Privacy Policy

What we collect

• Account data — email address and password (stored by our authentication provider, Supabase, using standard password hashing — we never see or store your password in plain text).
• Billing data — if you subscribe to a paid plan, Stripe processes your payment details directly. We store your Stripe customer and subscription IDs, but never your card number.
• Report data — the CSV/JSON data you submit to generate a report, and the narrative we return. For signed-in users, we store the first 500 characters of your input and the generated output so you can see your report history in the dashboard.
• API keys — we store a one-way hash of each API key you create, never the key itself. The raw key is shown to you once, at creation time, and cannot be recovered afterward.
• Anonymous demo usage — if you use the demo widget without an account, we store a one-way hash of your IP address (never the raw IP) to enforce a daily usage limit. This hash cannot be reversed back to your IP.
• Contact form and newsletter — if you message us or subscribe to release updates, we store your name/email and message content to respond to you or send release notes.
• Analytics — we use Vercel Web Analytics and Speed Insights, which are cookie-free and report aggregated page-view and performance data, not individual user tracking.

Third parties who process your data

We use a small number of subprocessors to run the service. Each only receives the data needed for its function:

• Supabase — authentication and database hosting.
• Groq — processes the data you submit to generate a report. We do not control Groq's own data retention; see their privacy policy for details.
• Stripe — payment processing for paid plans.
• Resend — delivers contact-form messages to our inbox.
• Vercel — application hosting, deployment, and analytics.

We do not sell your data, and we do not share it with anyone beyond the subprocessors listed above.

Your rights

Depending on where you live, you may have rights under GDPR (EU/UK), CCPA (California), or India's DPDP Act to access, correct, export, or delete your personal data. To exercise any of these rights, email us at utkarsh.mankad@gmail.com and we will respond within 30 days. Deleting your account removes your profile, API keys, and report history; we may retain billing records as required by law.

Data retention

We keep account and report data for as long as your account is active. If you delete your account, we remove your data within 30 days, except where we're legally required to retain billing records for longer.

Changes to this policy

We'll update the "last updated" date above if this policy changes materially, and post the new version here.

Contact

Questions about this policy? Email utkarsh.mankad@gmail.com or use our contact page.