Privacy Policy

• Account data: email address, authentication identifiers.
• Usage metadata: model called, token counts, exact cost, request id, and timestamp for every request.
• Billing records: top-up amounts, payment method metadata from our payment processor (we never see or store full card numbers).
• Support communications you send us.

When you make a request, your prompt and any attached content are forwarded to the model provider you selected, to generate a response. We do not store the body of your prompts or model responses. Our billing ledger records only request metadata, which model was called, token counts, exact cost, a request id, and a timestamp, never the prompt or output content itself. This is a deliberate design choice, not an oversight.

The model provider you route to has its own data-handling policy for the content it processes; consult that provider’s policy for how long it retains request content on its side.

Where GDPR applies, we process account and billing data to perform our contract with you (Art. 6(1)(b)), and usage metadata for legitimate interests in billing accuracy, fraud prevention, and service reliability (Art. 6(1)(f)). We rely on the same legitimate interest for the website analytics described in section 6, to understand how the site is used and to improve it.

We rely on a small number of subprocessors for hosting, authentication, payments, email delivery, product analytics (see section 6), and the AI model providers you explicitly select when you make a request.

We use strictly necessary cookies for authentication (session tokens), and one first-party cookie that records how you first arrived at the site (landing page, referrer, and any campaign parameters) so we can attribute signups. Our analytics providers set their own cookies, described in section 6.

We do not use advertising cookies, we do not run ad networks, and we do not sell or share personal data for advertising.

We use two third-party analytics services on this website, on both the marketing pages and the signed-in dashboard:

• Google Analytics 4 (Google), for aggregate traffic measurement: pages viewed, referring site, approximate location derived from IP address, and device and browser type.
• Microsoft Clarity (Microsoft), for session replay and heatmaps. Clarity reconstructs how a page was used, clicks, scrolling, mouse movement, and the structure of the page, to show us where people get stuck.

Both providers set their own cookies and process data on our behalf under their respective terms.

What analytics never sees. Prompt content and model responses are not sent to either provider, for the reason given in section 2, we do not store them at all. Clarity masks page text before it leaves your browser, and we additionally mark your API key as masked at the one moment it is displayed, so a full key is never captured in a session recording. Values you type into form fields, including passwords and provider keys added to the BYOK vault, are masked by default and are not recorded.

Depending on your jurisdiction, you may have the right to access, correct, delete, or export your personal data, and to object to or restrict certain processing. To exercise these rights, contact [email protected].

Account data is retained for as long as your account is active, plus a limited period afterward for legal and accounting requirements. Billing and usage-metadata records are retained as required by applicable tax and accounting law.

Our infrastructure and subprocessors may process data outside your country of residence. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses.

Privacy requests: [email protected]. General contact details are on the Contact page.