Privacy notice

Updated 29 September 2026

EMILIA Score is operated by EMILIA Protocol, Inc. This notice covers emiliascore.com and its Score workspace. For privacy questions or requests, contact team@emiliaprotocol.ai.

What you give us

For a custom marketplace-order dispute, you may explicitly share a statement and supported text files with that order's buyer, selected creator and authorized dispute reviewers. We save the submission, its participant role, time, sharing confirmations and saved-content digests with the order. Files may be safety-normalized before saving; a digest identifies that saved copy, not the truth of its contents. Submissions cannot be edited after sharing, and further submissions stop once a resolution is reserved. They are not public listings or model inputs. Ordinary order lists and account exports show submission metadata, not the private statements or file contents; participants can open those in the order's dispute evidence view. Unsubmitted text stays in page memory and clears on reload or account change. Do not include credentials, sensitive personal information or material you cannot share. Contact our privacy address for access, correction or deletion assistance; an unresolved funded order must be reconciled before workspace deletion, and deletion cannot recall copies another participant already made.

When you sign in, our authentication provider processes your email and sign-in information. Score uses your account identifier and email to identify your workspace. We store session and sign-in records so that you can use the service and sign out.

When you run an audition, we process your job description, policy, selected candidates and sample cases. Signed-in results are saved with the outputs, evaluation details, model information and reported usage. Anonymous reference results are returned to your browser without being saved as workspace auditions.

When you create an order-support job, we save its instructions and policy, worker version, the non-sensitive cases you supply, draft outputs, review decisions, edited replies, optional review notes and owner-reported review time. We retain run status and job history so that an interrupted request is not silently retried. These records are private to your Score workspace. Job case forms and unsaved review edits stay in page memory rather than browser session storage; reloads can discard unsaved edits.

For business briefs, spreadsheet cleanup and operations checklists, we save your goal, instructions, supplied text, worker version, queued attempts, returned files and review history. Choosing a local text file loads its content into the form; it is saved to Score only when you choose Save input. Unsubmitted material stays in page memory and clears on reload or account change. Saved inputs and results are private and are included in workspace export and deletion.

You can explicitly enable hourly or daily file preparation for up to seven days and 20 preparations. We save that permission's exact job instructions, helper version, named recipient, expiry, cap and use history. Each new input also needs its own unchecked-by-default schedule choice; ordinary saved inputs and older inputs remain manual. Stopping the schedule, changing the job or helper, expiry, or pausing and resuming the job prevents new dispatch under that permission. An already dispatched input cannot be recalled. Schedule records are private and included in workspace export and deletion.

When you publish a listing, we store the submitted profile, definition, optional notes and publication decision. Names, descriptions, website links and declaration-analysis counts are public, including through the profile's shareable link. File-worker listings also publish their supported work types and the builder's named data-recipient disclosure. Raw definitions and optional notes are not included in public profiles. Your saved choices and permission plans are private workspace records.

Publishing a service offer makes its title, summary, deliverables, buyer requirements, stated turnaround, revision count, price, terms version and pinned worker disclosure public. Your account email, internal seller identifier and private worker configuration are not part of the public offer. Service drafts stay private to the builder until published.

A creator storefront keeps its editable draft separate from the published page. When you publish, your chosen display name, description, specialties, demo link, processed images, public text or code samples and selected public offers become visible to visitors. Only publish material you may share, without private customer information. Image metadata is removed during processing. External demos open on their original sites. Samples are displayed as text, not executed. Storefront drafts, images and samples are included in your workspace export and deletion. Hiding a page cannot recall copies someone already saved.

Pre-sale inquiries share your chosen name and messages with the other participant. They are not public and are not sent to an AI worker. Both participants can export the conversation. Either participant's account deletion removes it from the live app for both; copies already exported cannot be recalled. Blocking prevents new messages in that conversation. Report details and moderation decisions are handled separately as described below. Check Messages for replies or review your email alert settings.

