Privacy Policy

Straitly(“we”, “us”, or “our”) respects your privacy. This Privacy Policy describes the personal data we collect, how we use and disclose it, and the choices available to you. It applies to all personal data collected through the website located at https://app.straitly.ai, the Straitly application programming interface, and the Straitly console (collectively, the “Service”).

Before using the Service, please read this Privacy Policy together with our Terms of Service. By using the Service, you acknowledge the practices described in this Privacy Policy. A principle governs this document: it describes what we actually do, including the exceptions. A policy that overstates its own protections is worthless.

1. Personal Data We Collect

1.1 Account Information

When you register, we collect your email address and, if you provide one, a display name. If you sign in with Google, we receive your email address and name from Google; we never receive your Google password. If you register with an email address and password, the password is processed and stored by Google Firebase Authentication and is never stored by us in any form.

1.2 Request Metadata

For each API request, we record: the timestamp; the model requested; token counts separated into fresh input, cached input, cache writes, and output; the size of the request in bytes; time to first token; total duration; completion status; whether the response was streamed; an opaque request identifier; and which of your account’s API keys the request billed against. This metadata powers your activity log, your analytics, and your billing.

1.3 Prompt and Response Content

We do not store the content of your prompts or the content of model responses. Content passes through our gateway to the applicable model provider and back to you. What we retain is the metadata described in Section 1.2. Two limited exceptions apply, and we disclose both:

• Error messages.When a provider rejects a request, we store the error string the provider returned so that we can display the reason for the failure. Such strings are authored by the provider and may incidentally quote a fragment of the request, such as the path of a malformed field or an attachment’s media type.
• Refusal reasons. Where a provider declines a request under its usage policy, we store the category and explanation the provider supplied, so that the console can present the reason rather than an unexplained failure.

1.4 Payment Information

Payment card details are collected and stored exclusively by Stripe, Inc. They do not reach our servers, and we never have access to a full card number. We store your Stripe customer identifier, the brand and last four digits of a saved card, and a record of each top-up transaction.

2. How We Use Personal Data

We use the personal data described above to:

• authenticate you and maintain your session;
• route, meter, and bill your API requests accurately;
• display your own usage, spend, and account history to you;
• detect and prevent fraud, abuse, and security incidents;
• respond to support requests; and
• operate and improve the Service using aggregate figures, meaning totals computed across accounts in which no individual is identified.

We do not sell personal data, we do not share personal data for cross-context behavioral advertising, and we do not use your data to train models.

3. Disclosure of Personal Data

We disclose personal data only to the processors listed below, each solely for the purpose stated. When you invoke a model, the content of that request is transmitted to the model provider serving it and becomes subject to that provider’s own privacy policy and retention practices.

We may also disclose personal data where required by law, or where reasonably necessary to protect our rights, safety, or property. In the event of a merger, acquisition, or sale of all or substantially all of our assets, account records will transfer with the business.

4. Cookies and Local Storage

We set a single cookie, fg_session, which holds a signed session token. It is marked httpOnly so that page scripts cannot read it, and it exists solely to keep you signed in. We operate no advertising cookies, no analytics cookies, and no third-party trackers. Your theme preference is stored in your browser’s local storage and does not leave your device.

5. Data Retention

Account records are retained for as long as your account remains open. Request metadata is retained as billing history so that invoices remain explainable and auditable. When you delete your account, we remove your profile, your wallet, and all of your API keys, and your request history is detached from your identity.

6. Your Rights

Two rights are exercisable directly in the console, without any request to us:

• Access and portability. Your complete activity history can be exported in CSV or JSON format from the Activity page.
• Deletion. The Settings page provides an account deletion control that removes your profile, wallet, and keys.

For correction, restriction, objection, or any request the console does not cover, contact privacy@straitly.ai. We respond within thirty (30) days and charge no fee.

6.1 European Economic Area and United Kingdom

Our legal bases for processing are: performance of a contract (operating your account and billing you); legitimate interests (security, fraud prevention, and improvement of the Service); and legal obligation (tax and accounting records). You have the right to lodge a complaint with your supervisory authority.

6.2 California

California residents have the rights to know, delete, and correct, and to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined in the California Consumer Privacy Act, so there is no sale or sharing to opt out of. We will not discriminate against you for exercising any privacy right.

7. International Transfers

We operate in the United States, and our processors are primarily located in the United States. By using the Service, you understand that your personal data is processed in the United States. Where required, we rely on standard contractual clauses with our processors.

8. Security

All traffic is encrypted in transit. API keys are stored solely as SHA-256 hashes: the full key exists exactly once, at the moment it is displayed to you, and a copy of our database does not yield a usable key. Access to production data is restricted to personnel who require it. No system is perfectly secure; in the event of a breach, we will notify affected users and regulators as required by applicable law.

9. Children’s Privacy

The Service is not directed to anyone under the age of eighteen (18), and we do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact privacy@straitly.ai and we will delete it.

10. Changes to This Privacy Policy

We may revise this Privacy Policy from time to time. If a revision is material, we will provide notice by email or through the console before it takes effect. The “Last Updated” date above reflects the current version.

11. Contact

Straitly
131 Continental Drive, Suite 305, Newark, DE 19713
privacy@straitly.ai for privacy matters; support@straitly.ai for all other matters.