Privacy Policy

1. Data Controller

The data controller responsible for the processing of your personal data is:

2. What Data We Collect

We collect and process the following categories of personal data:

• Account data: Your email address, provided during registration for account creation and authentication.
• Usage data: API request metadata including token counts, provider names, model identifiers, timestamps, and computed costs. We do not collect or store the content of your prompts or AI-generated responses.
• Technical data: IP address, browser type, and device information collected automatically when you access our website and dashboard.

3. Legal Basis for Processing

We process your personal data on the following legal bases (Art. 6 GDPR):

• Contract performance (Art. 6(1)(b)): Processing your account and usage data is necessary to provide the Tokpulse service.
• Legitimate interests (Art. 6(1)(f)): We process technical data for security purposes, fraud prevention, and service improvement.
• Consent (Art. 6(1)(a)): Where applicable, such as for optional analytics cookies or marketing communications.

4. How We Use Your Data

We use the collected data to:

• Provide, maintain, and improve the Tokpulse service
• Authenticate your identity and manage your account
• Generate usage dashboards and cost analytics
• Send transactional emails (e.g., login codes, account notifications)
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations

5. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Account data: Retained for the duration of your account. Deleted within 30 days of account deletion.
• Usage data: Aggregated usage statistics are retained for up to 12 months. Detailed request logs are retained for 90 days.
• Technical data: Server logs are retained for 30 days.

6. Your Rights (GDPR Art. 15-22)

Under the General Data Protection Regulation, you have the following rights regarding your personal data:

• Right of access (Art. 15): You may request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): You may request correction of inaccurate personal data.
• Right to erasure (Art. 17): You may request deletion of your personal data ("right to be forgotten").
• Right to restriction (Art. 18): You may request that we restrict the processing of your data.
• Right to data portability (Art. 20): You may request your data in a structured, machine-readable format.
• Right to object (Art. 21): You may object to the processing of your data based on legitimate interests.
• Right to withdraw consent (Art. 7(3)): Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at privacy@tokpulse.com. We will respond within 30 days. You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence.

7. Cookies

Tokpulse uses only essential cookies required for authentication and session management. These cookies are strictly necessary for the Service to function and cannot be disabled. We do not use tracking or advertising cookies.

8. Data Processors

We use the following third-party processors to operate the Service. All processors are bound by data processing agreements in accordance with Art. 28 GDPR:

• Supabase Inc. (San Francisco, USA) -- Authentication and database hosting. Data transfers to the US are covered by Standard Contractual Clauses (SCCs).
• Fly.io Inc. (Chicago, USA) -- Application hosting and compute infrastructure. Servers are located in EU regions where available.

9. Data Protection Officer

For any questions or concerns regarding data protection, you may contact our Data Protection Officer:

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. We encourage you to review this page periodically.