Transaction email alerts are optional and can only be enabled when sending is available. We store your preference, verified sign-in address, native identity reference, event references and delivery state in private account records. When enabled, Resend receives your email address, a generic update subject, a sign-in link and an opaque delivery reference. We do not include private messages, files or payment amounts. Signed provider events can record delivery to a mail server, delays, failures, bounces or spam complaints; delivery does not establish that you read the email. A bounce or complaint pauses future alerts to that address. Turning alerts off does not change your orders, payments or sign-in email. These private notification records are included in account export and deletion, but deleting your workspace cannot recall an email already submitted to Resend or remove provider-held records and backups. We do not automatically enroll you in marketing emails or track email opens and clicks through this feature.

A service request saves a private copy of the accepted offer, your requested result, source material and sharing confirmations in the buyer's workspace. Creating it does not dispatch or charge for work. Where paid checkout is enabled, opening checkout requires a separate price confirmation. Starting work separately sends the approved input and instructions to the exact named worker through the file-work queue. The builder's connected worker receives that task, not access to the buyer's workspace or account email. Unsubmitted service forms stay in page memory and clear on reload or account change.

The builder's order dashboard shows the order reference, accepted service and worker, status, stated due time, revision counts and total returned-file count. It does not expose your account email, source, requested result, correction notes, filenames, file contents or private work-record links. Requesting a revision separately approves sending your original source and correction note to the same named worker. The buyer's workspace retains each attempt and its review history.

Private order messages are shared only with that order's buyer and seller through Score. Each message requires confirmation before sharing. We save its text, participant role and time with the buyer's order, including it in that workspace's export and deletion. The conversation does not reveal account emails or automatically send messages to a worker. Unsent text stays in page memory. Deletion cannot recall a message already read or copied by the other participant.

If a seller payment account is connected through a verified setup, Score stores its Stripe account reference, the business country you select, accepted setup terms, setup policy, readiness status and verification timestamps. Its private request reference allows an interrupted setup to resume without creating another account. Stripe collects identity and bank information on its hosted page, not in Score's service forms. A readiness status does not itself activate seller checkout or prove a payout. Local seller-payment records and related routing references are removed during workspace deletion; Stripe's account records are separate.

For paid service orders, Score stores the order-to-payment binding, gross amount, accepted platform fee, Stripe checkout and charge references, verification status, refund or dispute state, and exact work-admission reservations. The seller can see that order's payment and fee summary, but not the buyer's private source or account email through Score. Stripe receives the public service title, amount, and opaque order and purchase references, not your private objective, source or revision notes. Card details stay on Stripe's hosted checkout. A seller's Stripe dashboard is governed by Stripe's own access and data practices.

Job-library templates are different from agent listings: publishing makes the title, summary, chosen author name, instructions, policy and synthetic examples public. Template versions and source attribution are also public. Do not include real customer cases or private business information. Adopting a template creates a private job with those instructions, not the publisher's cases, credentials, permissions or results. Copies and adaptations already made by others can remain after the original template is hidden or deleted.

Your job and worker evidence reports summarize recorded runs and owner reviews within your own workspace. They are not public ratings. The reports omit customer text, contact fields and case identifiers; you can choose to download and share them yourself. A report describes the available records, not an independent certification.

You can separately preview and publish an outcome snapshot for one saved job and one exact helper version. Only the approved preview's selected version, work profile, outcome counts, dates and integrity hash become public through a stable link and the public evidence page. Source text, review notes, filenames, private job and run identifiers, account identity, payment details and recipient disclosures are excluded. The helper identifier and version may still identify its builder. Publication is optional and never automatic after a purchase, run or review.

You can correct a published snapshot after reviewing a fresh preview. Its public record then identifies the previous revision and hash. Withdrawal removes the snapshot from the public list and replaces its link with a withdrawal notice without the old metrics. Score retains the owner's saved snapshot and mutation records privately until account deletion, including them in export. Account deletion removes these publications and withdrawal notices from the live service. It cannot remove copies, screenshots, downloads, search caches or backups already held elsewhere.

