Privacy notice

Last updated August 28, 2026

ABDA-NL is an academic research service operated by the iDAKS Lab at the University of Illinois Urbana-Champaign School of Information Sciences. This notice describes the data practices of this service.

What you can do anonymously

You can open bundled examples, inspect computed arguments, and make deterministic changes without registering. The application uses short-lived, pseudonymous rate-limit counters and operational request metadata to keep the service reliable. The application does not store the raw network address in its rate-limit table.

Information stored for registered users

• Your verified email address, optional display name, identity-provider issuer and subject, and login timestamps.
• Private project names, descriptions, scenario contents, versions, and timestamps.
• Trial activation, model route, token counts, cost, latency, status, and request identifiers. Model prompts and responses are not stored in usage records.
• Digests and metadata for share links and MCP credentials. The service does not retain recoverable copies of those bearer secrets.

Private project content, model prompts, and model responses are used only to provide, secure, recover, and maintain the service. They are not analyzed as research data.

Model-provider processing

When you use an AI feature, the current scenario and your instruction or question are sent to the selected model provider. Funded access normally uses Microsoft Azure Foundry through CloudBank. During a qualifying service outage, it may use the displayed OpenRouter fallback. If you bring your own key, the request is sent to the provider and model you select.

Every OpenRouter request asks for only endpoints that OpenRouter marks as Zero Data Retention and as not collecting user data. OpenRouter may still retain operational metadata such as timestamps, model names, and token counts. Availability depends on a compatible privacy-preserving endpoint being online.

Do not submit confidential information, sensitive personal information, unpublished restricted data, or material that you are not authorized to send to the selected provider.

A bring-your-own key is held in memory for the current browser tab, sent with the model request, and not saved in browser storage, a cookie, a project, a share link, the application database, or an application log. Model providers process requests under their own terms and privacy notices.

Cookies and security logs

The service uses a signed, secure session cookie after login. It does not use advertising cookies. Managed hosting, identity, database, and model services may create security, billing, and availability logs. Application request logs use normalized route names and do not record query strings.

Retention and deletion

Account and project records remain available while the service is operating unless you request deletion. Deleting a project in the interface archives it. Application and managed container logs are retained for up to 30 days. Database backups are retained for 7 days, so deleted material may remain in a backup until that backup expires. Short-lived rate-limit records expire automatically.

To request access, correction, or permanent deletion, email privacy@abda-nl.org. Do not include an API key, share link, MCP token, or other secret. After verifying the request, the project team will complete it within 30 days. General service questions can be sent to support@abda-nl.org.

Changes to this notice

Material changes will be posted here with a revised date. This research service may also publish a release note when a change affects model routing or stored user data.