DRAFT — FOR LEGAL REVIEW. Not legal advice. Do not publish without a lawyer.

Privacy Policy (Draft)

Effective date: TBD · Entity: TBD (Australia)

  1. Who we are. CostLatch provides an API proxy that enforces spending budgets on AI API usage.
  2. Data we collect. Account email; encrypted provider API keys; proxy key hashes; spend aggregates (tokens/USD estimates); alert emails/webhook URLs; Stripe customer IDs. We do not log prompt or completion bodies by default.
  3. Purpose. Provide the service, bill subscriptions, send budget/loop alerts, prevent abuse.
  4. Processors. Cloudflare (hosting), Stripe (payments), Resend (email). List to be finalized.
  5. Retention. Usage aggregates per plan (30/90 days). Keys deleted on account deletion request.
  6. International transfers. TBD based on hosting region.
  7. Your rights. Access, export, deletion — contact TBD. AU Privacy Act / APP considerations for AU users; GDPR if serving EU.
  8. Contact. privacy@costlatch.com (TBD).

← Back