Privacy Policy

1. Introduction

Pome (“we,” “our”) is incorporated in England and Wales, with its registered office in London, United Kingdom. We build Simulation Testing Infra for AI Agents: stateful digital clones and replayable audit logs so teams can test agent workflows before production.

This Privacy Policy describes how we collect, use, disclose, and protect information when you use our website (pome.sh), platform, APIs, SDK, and related services (collectively, the “Services”). We are committed to protecting your personal data and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data Controller

Pome is the data controller for personal data collected through the Services. If you have questions about how we handle your data, contact us at founders@pome.sh.

3. Information We Collect

a. Information You Provide

• Account and contact information (name, email address, company name) when you sign up, request closed beta access, or contact us.
• Payment and billing information if you use paid features of the platform.
• Communications you send to us, including support requests and feedback.

b. Information Collected Automatically

• Website analytics: Pages visited, referral source, browser type, and device information via Vercel Analytics. We do not use third-party tracking cookies.
• Platform usage: Agent run metadata, digital clone interactions, execution traces, audit logs, and configuration data needed to operate the Services for your account.
• SDK and API telemetry: Request metadata, error reports, and performance signals when you integrate our SDK or call our APIs to test agent workflows. We do not use this data to train models on your proprietary agent logic without your consent.

4. How We Use Your Information

We use data solely to provide and improve our Services. We will never sell your personal data to third parties.

• Provide, maintain, and improve the Services.
• Run agent evaluations, digital clones, and audit trails on your behalf.
• Process transactions and send transactional communications.
• Respond to your requests, comments, or questions.
• Send product updates and marketing communications (you may opt out at any time).
• Detect, prevent, and address fraud, abuse, or technical issues.

5. Lawful Basis for Processing (GDPR)

Under the UK GDPR, we rely on the following lawful bases:

• Contract: Processing necessary to perform our contract with you (e.g., operating your account and delivering the platform).
• Legitimate interests: Analytics, fraud prevention, and product improvement, where these interests are not overridden by your rights.
• Legal obligation: Where processing is required to comply with applicable law.
• Consent: For marketing communications. You may withdraw consent at any time.

6. How We Share Your Information

We do not sell your personal information. We may share data with:

• Service providers who help us operate the platform (hosting, analytics, payment processing), bound by data processing agreements.
• Legal obligations: When required by law, regulation, court order, or legal process.
• Business transfers: In connection with a merger, acquisition, or sale of assets, with notice to you where required.

7. International Data Transfers

Some of our service providers are based outside the UK or European Economic Area. Where we transfer personal data internationally, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses or UK International Data Transfer Agreements) in accordance with the UK GDPR. We also take reasonable steps to comply with applicable US privacy laws for users based in the United States.

8. Data Retention

We retain personal information for as long as your account is active or as needed to provide you with the Services. Agent run logs and audit data are retained according to your plan tier and deleted or anonymised upon request, subject to legal obligations.

9. Security

We implement technical and organisational security measures to protect your information, including encryption in transit (TLS), encryption at rest where applicable, access controls, and regular security reviews. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

10. Your Rights

Under the UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data (“right to be forgotten”) where applicable.
• Restrict or object to certain processing.
• Data portability: receive your data in a structured, machine-readable format.
• Withdraw consent for consent-based processing at any time.

To exercise any of these rights, contact us at founders@pome.sh.

11. Children's Privacy

Our Services are not directed to children under 13 (or under 16 where required by local law). We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us so we can promptly delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the “Last updated” date. Where required by law, we will notify you directly.

13. Contact Us

If you have questions about this Privacy Policy or how we handle your data, contact us at founders@pome.sh.

Pome · London, United Kingdom.