Privacy policy

Product order data

For product orders we process your email, order and payment references, salted lookup-password hash, and delivery and support records. Private delivery content is encrypted and is available only through authorized order access. Your email is used for lookup and contact; automatic order email and password recovery are not currently provided. Do not send identity documents or verification codes to this storefront.

Who we are

The controller of your account and billing data is (published before launch) OÜ, registry code (published before launch) (registrikood), Estonia (details on the company information page). For the content of API requests you send through Ahrigate, Ahrigate acts as a processor on your behalf (see the Data Processing Agreement).

What we collect

We collect the data needed to operate the service: your email address and account identifiers, API usage logs (model, token count, timestamp, API key identifier), and billing records. Request and response content is forwarded to the model provider you select. (published before launch)

How we use it

Usage data is used to calculate your bill, detect abuse, and keep the service reliable. We do not sell your personal data. Legal bases under GDPR Art. 6: performance of a contract (providing the service and billing), legitimate interests (security, abuse prevention, reliability) and legal obligation (accounting and tax records).

Where data is processed

We use the sub-processors listed below. Some of them process data outside the European Economic Area (for example the United States); where that happens we rely on an appropriate GDPR Chapter V transfer mechanism such as the EU-US Data Privacy Framework or Standard Contractual Clauses. (published before launch)

Retention

API usage logs are retained for (published before launch). Billing and accounting records are retained for the period required by Estonian accounting law (published before launch). You may request deletion of personal data at any time, subject to those obligations.

Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, object to and export your personal data, and to lodge a complaint with a supervisory authority. In Estonia that is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) (www.aki.ee). Contact us at privacy@ahrigate.com.

Sub-processors

• Vercel Inc. — Fallback website hosting (not active unless we fail over to it) — Functions configured for Vercel (fra1, Frankfurt); global edge network
• Clerk, Inc. — Authentication and account management — (published before launch)
• Neon, Inc. — PostgreSQL database — (published before launch)
• Upstash, Inc. — Key-value cache / rate limiting — (published before launch)
• Telegram Messenger Inc. — Internal operational alerts (no customer content) — (published before launch)
• Amazon Web Services, Inc. — Primary website hosting, API gateway hosting and AWS Bedrock model access — Website: AWS Lightsail, Frankfurt (eu-central-1); gateway: AWS, Frankfurt (eu-central-1); Bedrock region (published before launch)
• OpenAI, L.L.C. — Model provider (processes the prompts you send to OpenAI models) — United States (provider-determined); (published before launch)
• Anthropic, PBC — Model provider (processes the prompts you send) — United States (provider-determined)