Privacy Policy

Last updated 2026-10-14

This policy explains what personal data BaseURL collects when you use our website, dashboard and API (the "Service"), why we collect it, who we share it with and what rights you have. The short version: we collect what we need to run and bill the Service and keep it secure, and we do not log or store your prompts or completions.

1. Who is responsible

The data controller for the Service is [Company legal name and address], trading as BaseURL ("we", "us"). You can reach us about anything in this policy at [email protected].

2. What we collect

Account information

• Your email address and password. We store only a strong one-way hash of your password, never the password itself.
• Your name and organization name, if you give them.
• Records of which version of our Terms of Service you accepted, and when.

Security information

• A hashed form of the IP address and browser user agent used to sign in or sign up, which we use to detect abuse and protect your account.
• Security events such as sign-ins, password resets, and API key creation and revocation.

Usage records

• For each API request: which API key and account made it, the model used, the number of input and output tokens, timestamps, the outcome (for example success or error type) and the amount charged.
• Balances, top-ups, holds, charges and other entries in your account's billing history.

Payment records

• Payments are handled by our payment processor, Paystack. We never see or store your full card details, bank login or USSD PIN.
• We keep only the payment reference, amount, currency, exchange rate, status and timestamps, plus hashed or summary data needed to match payments to your account and handle disputes.

Communications

• Messages you send to support, and records of the service emails we send you (for example email verification, password reset and billing notices).

3. What we do not collect

We do not log or store the content of your API requests or the responses: your prompts and completions. They pass through our gateway to the inference provider that runs the model, only so the provider can generate your response, and are then returned to you. We do not use them to train models.

We do not use advertising trackers or third-party analytics on this website.

4. Why we use it

We use personal data only for these purposes, on these legal bases:

• To provide the Service: create and run your account, authenticate API requests and show you usage. Basis: performance of our contract with you.
• Billing: price and charge requests, process top-ups and refunds, and keep accurate accounts. Basis: contract and legal obligation.
• Security and fraud prevention: protect accounts, detect abuse and enforce our Terms of Service. Basis: our legitimate interests in keeping the Service and our customers safe.
• Communication: send service, security and billing messages, and tell you about important changes. Basis: contract and legitimate interests.
• Legal compliance: meet tax, accounting and other legal obligations, and respond to lawful requests. Basis: legal obligation.

If we ever want to send you marketing emails, we will ask for your consent first, and you can withdraw it at any time.

5. Who we share it with

We do not sell your personal data. We share it only with service providers who help us run the Service, under contracts that require them to protect it and use it only on our instructions:

• Inference providers, which process the content of your requests to generate responses. They receive the request content, not your account details.
• Paystack, which processes your payments.
• Our email delivery provider, which sends service emails to your address.
• Hosting and infrastructure providers, which host our servers, databases and website.

We may also disclose personal data if required by law or a valid legal request, to protect the rights, safety or property of our users, the public or BaseURL, or as part of a merger, acquisition or sale of assets, in which case we will tell you.

6. How long we keep it

• Account information: while your account is open, and for a limited period after closure to handle any remaining billing, disputes or legal claims.
• Billing and payment records: as long as tax and accounting laws require, typically six years.
• Security logs: for a limited period, usually no more than 12 months, unless needed to investigate an incident.
• Prompts and completions: not stored.

When we no longer need personal data, we delete or anonymize it.

7. How we protect it

• All connections to the Service use encryption in transit (HTTPS/TLS).
• API keys, session tokens and email verification tokens are stored only as hashes, so even we cannot read them back. Passwords are stored with a slow, salted password hash.
• Access to production systems is limited to staff who need it, and our applications run with least-privilege database access.
• We do not write request content, passwords, tokens or API keys to our logs.

No system is perfectly secure. If we become aware of a personal data breach that affects you, we will notify you and the relevant authorities as the law requires.

8. Your rights

Under the Nigeria Data Protection Act 2023 (NDPA) and other laws that may apply to you, you have the right to:

• access the personal data we hold about you and get a copy of it;
• have inaccurate data corrected;
• have your data deleted, where we do not need to keep it for a legal reason;
• object to or restrict certain processing, and withdraw consent where processing is based on consent;
• receive your data in a portable format; and
• complain to the Nigeria Data Protection Commission (NDPC) or your local data protection authority.

To use any of these rights, email [email protected] from the address on your account. We may need to confirm your identity, and we will respond within the time the law requires.

9. International transfers

Some of our service providers, including inference providers and hosting providers, are located outside Nigeria. When we transfer personal data abroad, we do so only where the NDPA permits it, for example to countries with adequate protection or under contractual safeguards, and we take steps to make sure your data stays protected.

10. Cookies

This website does not use cookies. The dashboard at app.baseurl.dev uses a single strictly necessary cookie to keep you signed in. We do not use advertising or tracking cookies.

11. Children

The Service is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. We will change the "last updated" date at the top, and if the changes are significant we will tell you by email or in your dashboard before they take effect.

13. Contact

For privacy questions or requests, email [email protected] or write to [Company legal name and address].