A minimal prepaid-run-pack payment-routing reference may remain after deletion so delayed notifications can be matched to a removed workspace without recreating it. It contains an internal account reference, not your email, card details or customer questions. Service-order payment routing references are removed with the workspace.

Browser drafts and cookies

Hugging Face project intake sends your public project link to EMILIA, which reads public repository metadata from Hugging Face at a fixed revision. It does not fetch private repositories, source files or model weights, execute code, or send customer files to Hugging Face. Before you continue, the project preview and editable offer stay in page memory. Continuing copies the reviewed fields into the existing browser-tab listing draft. Saving that draft stores it privately in your Score account; publication requires a separate choice. Repository metadata and license labels do not verify ownership, commercial rights, compatibility or performance.

If a business enables its customer question link, we store submitted questions, optional reply emails and consent records in that business's job. The approved business label is public; its private instructions, account details and received questions are not. The label does not verify the business's identity. Submit only to a business you trust. Contact that business or our privacy address to request correction or deletion of a question, using its receipt reference.

A business can separately enable seven days of automatic OpenAI drafting for incoming questions, pinned to its selected worker version. Pausing the job, disabling the link, changing the worker version or expiry stops new automatic dispatches. Otherwise each provider run requires a separate owner confirmation. Capacity or interruption can leave a question awaiting manual review. An already dispatched request cannot be recalled.

Your unsent job, policy, custom sample cases, shortlist and listing draft are stored in this tab's session storage so they can survive sign-in and reloads. Signed-in drafts are bound to that account. Signing out, an expired session or an account change clears private unsent drafts and loaded private views. Older unbound tab drafts are discarded; saved workspace records are not deleted. Browser session restoration may preserve same-account drafts. You can also use “Clear drafts from this tab” in My work, or clear this site's browser data. Publication and run consent are not restored from draft storage.

Unpublished job-template forms and loaded evidence reports stay in page memory and are cleared on refresh or account change. A public template identifier may be saved in this tab's session storage to return you to it after sign-in. Private job cases and review edits are not copied into template forms.

Score uses essential cookies for sign-in and sessions. The application does not include advertising trackers or an advertising-cookie system. Our hosting and authentication providers also process request and security information to operate their services.

We count visits to the homepage, the permission guides and the AI Access Review page, and clicks on the review's payment button. Each count records only the day, the page, and a short tag from the link you followed (for example ref=li). The counter stores no cookie, IP address or value derived from one, account, device details or anything you type. To limit abuse it uses one hourly cap for the whole site, not a limit per visitor. The visit counter never receives your answers in Check an AI agent. They stay in your browser unless you choose to save them in a job brief. When you press the review's payment button, the same short tag is added to the Stripe payment page address, and Stripe keeps it with that checkout.

If you buy an AI Access Review, Stripe collects your payment details on its own page and gives EMILIA Protocol, Inc. the contact details you enter there and the payment record. We keep our email with you, our session notes, your report and a private record of the review, including how you heard about it, outside the Score workspace to deliver and support the review. Screenshots are deleted as stated on the review page. Nothing about you is published. We do not promise an automatic deletion period for these records; you can ask team@emiliaprotocol.ai to delete them.

When a model provider receives your sample

When you choose EMILIA Workbench, preparing a business file sends the selected input and job instructions to OpenAI after you approve that specific worker version and run, or explicitly opt the new input into a current limited schedule. A manually queued run can start after you leave the page while the job is active and its approval is less than 24 hours old. Scheduled runs use their pinned permission's expiry, no more than seven days after it was granted. Pausing stops new dispatches, but cannot recall a request already sent. We save the returned files, questions and usage with the run. EMILIA Workbench does not open links in your source text or connect to or change outside business accounts.

When you instead choose a connected outside file worker, the approved input and instructions go to the builder's named recipient, not automatically to OpenAI. Your confirmation is tied to the displayed worker version and data-handling disclosure. The builder controls its runtime and any disclosed downstream providers. Its returned files are kept in your private job for review; Score does not independently verify its processing or recall copies already released to it. No store credentials or owner account email are included in the task.

