Privacy Policy

Privacy Policy

Last updated: June 2026

1. Information We Collect

Automatically Collected

• API request logs (anonymized, retained for 90 days)
• Usage statistics (token counts, response latency, model name, request timestamps)
• Webhook events (retained for 30 days for deduplication)

Provided by You

• Email address (provided by Stripe for billing)
• API key usage data

What We Do NOT Collect

• PII beyond your email address (provided by Stripe)
• IP addresses beyond what is required for abuse prevention
• Browser fingerprints
• Third-party tracking data

2. How We Use Your Information

• To provide and maintain the Service
• To process payments (via Stripe)
• To enforce rate limits
• To prevent abuse
• To persist conversations (server-side, for the conversation history feature)

3. Data Storage

• Data is stored in PostgreSQL (via Supabase)
• API keys are stored as Argon2id-hashed values (never in plaintext)
• Conversation content is stored server-side for the conversation history feature
• Usage logs are retained for 90 days, then deleted
• Webhook events are retained for 30 days, then deleted
• Audit logs (admin actions) are retained for 90 days, then deleted

4. Third-Party Services

• Stripe: Payment processing. See Stripe’s Privacy Policy.
• Supabase: Database hosting. See Supabase’s Privacy Policy.

5. Data Security

We implement industry-standard security measures:

• TLS encryption for all API traffic
• Parameterized SQL queries (no injection vulnerabilities)
• Timing-safe secret comparison
• No hardcoded credentials
• Argon2id key hashing (OWASP-recommended)

6. Your Rights

• Request deletion of your data
• Request a copy of your data
• Opt out of non-essential data collection

7. Changes to This Policy

We will notify you of any changes to this Privacy Policy via email or through the Service.

8. Contact

For privacy-related inquiries, contact [email protected].