Effective 21 Oct 2026

Privacy policy

BB Arena has no accounts or advertising, and our visitor statistics don't use cookies or identify you. This page explains the little personal information we do handle, mostly when you email us, and what your rights are.

Who we are

BB Arena is run by Marius du Preez, trading as MDP SEC, in Australia ("we", "us"). We're responsible for the personal information described here. Contact us at [email protected].

Browsing the site

The site is a set of static pages. There are no accounts, sign-up forms or advertising, and we don't set cookies ourselves. Fonts and images are served from this site, not from third parties.

The site is delivered by Cloudflare. Like any web host, Cloudflare processes technical information needed to deliver pages and protect the site from attacks and abuse, such as your IP address, browser type and the pages requested. As part of that protection, Cloudflare may set a small, strictly necessary security cookie (for example __cf_bm); it isn't used for tracking or advertising.

Visitor statistics

To see how the site is used, we use Cloudflare Web Analytics. When a page loads, a small Cloudflare script records the page you viewed, the site that linked you here, your browser, operating system and device type, your country, and how quickly the page loaded. It doesn't use cookies or store anything on your device, and it doesn't follow you across other websites.

We only see the totals, such as page views, top pages, referring sites, countries and loading speed. We can't see or identify individual visitors, and we don't combine these statistics with anything else.

When you email us

Our email is provided by Google Workspace. When you contact us, we receive your name, email address and whatever you include in your message, along with details such as your organisation. We use this to reply, to discuss and run evaluations or sponsored runs, to discuss and arrange licences for our labs (including any non-disclosure agreement), and to keep a record of the conversation.

Evaluation requests and API access

If you ask us to evaluate a model, you may send API keys, endpoints or other access details. We treat these as confidential: they're stored securely, accessible only to us, used only to run your evaluation, never shared, and deleted when the evaluation is finished. We recommend issuing a dedicated key that you can revoke afterwards.

Published results describe AI models, not people. They contain benchmark figures only and no personal information.

Pack downloads

When we send an evaluation pack or a licensed set of labs under a signed agreement (a non-disclosure agreement or a licence), we send a private download link on delivery.blackboxarena.ai. For each link, our delivery service stores the recipient's name, company and email address, which pack it is for, the email address of the team member who created it, and when the link was created, when it expires and whether it was withdrawn. Links are looked up by a one-way hash of the link, and for links created from 21 October 2026 a copy of the link is also kept encrypted, so that the team can send the same link to the same recipient again. It is readable only by our delivery service, is shown only to our own signed-in team, and is deleted with the link record.

Each time the pack is downloaded, the service records the time, the IP address the request came from, the network provider that address belongs to (its name and number), the approximate location Cloudflare derives from it (country, region and city), the browser or download tool used (its user agent), which part of the file was requested and whether it was served. Opening the download page itself is recorded in the same way, with the same details and the same retention. It also records when a team member copies a link again or replaces it, and which team member did so. The download pages set no cookies of their own. Our own team signs in with Cloudflare Access to create links, which sets a sign-in cookie for them only.

We use this to deliver the pack under the agreement, to check that the link is used by the recipient's organisation as the agreement requires, and to troubleshoot downloads that go wrong. The service runs on Cloudflare (Workers, D1 and R2 storage, and Cloudflare Access for our sign-in), which also processes the technical data described under "Browsing the site". Link and download records are deleted automatically two years after the link expires or is withdrawn. To ask for them to be deleted sooner, email [email protected].

Why we use your information

• Replying to you, running evaluations and licensing labs: to take steps you've asked for, or our legitimate interest in running the benchmark and our business.
• Delivering packs: to carry out the agreement the pack is sent under, and our legitimate interest in checking that download links are used by the recipient's organisation and in troubleshooting downloads.
• Keeping the site secure: our legitimate interest in protecting the site and its visitors.
• Visitor statistics: our legitimate interest in understanding how the site is used and keeping it fast.
• Financial records for sponsored runs and lab licences: to meet our legal obligations, such as tax record-keeping.

How long we keep it

• Emails, evaluation and licensing correspondence: for as long as we need them for the conversation, then up to two years as a record. Signed agreements are kept for as long as they apply.
• API keys and access details: deleted as soon as the evaluation is finished.
• Pack download links and download records (including IP addresses, network provider, approximate location and user agent): deleted automatically two years after the link expires or is withdrawn. The signed agreement itself is kept for as long as it applies.
• Invoices and payment records for sponsored runs and lab licences: as long as Australian tax law requires, usually five years.
• Cloudflare's technical data and visitor statistics: kept by Cloudflare under its own policy.

Sharing and international transfers

We don't sell or rent personal information, and we only share it with the providers that run our services (Cloudflare for the website, visitor statistics and pack delivery, and Google for email) or where the law requires it. These providers process data in several countries, including the United States, and use recognised safeguards such as standard contractual clauses for international transfers.

Your rights

Depending on where you live, you can ask us for a copy of the personal information we hold about you, ask us to correct or delete it, object to or restrict how we use it, or ask for it in a portable format. Email [email protected] and we'll respond within a month.

If you're unhappy with how we've handled your information, please tell us first. You can also complain to the Office of the Australian Information Commissioner, or to the data protection authority where you live (in the UK, the ICO).

Security

We protect the information we hold with access controls and encrypted connections, and we keep as little as possible. No system is perfectly secure, but we'll tell you promptly if a problem affects your information.

Children

BB Arena is for professionals and isn't aimed at children. We don't knowingly collect information from anyone under 16.

Other websites

We link to other sites, such as MDP SEC's site and bug-bounty platforms. Their own privacy policies apply when you visit them.

Changes to this policy

If we change how we handle personal information, we'll update this page and the effective date at the top.