Privacy policy

The Saanora Platform is run by Saanora. It is an API with prepaid credit for Saanora models, plus the console at this site where you manage organizations, projects, API keys, usage, billing and members. This policy explains what data the platform handles and why.

Saanora Chat, the consumer app at saanora.com, is a separate product with its own privacy policy.

This policy sits alongside the platform terms and the acceptable use policy.

We collect what it takes to run the platform and charge correctly for it:

• Account details: your name and email address, and your avatar if you sign in with Google. If you sign up with a password, it is handled by our authentication provider.
• Organization membership: the organizations and projects you belong to, your role in each (owner, admin, developer, billing or reader), and settings such as per-project monthly spend limits.
• API keys: stored as SHA-256 hashes, plus the first few characters so you can tell keys apart. We cannot show a full key again after it is created.
• Request metadata: for each API request, the time, organization, project, key, endpoint, model, mode (fast or consistent), status, number of questions, input and output tokens, latency, cost and request id.
• Billing records: order ids, amounts and status for each top-up, and your credit balance and usage tier. Payment card details are handled by Polar, our merchant of record. We do not store them.

Request metadata is what your usage pages and your charges are built from. Data handling has the same list in short form.

The record (the "state" field) and the questions in a request are the content you ask Clara to decide about. We process them in memory to compute the answers and send the answers back to you. They are not written to our database.

The models run on GPU servers operated by Modal. Your record passes through those servers in memory while the request runs.

We use the data above to:

• Run your account, your organizations and the console.
• Answer API requests and route them to the right model.
• Charge for usage. Each request's cost is held before it runs and the exact cost is deducted after. Failed requests are free. See billing and credit and pricing.
• Apply your usage tier and rate limits, and the spend limits you set on projects.
• Show members usage and costs, and show billing history to owners, admins and billing members.
• Keep the platform secure and enforce the acceptable use policy.
• Send emails about your account and reply when you contact us.

These providers process data for the platform:

• Supabase: our database and authentication.
• Polar: payments. Polar is the merchant of record: it runs checkout, collects and remits taxes, and issues receipts and invoices. Card details are handled by Polar.
• Modal: the servers that run the API and the models. Records pass through in memory and are not stored.
• Google: only if you choose Google sign-in.
• Web hosting and email delivery providers, to serve this site and send account emails.

We use only strictly necessary cookies: sign-in session cookies keep you signed in, and others remember the organization and project you selected in the console.

We do not use advertising cookies or analytics cookies.

• Records and questions: not kept at all. They exist only in memory while a request runs.
• Account data and organization membership: for as long as your account exists.
• Request metadata and billing records: kept so we can show your usage and meet our accounting obligations.

When we delete your account, we remove your profile and your memberships. Data that belongs to an organization, such as its projects, request metadata and billing records, stays with the organization while it exists, and billing records we need for accounting may be kept.

• API keys are stored as SHA-256 hashes, plus the first few characters so you can tell keys apart. Treat a key like a password: anyone who has it can spend your credit.
• Row-level security in the database limits each member to the data of the organizations they belong to.
• Traffic to the site and the API is encrypted with HTTPS.
• Payment card details are handled by Polar and never reach our database.

If you think a key has leaked, revoke it in the console and create a new one.

You can ask to access, correct or delete the personal data we hold about you. Write to support@saanora.com and tell us what you need.

You can see your organization's usage in the console at any time. Owners, admins and billing members can also see its billing history. There is no self-serve delete button, so account deletion also goes through support@saanora.com.

We cannot return or delete records and questions from past requests, because we never stored them.

The Saanora Platform is only for adults (18 or the age of majority where you live, whichever is higher), and we do not knowingly collect data from anyone younger. If you believe a minor has an account, write to support@saanora.com. We will look into it and close the account if so.

When we change this policy, we update it on this page and change the effective date at the top. The current version is always the one here.

Questions about this policy or your data: support@saanora.com.