Privacy policy

Who this covers

This policy applies to Openbase at openbase.ai, the API at api.openbase.ai and the customer dashboard. It covers people who create an account and the applications they point at our API.

It does not govern what the upstream model providers do with a request once we forward it to them. That is set by whichever provider you named in the request, and their policy applies alongside this one.

Information you give us

• Account details: your email address, an optional display name, and either a password we store only as a bcrypt hash or a link to your Google account if you sign in with Google.
• Workspace details: the workspace name created for you at signup, which is the entity that owns your balance, keys and usage.
• Billing details: the amounts you top up and a customer reference issued by our payment processor. Card numbers are entered on the processor's own hosted page and never reach our servers.
• Support correspondence: whatever you choose to tell us when you email support, sales or security.

Information we record automatically

Every call through the gateway writes one metadata row so that it can be billed, debugged and shown back to you in your usage log. That row holds:

• the model and provider that served the request, and the endpoint called
• prompt, completion and reasoning token counts, and the resulting cost
• status, HTTP status code, error code and error message when something failed
• latency, time to first token, how many providers were attempted, and whether failover was used
• the IP address and user agent that made the call, and the time it happened

What we do not keep: your prompts

The content of your requests and the model's responses are relayed to the provider you selected and are not written to our storage. There is no column in our database that holds a prompt or a completion, and no log that captures message bodies.

What survives a request is the metadata listed above. That means we cannot show you a past conversation, and we cannot hand your prompts to anyone, because we do not have them.

We never use your requests, responses or usage to train any model, and we do not sell or rent any of it.

Signing in with Google

If you choose to sign in with Google, we ask Google for three things only: the openid, email and profile scopes. From those we receive your email address, your name and profile picture URL if your account has one, and a stable Google account identifier.

We store the email address, the name and that identifier. The identifier is what lets us recognise you as the same person the next time you sign in. We do not receive or request access to Gmail, Drive, Calendar, contacts or any other Google service, and we do not receive your Google password.

Google's own handling of the sign-in is governed by Google's privacy policy. Revoking Openbase from your Google account permissions page stops future sign-ins; ask us to delete your account if you also want the stored identifier removed.

Cookies and tracking

We set no cookies. There is no advertising network, no analytics product, no session recording and no third-party tag anywhere on this site.

Your signed-in session is held in your browser's local storage as a short-lived access token and a refresh token, which is why signing out or clearing site data ends the session immediately. Web fonts are bundled and served from our own domain, so loading a page does not call out to a third party.

We keep the IP address and user agent attached to each active session so that you can review and revoke sessions, and so unusual sign-in activity can be spotted.

Why we process it

• To run the service you asked for: authenticating you, routing requests, and enforcing your balance and rate limits. This is necessary to perform our contract with you.
• To meter and bill usage, issue invoices and handle disputes. Also contractual, and in part a legal obligation for tax and accounting records.
• To keep the platform safe: detecting abuse, credential stuffing, fraud and attempts to reach another account's data. This is our legitimate interest in a service that is not trivially abusable.
• To send transactional messages such as address verification, password resets and billing receipts. Contractual, and you cannot opt out of these while holding an account.
• To comply with the law when we are required to retain or produce records.

Who else touches it

We use a small set of processors, each for one job. We do not share your data with anyone else, and there is no category of recipient beyond this list.

Where it is stored, and how it is protected

The application, its database and its cache all run in Google Cloud's europe-west1 region in Belgium. The database has no public address and is reachable only from our own private network. Traffic to us travels over TLS.

Provider credentials are encrypted with AES-256-GCM under a key held outside the database. Your API keys are stored only as SHA-256 hashes alongside a prefix and last four characters for display, so a database dump cannot be turned back into a working key. Passwords are bcrypt hashes. Privileged administrative actions are written to an append-only audit log recording the actor, the action and the address it came from, and the admin console itself sits behind a separate identity-aware proxy.

Where a processor is outside the European Economic Area, the transfer relies on the safeguards in that processor's data processing terms, including standard contractual clauses where they apply.

How long we keep it

• Account and workspace records: for as long as the account exists.
• Request metadata, transactions and invoices: kept while the account is open, because they are your usage history and our billing record, and retained afterwards only as long as tax and accounting rules require.
• Session records: until the session expires or you revoke it. Refresh tokens are held as hashes and expire on their own.
• Encrypted database backups: automated daily, with seven retained backups and seven days of transaction logs, after which they age out. A deletion can therefore persist in a backup for up to a week before it is gone everywhere.

Your rights

Email support@openbase.ai to exercise any of these and we will answer within one month. We may need to confirm you control the account first.

• Ask what we hold about you and get a copy of it.
• Correct anything inaccurate, including your name and email address.
• Delete your account and the personal data attached to it, subject to records we must keep for accounting.
• Export your usage history from the dashboard at any time.
• Object to processing we base on legitimate interests, and withdraw consent where we relied on it.
• Complain to your local data protection authority if you think we have handled this badly.

Children

Openbase is a developer tool sold to adults. It is not directed at children, and we do not knowingly create accounts for anyone under 16. Tell us if you believe a child has registered and we will remove the account.

Changes

When this policy changes we update the date at the top of this page. If a change materially affects what we collect or why, we will email account holders rather than rely on you noticing.

Contact

Privacy questions and requests go to support@openbase.ai. Security issues, including anything you believe exposes another customer's data, go to security@openbase.ai and are acknowledged within two business days.