Outside file workers can also receive future inputs that you separately opt into a valid limited schedule. The same exact-recipient and version checks apply. Work outcome reports omit source text, review notes, filenames and account/job/input/run identifiers. They retain helper identifiers, versions, aggregate outcomes and available usage measurements. Downloads are your choice and are not automatically published; sharing a report can still identify its builder.

Reference examples run deterministic code without a model-provider call. Hosted AI auditions and job drafting runs send the job description, policy and cases to OpenAI after the owner approves the run or explicitly enables the time-limited automatic intake setting. The separate customer reply-email field is excluded. A question's free text can still contain personal information; remove unnecessary details before a manual run and do not submit secrets, credentials or sensitive records.

We store the returned output and usage with your signed-in audition. Provider processing and retention are separate from your Score workspace. OpenAI describes its API handling in its API data controls. Deleting an audition from Score does not recall a request already processed by a provider.

Why we process information

With the owner's explicit per-run consent, an outside builder's connected worker receives that job's instructions, policy and selected case inputs. It does not receive store tokens, the owner's account email or the separate customer reply-email field. The builder controls its own runtime and providers, whose handling and retention must be checked before selection. Score records the returned drafts and checks, but does not independently attest that runtime or control copies it has already received. Worker tokens are stored as hashes; task indexes contain references, not copies of case input.

If you connect Shopify, we verify a dedicated read-only token and store it encrypted. Selected order lookups request order identifiers, value, currency, creation and fulfillment facts, not customer names, addresses or email fields. Imported facts and their source timestamps remain in the job. Disconnecting removes the stored token; also revoke the custom-app token in Shopify. Deleting all Score data removes owned connection records. Shopify has its own account and data practices.

We use this information to provide sign-in, show the listings you choose to publish, run and save auditions, record your choices, support export and deletion, answer support requests and protect the service from abuse. We use account-based and hashed network-based counters to enforce usage limits. Score does not sell personal information, sell ratings or use your audition content for advertising.

Services involved

When paid checkout is enabled, Stripe processes your payment on its hosted page. Card details do not pass through Score. Score stores purchase identifiers, a hashed account binding, payment-verification status and run-use reservations. We send Stripe the product, amount and opaque purchase/account references, not your customer questions or agent inputs. Stripe retains its own payment, fraud-prevention and legally required transaction records. Workspace deletion removes local purchase and run-use records but does not erase Stripe records or automatically refund a payment; keep your receipt and contact billing support to resolve unused runs.

• Vercel hosts the website and server routes.
• Supabase provides the database and authentication. Our configured email-delivery provider processes sign-in emails.
• OpenAI processes the hosted AI samples you explicitly approve. Reference samples and declaration scans do not use a model provider.

These services may process information in countries other than your own. Their service records, security logs and backups follow their applicable policies and our service arrangements. We do not promise that deleting a live Score record immediately removes all provider logs or backup copies.

Keeping, exporting and deleting records

Job-board drafts stay in the buyer's account. Publication uses a separately confirmed public description. Quotes are available to the buyer and the creator who supplied them; a creator cannot read competing private quotes. Custom order terms, milestone deliveries, revision requests and dispute evidence are available to the order participants and authorized marketplace reviewers. Public creator profiles do not expose these records. Account exports use scoped job and order views rather than internal cross-account routing and payment ledgers.

Reusable product files stay private to their seller until a paid buyer is entitled to download the reserved package. Public product pages show the description, price, file names and hashes, and license, not file contents. An unpaid buyer's export contains purchase metadata, not the paid files. A seller's later edit or deletion does not replace or remove a purchaser's reserved archive. Deleting the buyer's workspace removes that archive, but cannot recall downloaded copies.

Immediate account deletion is blocked while either party has an unresolved custom-order checkout, payment action, funded balance or open dispute. Cancel an unfunded checkout or resolve the transaction first; contact support for help with a privacy request while a transaction is pending. This prevents deletion from silently losing the record needed to release or refund money. Stripe retains its own transaction and compliance records separately. Account deletion is not a refund.

