Privacy Notice

1. What we collect

• Account data. Your name, email address and password hash. Passwords are hashed and never stored in plain text.
• Billing data. Plan, subscription status and a Stripe customer reference. Card details are handled by Stripe; they never reach our servers.
• Request data. The model, endpoint, token counts, status, timing and the account and key that made each request, plus the provider that served it. Depending on the endpoint, this can include the prompt and completion text.
• Technical data. IP address, user agent and session identifiers used for security and to keep you signed in.

2. Why we use it

• To run the service: route requests, return results, enforce plan limits and show your usage.
• To bill you and manage subscriptions.
• To keep the service secure: detect abuse, prevent fraud and diagnose incidents.
• To support you when you contact us and to tell you about material service changes.

Our legal bases are performance of our contract with you, our legitimate interests in running and securing the service, and compliance with legal obligations. Where we rely on consent, you can withdraw it at any time.

3. Sharing

We share data only as needed to operate the service:

• Model providers. Your prompt and the request parameters are forwarded to the provider that serves the model, so it can produce a response.
• Stripe. Payment and subscription processing.
• Infrastructure and email. Hosting, storage and transactional email providers acting on our instructions.
• Legal. Where we are required to disclose information by law or to protect rights and safety.

We do not sell your personal data, and we do not use your prompts or completions to train models.

4. Retention

Account data is kept while your account is open. When you delete your account, we remove your profile, API keys, request history and any quote requests sent with the same email. Billing and tax records are kept only as long as the law requires. Request logs also expire automatically at the end of the history window included with your plan.

5. Cookies

We use a single essential cookie to keep you signed in to the console. It is HTTP-only and not used for advertising. The public site does not set tracking cookies.

6. Your choices and rights

You can view and update your account details, rotate or disable keys, and delete your account from the console. Deleting an account cancels any live subscription first, then removes the account, its keys, request history and related quote requests. Depending on where you live, you may also have the right to access, correct, export, restrict or object to our processing, or to lodge a complaint with a regulator. Email privacy@iceberg.host and we will help.

7. Security

Traffic is encrypted in transit. Passwords are hashed, session tokens are stored only as hashes, and access to production systems is limited. No service is perfectly secure, so please use a strong, unique password and keep your API keys out of client-side code.

8. International transfers

Our providers may process data in other countries. Where required, we rely on appropriate safeguards such as standard contractual clauses for those transfers.

9. Changes and contact

We will post any changes here and update the date above; significant changes will also be announced by email or in the console. Questions or requests: privacy@iceberg.host.