Privacy Policy

Account information. Your email address, so you can sign in and so we can reach you about the service. Optionally a company name. Your plan, your usage count for the current period, and your spend cap.

API keys. Stored only as a SHA-256 hash and a short non-secret prefix. We cannot read your key back out of our database, which is why a lost key must be replaced rather than recovered.

A record of each API call. Which key made it, which endpoint, when, the risk score returned, and whether it counted as overage. Not the text.

Custom policies, if you write them. These are your own rules, in your own words, and we store them so they can be applied to your traffic.

Payment details are not collected by us. Stripe handles checkout and holds your card. We store only the identifiers Stripe gives us for your customer and subscription.

This is the part that matters most, so it is stated plainly rather than summarised.

When you call the API, the text you send is transmitted to Google's Gemini API, which performs the analysis and returns a verdict. There is no version of this service in which that does not happen — it is what you are paying for. Treat any text you send us as text you have sent to Google, and do not send us content you are not permitted to share with a third-party processor.

Some requests are answered without reaching a model at all. A deterministic scan decides text containing an unambiguous finding — a card number, a credential, an explicit instruction override — and a short-lived cache answers text we have seen very recently. In those cases the text does not leave our infrastructure. You can tell which happened from the X-LLMFence-Source header on the response, described in Latency & the Fast Path.

We do not write your text to our database. It exists in memory for the duration of the request. A redacted copy of the verdict, keyed by a SHA-256 hash of the text, may remain in an in-memory cache for up to fifteen minutes so that repeated content is not re-analysed. That cache is not written to disk and does not survive a restart.

We do not use your text to train anything. We have no model of our own to train.

These are our sub-processors. All are in the United States, so using LLMFence involves an international transfer if you are in the UK, EEA or Switzerland.

We do not sell your data, and we do not share it with anyone outside this list except where we are legally required to.

How those transfers are made lawful

Naming a transfer without naming its safeguard is only half a disclosure, and Article 46 asks for the safeguard. Each processor above is relied on under the Standard Contractual Clauses adopted by the European Commission in decision 2021/914, incorporated through that processor's own data processing agreement, with the UK Addendum issued by the ICO where UK data is involved and the equivalent recognition for Switzerland. Google, Supabase, Vercel and Stripe each publish the DPA that carries these clauses.

Some of these processors are additionally self-certified under the EU – US Data Privacy Framework. We rely on the Clauses rather than on that framework, because an adequacy decision can be struck down — it has happened twice — and a policy that depends on one stops being true the day it is.

The text you send to the API is the important row there, and it is the shortest: it is not written to our database at all. It is held in memory only long enough to answer, plus up to fifteen minutes in a cache keyed by a SHA-256 hash of the text, which is discarded when the process restarts.

Everything tied to your account is removed when you delete it, and that happens immediately rather than on the next sweep. Stripe retains its own transaction records independently, as it is required to for tax and accounting purposes, and enquiries sent through the contact form are deleted on the schedule above whether or not you ever had an account.

If you are in the UK, EEA or Switzerland you have rights of access, rectification, erasure, restriction, portability and objection. These apply to everyone using LLMFence, wherever you are — it is simpler to run one standard than two.

Erasure is built in. Go to Settings and delete your account. It removes your profile, keys, usage records, policies, notifications and billing events, and cancels your subscription. You do not need to ask us, and we cannot slow it down.

For anything else, contact us through the contact page. If you are unhappy with how we have handled a request, you can complain to your local data protection authority.

The CCPA, as amended by the CPRA, gives California residents a specific set of rights. They overlap heavily with the rights above, and we run one standard rather than two, so the mechanism is the same — but the law asks for particular statements, so here they are.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. Not as a policy choice we could quietly reverse: there is no advertising, no analytics and no tracking on this site at all, which is also why you have never been asked to accept a cookie banner here. We have never sold or shared personal information in the twelve months preceding the date above.

You have the right to know what we collect and why (section 1), to request deletion (section 5 — it is self-service), to correct inaccurate information, and to limit the use of sensitive personal information. That last one is short in our case: we do not collect the special categories the statute defines, other than whatever happens to appear in text you choose to send the API, which we do not store.

We will not discriminate against you for exercising any of these — no degraded service, no different pricing. Exercising them takes effect immediately through your settings page, so there is no verification delay and no agent to authorise; if you would rather ask us, use the contact page.

Most text you send us is not about you — it is produced by your assistant and may contain your own users' personal data. In that arrangement you are the controller and we are your processor, and you are responsible for having a lawful basis to send it.

If you need a data processing agreement before you can use the service, ask on the contact page.

Traffic is encrypted in transit. Every table enforces row-level security, so one account cannot read another's data even if an application bug tried to. API keys are stored as hashes. What we do and do not claim about our security posture is set out on the security page.

If we change this policy in a way that affects what happens to your data, we will say so rather than quietly moving the date at the top.