Privacy Policy

ProtAI ("we", "us", "our") takes privacy seriously. This policy explains what data we collect, why, who we share it with, and your rights. It applies to protai.co.uk, the dashboard, API, and SDKs.

1. Data we collect

Account data. When you sign up: your email address and anything you add to your profile. When you subscribe: billing details are processed by Stripe — we never see or store your card numbers.

Metering data. To provide the service we store: project and meter configuration, API key metadata (prefixes and hashes — never raw keys), per-user balances, and an immutable ledger of check/report entries including the end-user IDs you send us, units, and timestamps.

What we deliberately don't collect. ProtAI never proxies your AI traffic. We never see your prompts, completions, model parameters, or any content your users generate. There is nothing to leak because it never touches our servers.

Technical data. Standard web logs (IP address, user agent, pages visited) for security and analytics, plus privacy-friendly usage analytics on the marketing site.

2. How we use it

• To provide and operate the service: metering, quotas, alerts, billing.
• To secure the platform: fraud prevention, rate limiting, abuse detection.
• To communicate: transactional emails (alerts, receipts), and product updates you can opt out of.
• To improve: aggregated, anonymised analytics about feature usage.

We do not sell your data. We do not use your data to train AI models.

3. Subprocessors

We share limited data with the services that run ProtAI:

• Supabase — database and authentication (account + metering data).
• Stripe — subscription and credit-pack payments (billing data).
• Vercel — hosting and edge delivery (technical logs).
• Resend — transactional email (your email address, alert content).
• Google Analytics — marketing-site analytics (anonymised usage).

Each processes data only on our instructions under their own data processing terms. Where data leaves the UK/EEA, transfers rely on adequacy decisions or standard contractual clauses.

4. Your end users

When you send us end-user IDs and usage, you are the data controller for that data and we process it as your processor, solely to provide the metering service. Make sure your own privacy policy discloses this, and only send us identifiers you have a lawful basis to share. We recommend opaque IDs (e.g. user_8f2a) rather than emails or names.

5. Cookies

We use strictly-necessary cookies for authentication and security. The marketing site uses Google Analytics cookies to understand aggregate traffic. No advertising cookies, no cross-site tracking.

6. Retention

• Account data: kept while your account is active, deleted within 90 days of closure on request.
• Metering ledger: kept while your account is active; ledger entries are append-only by design and cannot be edited, but can be deleted with your account.
• Contact messages: kept for 24 months.
• Web logs: kept for 12 months.

7. Your rights (UK GDPR)

If you're in the UK or EEA you have the right to access, correct, delete, or port your personal data, to restrict or object to processing, and to withdraw consent where processing is based on it. To exercise any of these, contact us via the contact page — we respond within 30 days. You also have the right to complain to the ICO (ico.org.uk).

8. Security

Data is encrypted in transit (TLS) and at rest. API keys are stored as salted hashes and shown once. Access to production systems is limited and logged. See our security page for detail.

9. Changes

We'll notify you of material changes to this policy by email or in the dashboard before they take effect.

10. Contact

Data protection questions: contact page or support@protai.co.uk.