Privacy Policy

1. Data Controller

For the purposes of applicable data protection laws, the data controller responsible for your personal data is:

For EU/EEA residents: If you have questions about GDPR compliance or wish to exercise your data protection rights, please contact us using the details above.

2. Information We Collect

We collect personal data that you provide directly to us, data we collect automatically when you use the Service, and data generated through your use of the platform.

• Identification and contact details (such as name and email address).
• Account information (such as login credentials, OAuth identifiers, and basic profile information).
• Billing and transaction data (such as Stripe identifiers, wallet top-ups, and usage ledger entries; card details are processed and stored by our payment processor, not by us).
• Usage data (such as login timestamps, model usage metrics, and agent or tool activity).
• Content and configuration data you create in the Service (such as Starships, agents, tools, environment variables, and conversations).

3. How We Use Personal Data

We use personal data only for limited, specified purposes, including to:

• Provide, operate, and maintain the Service.
• Process payments and maintain billing and usage records.
• Communicate with you about the Service, including security and technical notices.
• Respond to enquiries, support requests, and feedback.
• Monitor and improve the performance, security, and reliability of the Service.
• Prevent, detect, and investigate fraud, abuse, or security incidents.
• Comply with legal and regulatory obligations.

4. Legal Bases for Processing (EEA/UK)

Where the EU, EEA, or UK data protection laws apply, we process your personal data on the following legal bases:

• Performance of a contract, where processing is necessary to provide the Service to you.
• Compliance with a legal obligation, such as record-keeping and tax requirements.
• Legitimate interests, such as securing the Service, preventing misuse, and improving our platform, where those interests are not overridden by your rights.
• Consent, where required for specific optional features or communications.

5. AI Training and Use of Content

We do not use your private content, proprietary workflows, or agent configurations to train AI models. Your data remains your data. We may use aggregate, anonymized statistics derived from usage of the Service to improve our systems and features, provided such information does not identify you.

6. Sharing of Personal Data

We may share personal data with selected third parties, strictly as necessary to provide the Service or to comply with law, including:

• Service providers such as hosting, infrastructure, and payment processors.
• Professional advisers (such as legal or accounting advisers) where reasonably necessary.
• Competent authorities, regulators, or courts where required by law or to protect our rights or the rights of others.
• Successors in interest in connection with a corporate transaction, such as a merger or acquisition, to the extent permitted by law.

We do not sell your personal data.

7. Data Security

We implement technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include encryption in transit and at rest where appropriate, access controls, and security monitoring. However, no method of transmission or storage is completely secure; we cannot guarantee absolute security.

8. Data Retention

We retain personal data for as long as necessary to fulfil the purposes described in this Privacy Policy or as required by law. For example, account data and configuration data are generally retained while your account is active, whereas certain billing and transaction records may be retained for up to seven (7) years for legal and accounting purposes. Data may remain in backup systems for a limited period.

9. Your Rights

Subject to applicable law, you may have certain rights in relation to your personal data, including the right to request access, rectification, erasure, restriction of processing, data portability, and to object to certain processing activities. Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise these rights, please contact us using the details in section 1. We will respond to requests within the timeframes required by applicable law.

10. International Transfers

Personal data may be processed in countries outside your country of residence, including countries that may not provide the same level of data protection. Where required, we implement appropriate safeguards, such as Standard Contractual Clauses or other mechanisms recognised by applicable law, to protect personal data transferred internationally.

11. Children's Data

The Service is not intended for children under the age of 13, and we do not knowingly collect personal data from children under 13. If you believe that we have collected personal data from a child in violation of this policy, please contact us so that we can take appropriate steps.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the Service, legal requirements, or our data practices. When we make material changes, we will provide appropriate notice, which may include updating the "Last updated" date at the top of this page or providing in-product or email notifications.

13. Contact

If you have any questions about this Privacy Policy or our handling of personal data, please contact: