Privacy Policy

Straitly(“we”, “us”, or “our”) respects your privacy. This Privacy Policy describes the personal data we collect, how we use and disclose it, and the choices available to you. It applies to all personal data collected through the website located at https://straitly.ai, the Straitly application programming interface, and the Straitly console (collectively, the “Service”).

Before using the Service, please read this Privacy Policy together with our Terms of Service. By using the Service, you acknowledge the practices described in this Privacy Policy. A principle governs this document: it describes what we actually do, including the exceptions. A policy that overstates its own protections is worthless.

1. Personal Data We Collect

1.1 Account Information

When you register, we collect your email address and, if you provide one, a display name. If you sign in with Google, we receive your email address and name from Google; we never receive your Google password. If you register with an email address and password, the password is processed and stored by Google Firebase Authentication and is never stored by us in any form.

1.2 Request Metadata

For each API request, we record: the timestamp; the model requested; token counts separated into fresh input, cached input, cache writes, and output; the size of the request in bytes; time to first token; total duration; completion status; whether the response was streamed; an opaque request identifier; and which of your account’s API keys the request billed against. This metadata powers your activity log, your analytics, and your billing.

1.3 Prompt and Response Content

We do not store the content of your prompts or the content of model responses. Content passes through our gateway to the applicable model provider and back to you. What we retain is the metadata described in Section 1.2. Two limited exceptions apply, and we disclose both:

• Error messages.When a provider rejects a request, we store the error string the provider returned so that we can display the reason for the failure. Such strings are authored by the provider and may incidentally quote a fragment of the request, such as the path of a malformed field or an attachment’s media type.
• Refusal reasons. Where a provider declines a request under its usage policy, we store the category and explanation the provider supplied, so that the console can present the reason rather than an unexplained failure.

1.4 Payment Information

Payment card details are collected and stored exclusively by Stripe, Inc. They do not reach our servers, and we never have access to a full card number. We store your Stripe customer identifier, the brand and last four digits of a saved card, and a record of each top-up transaction.

2. How We Use Personal Data

We use the personal data described above to:

• authenticate you and maintain your session;
• route, meter, and bill your API requests accurately;
• display your own usage, spend, and account history to you;
• detect and prevent fraud, abuse, and security incidents;
• respond to support requests; and
• operate and improve the Service using aggregate figures, meaning totals computed across accounts in which no individual is identified.

We also measure whether our own advertising works. When you visit https://straitly.ai, the Meta Pixel may record the pages you view, and when you sign up, save a payment card, make your first API request, or add credits, we tell Meta that the event happened, together with a hashed (non-reversible) copy of your email address, first and last name, country and account identifier, your IP address and browser user agent, and Meta’s own cookie identifiers. Meta uses this to measure our ads and show them to people likely to be interested. We never send Meta your prompts, responses, API keys, model usage details, or payment card data. Under California law this counts as “sharing” for cross-context behavioral advertising; Section 6.2 explains how to opt out.

We measure our ads on X (formerly Twitter) the same way. The X Pixel may record the pages you view, and when you sign up, save a payment card, make your first API request, or add credits, it tells X that the event happened, together with a hashed copy of your email address at signup, your IP address and browser user agent, and X’s own cookie identifiers. The same opt-outs apply, and X never receives your prompts, responses, API keys, model usage details, or payment card data.

We also use the Google Ads tag to measure page views, signups, contact-form submissions, saved-card milestones, first API requests, and paid top-ups. Google receives event names, top-up value and currency, opaque transaction identifiers, Google ad-click and cookie identifiers, and browser connection information. We do not provide Google with emails, account identifiers, prompts, responses, API keys, or payment card data through this integration. The same advertising opt-outs apply. Google enhanced conversions and personalized advertising signals are disabled.

We use LinkedIn advertising image pixels to measure public-page visits, signups, contact-form submissions, saved-card milestones, first API requests, and paid top-ups. LinkedIn receives the event, paid top-up value and currency, opaque event identifiers, a public URL without query parameters, browser connection information, and any available LinkedIn cookies. We do not load LinkedIn JavaScript to collect page content, form values, or button activity. We do not send emails, raw account identifiers, private console URLs, API keys, prompts, responses, or payment card details. The same advertising opt-outs apply.

