1. What we collect
Account: email, name, password hash.
Usage: API requests, run metadata, billing events.
Device: IP (hashed after 7 days), user-agent.
2. Why we collect it
To provide the service, bill it correctly, prevent abuse.
Legal basis: contract performance (Article 6.1.b GDPR).
3. Sub-processors
Full list at /security. Changes announced 30 days in advance.
4. Your rights
Access, rectification, erasure, portability. Contact [email protected].
5. Retention
Account: until deletion. Logs: 90 days. Billing: 10 years (legal).
6. International transfers
EU-only by default. SCCs for US sub-processors when strictly necessary.