for the following purposes:

• Service providers: infrastructure, databases, caching, security, email, analytics, error monitoring, customer support, and payment processing.
• OpenRouter and model providers: to perform provider-backed operations you request.
• Your organization: administrators and collaborators can access shared workspaces, content, activity, and billing information according to their roles.
• Legal and safety: to comply with law, protect rights and safety, investigate abuse, and enforce agreements.
• Business transactions: in connection with financing, due diligence, merger, acquisition, reorganization, or sale of assets, subject to appropriate safeguards.
• At your direction: when you connect an integration, publish content, invite a collaborator, or otherwise ask us to disclose information.

• Stripe for payments, subscriptions, invoices, and reloads.
• OpenRouter and downstream model providers for provider-backed authoring.
• Cloudflare for network delivery, routing, and security services.
• Resend for transactional email delivery.
• Sentry for error and performance monitoring.
• PostHog for product analytics.
• Google Analytics for website analytics.
• GitHub and Google for optional OAuth authentication.

Providers may change as the Service evolves. We will update this Policy when a change materially affects how personal information is processed.

We use cookies, browser storage, and similar technologies for account sessions, security, selected-organization state, product configuration, payment flows, and analytics. These may include:

• Essential authentication, security, billing, and selected-workspace data.
• Stripe and Cloudflare technologies used for payment and security functions.
• Google Analytics, PostHog, and Sentry technologies used to understand reliability and product usage.

Google Analytics loads only after a product interaction. PostHog and Sentry may initialize on product routes. Browser controls can block or remove cookies, but blocking essential storage may prevent parts of the Service from working.

We keep personal information only for as long as reasonably necessary for the purposes described in this Policy, including:

• Account, organization, and workspace data while the account is active and for a limited period afterward for recovery, security, dispute, and legal purposes.
• Runtime traffic, webhook delivery, realtime, proxy, and inspection data for the period shown in the relevant product surface or documentation. Retention varies by protocol, record type, and plan, and some records are intentionally short-lived.
• Provider-cost reservations and usage records long enough to reconcile charges, investigate errors, prevent duplicate billing, and maintain financial records.
• Subscription, invoice, tax, transaction, and audit records for the period required by accounting, tax, fraud-prevention, and legal obligations.
• Support and legal communications as needed to respond, maintain an audit trail, and resolve disputes.

Backups and de-identified records may remain for a limited period after deletion. We may retain information longer when required by law, legal hold, security investigation, or dispute.

We use administrative, technical, and organizational measures designed to protect personal information. No system or transmission method is completely secure, and we cannot guarantee absolute security.

You control important safeguards, including account credentials, API keys, team membership, workspace visibility, mock authentication, and the data sent to runtime or provider-backed features. Do not send production secrets or sensitive personal information to a mock endpoint unless it is intentionally configured for that use.

Depending on your location, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal information. You may also have the right to withdraw consent, appeal a request decision, or complain to a data-protection authority.

• Update available profile and organization information in product settings.
• Cancel a subscription or disable auto-reload in billing settings.
• Unsubscribe from marketing through the message or contact us. Service and security messages may still be sent.
• Submit a privacy request to [email protected].

We may need to verify your identity and authority before completing a request. We will respond within the period required by applicable law. Some information may be exempt from a request.

California law may provide rights to know, access, correct, delete, and receive information about categories of personal information, sources, purposes, and recipients. It may also provide rights to opt out of sale or sharing, limit certain uses of sensitive personal information, use an authorized agent, and receive non-discriminatory treatment.

Olio LLC does not sell personal information for money. We do not use Customer Content or account data for cross-context behavioral advertising. If an analytics disclosure is treated as "sharing" under applicable law, you may submit an opt-out request to [email protected].

Olio LLC and its service providers may process information in the United States and other countries that may have different data-protection laws. Where required, we use recognized transfer mechanisms or other appropriate safeguards. You may contact us for information about applicable safeguards.

The Service is intended for adults and is not directed to children. You must be at least 18 years old to create or use an account. If we learn that we collected personal information from a child contrary to this Policy, we will take appropriate steps to delete it.

Organizations using DotMock may act as the controller or business for personal information they place in Customer Content. Those organizations are responsible for providing required notices, obtaining permissions, responding to rights requests, selecting appropriate provider paths, and avoiding unnecessary sensitive data. Olio LLC processes that Customer Content to provide the Service.

We may update this Policy. We will change the effective date above and provide additional notice when a change materially affects your rights or our processing. Prior versions may be requested by emailing us.

Contact Olio LLC about this Policy or a privacy request at [email protected] or through the DotMock contact page.