We use the Reddit Pixel to measure public-page visits, signups, contact-form submissions, saved-card milestones, first API requests, and paid top-ups. Reddit receives the event, paid top-up value and currency, opaque conversion identifiers, a public Straitly URL, page title and description metadata, Reddit click and cookie identifiers, and browser connection information. Reddit automatic email and phone matching are disabled. We do not send emails, phone numbers, raw account identifiers, private console URLs, API keys, prompts, responses, or payment card details. The same advertising opt-outs apply.

We do not sell personal data, and we do not use your data to train models.

3. Disclosure of Personal Data

We disclose personal data only to the processors listed below, each solely for the purpose stated. When you invoke a model, the content of that request is transmitted to the model provider serving it and becomes subject to that provider’s own privacy policy and retention practices.

We may also disclose personal data where required by law, or where reasonably necessary to protect our rights, safety, or property. In the event of a merger, acquisition, or sale of all or substantially all of our assets, account records will transfer with the business.

4. Cookies and Local Storage

We set a single cookie, fg_session, which holds a signed session token. It is marked httpOnly so that page scripts cannot read it, and it exists solely to keep you signed in. Our own usage analytics are first-party and stay on our servers. On the public site and console we also load the Meta Pixel, which sets Meta’s advertising cookies (_fbp, and _fbcwhen you arrive from a Meta ad) for the purpose described in Section 2, and the X Pixel, which sets X’s advertising cookies for the same purpose. The Google Ads tag may set advertising measurement cookies such as _gcl_aw. When you sign in or start a payment, our server sets the same two first-party Meta cookies if your browser did not already have them. None of these advertising tags or cookies are set if your browser sends a Global Privacy Control signal or if you opt out at /do-not-sell. Your theme preference and the campaign you arrived from are stored in your browser’s local storage.

5. Data Retention

Account records are retained for as long as your account remains open. Request metadata is retained as billing history so that invoices remain explainable and auditable. When you delete your account, we remove your profile, your wallet, and all of your API keys, and your request history is detached from your identity.

6. Your Rights

Two rights are exercisable directly in the console, without any request to us:

• Access and portability. Your complete activity history can be exported in CSV or JSON format from the Activity page.
• Deletion. The Settings page provides an account deletion control that removes your profile, wallet, and keys.

For correction, restriction, objection, or any request the console does not cover, contact privacy@straitly.ai. We respond within thirty (30) days and charge no fee.

6.1 European Economic Area and United Kingdom

Our legal bases for processing are: performance of a contract (operating your account and billing you); legitimate interests (security, fraud prevention, and improvement of the Service); and legal obligation (tax and accounting records). You have the right to lodge a complaint with your supervisory authority.

6.2 California

California residents have the rights to know, delete, and correct, and to opt out of the sale or sharing of personal information. We do not sell personal information. We do share limited personal information with Meta, X, Google, and LinkedIn for advertising measurement, as described in Section 2. To opt out, use the Do Not Sell or Share My Personal Information page, or turn on Global Privacy Control in your browser, which we honor automatically. You may also email privacy@straitly.ai. We will not discriminate against you for exercising any privacy right.

7. International Transfers

We operate in the United States, and our processors are primarily located in the United States. By using the Service, you understand that your personal data is processed in the United States. Where required, we rely on standard contractual clauses with our processors.

8. Security

All traffic is encrypted in transit. API keys are stored solely as SHA-256 hashes: the full key exists exactly once, at the moment it is displayed to you, and a copy of our database does not yield a usable key. Access to production data is restricted to personnel who require it. No system is perfectly secure; in the event of a breach, we will notify affected users and regulators as required by applicable law.

9. Children’s Privacy

The Service is not directed to anyone under the age of eighteen (18), and we do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact privacy@straitly.ai and we will delete it.

10. Changes to This Privacy Policy

We may revise this Privacy Policy from time to time. If a revision is material, we will provide notice by email or through the console before it takes effect. The “Last Updated” date above reflects the current version.

11. Contact

Straitly
131 Continental Drive, Suite 305, Newark, DE 19713
privacy@straitly.ai for privacy matters; support@straitly.ai for all other matters.