Private helper comparisons save your input, instructions and selected worker versions in your account. Saving a comparison does not send material to a worker. Each separately approved candidate receives the same frozen input through its own work record; copies remain with those private child records and results. Comparison summaries omit source text. They are not published automatically. Workspace export and deletion include the comparison and its child work records, but cannot recall material already received by a worker or its provider.

Reports submitted through Help and reports are private to the reporting account and explicitly authorized Score moderators. Reports contain the selected record reference, category, explanation, revision information and our response; do not include passwords, card details or unnecessary personal information. Your reports are included in your workspace export and removed by workspace deletion. Moderation decisions remain separately as security records: target and report references, decisions, reasons, dates and hashed staff identifiers. These records are not public and are not automatically removed with a reporter's or moderator's workspace. Contact us for an access, correction or deletion request concerning retained security records. We do not promise an automatic retention period that the service does not enforce.

Workspace export and full Score-data deletion include your service offers, orders and local service-payment records. Deletion also removes their owner-bound Stripe routing references; delayed notifications cannot restore the deleted workspace. Hiding an offer removes it from the public service list. A buyer's saved copy of an accepted offer can remain after the builder hides or deletes the original. Existing orders retain their accepted terms; starting requires the exact accepted worker version and data disclosure to remain available. Deleting a buyer's workspace removes its private order, source and work records, but cannot recall copies already delivered to an outside worker or erase Stripe's transaction records.

Saved workspace records stay available until you delete them. You can export your workspace, delete individual listings or auditions, or delete all Score data from My work. Hiding a listing removes it from Explore while retaining your private copy. Copies previously viewed, downloaded or indexed elsewhere cannot be recalled by hiding or deleting a profile.

A saved selection keeps its own copy of the tested job, policy, sample cases and selected worker's outputs, checks and version details. Deleting the original audition does not delete this selected evidence. Cancelling a selection changes its status; it does not erase the record. You can review and download the private handoff yourself; Score does not automatically send it to a builder or customer.

You can export a job with its case and review history, or include it in a complete workspace export. Pausing a job or changing its worker does not erase its prior cases or outputs. Accepting a draft does not send it. A paused job can retain a result from a provider request already in flight.

Deleting all Score data removes your Score listings, job-library templates, auditions, selections, permission plans and jobs with their case and review history, and ends your Score sessions. Workspace exports include your templates. Removing your template does not remove independent copies or private jobs created by other people. Deletion does not delete a shared EMILIA sign-in identity or records in other EMILIA products. Contact us for an identity-deletion request or a wider data request.

After a full Score-data deletion, a minimal hashed deletion marker remains to prevent in-flight requests from recreating deleted work. A fresh sign-in can create a new empty workspace; it cannot restore the deleted workspace. Usage-limit and abuse-prevention records are retained to prevent limit evasion. Expired sign-in records can remain until they are pruned or included in a full Score-data deletion. If you need information about retained security records, provider records or backups, contact us. We do not claim an automatic retention schedule that the service does not enforce.

Revoked intake indexes and worker queue or replay references can remain as server-side routing and security records. They cannot retrieve a deleted owner's job or authenticate a worker whose listing was deleted. These records do not retain copies of customer questions or store tokens. Contact us for requests concerning retained operational metadata.

Your choices and requests

You may contact us to request access, correction, export or deletion of your information, or to object to or restrict processing where applicable. You can stop future model-provider submissions by leaving the run-consent box unchecked. This does not undo completed processing. Depending on where you live, you may also have a right to complain to your privacy regulator. We may need to verify that a request concerns your account.

Use appropriate sample material

Score is intended for adults evaluating business tools. It is not intended for children or for storing sensitive customer, health or financial records. If you believe personal information was submitted in error, contact us so we can review the request.

Changes and contact

We will update this notice when the service's data practices change and show the updated date here. Questions, corrections and privacy requests can be sent to team@emiliaprotocol.ai.