Privacy Policy

This Privacy Policy describes how Kourier AI Inc, a Texas corporation doing business as Kourier (“Kourier,” “we,” “us,” or “our”), collects, uses, and protects your personal data when you use kourier.sh, our inference endpoint, and the Cloud dashboard at app.kourier.sh (collectively, the “Service”).

1. Information we collect

Account data

When you create an account, we collect your email address and a password. Passwords are never stored in plaintext — they are hashed using a one-way function before being written to our database. We also store the display name you choose for your profile.

Social sign-in data

If you sign in with Google or GitHub, we receive the profile information those providers share with us — typically your name, email address, and a provider account identifier. The provider controls what data is sent; we store only what they return to us at sign-in.

API keys

API keys you generate are stored as one-way hashes. The full key value is shown to you once at creation time and is never retrievable afterward — not by us, not by anyone. We cannot impersonate your requests.

Usage data

To operate the Service and enforce plan limits, we record request counts, token usage, model selection, and rate-limit events against your account. This data is shown in your usage dashboard and may be aggregated for capacity planning.

Technical data

Our servers log standard request metadata such as IP addresses, timestamps, and user-agent strings. This information is used for security, abuse prevention, and troubleshooting.

Website analytics

If you accept analytics, we use Google Analytics on kourier.sh to understand aggregate site traffic and how visitors use the marketing site. Google Analytics may collect device, browser, approximate location, referral, and interaction data using cookies or similar technologies. We do not use this information for targeted advertising.

2. How we use your data

We process your data to: provide and maintain the Service; authenticate your account and manage sessions; measure token usage and enforce plan rate limits; detect, prevent, and respond to fraud, abuse, and security incidents; communicate with you about your account; and comply with legal obligations. We do not use your personal data for advertising and we do not sell it.

3. Prompt and completion content

Requests you send to the endpoint (prompts) and the responses returned (completions) are handled by the inference layer that powers the Service. The retention and processing of prompt and completion text by that layer is governed by the terms under which the model is served. If we begin persisting prompt or completion content for any purpose, we will update this policy and notify you before doing so.

4. Data sharing

We do not sell your personal data. We share data only as needed to operate the Service, including with infrastructure providers, Google and GitHub when you choose social sign-in, Dodo Payments for subscription billing and payment processing, and Google Analytics for marketing-site analytics. Dodo Payments handles payment-card data directly; Kourier does not store complete card numbers.

We may disclose data to law enforcement or other third parties when required by a valid legal process, or to protect our rights, our users, or our infrastructure from harm.

5. Data retention

We keep your account data for as long as your account is active. When you close your account, we will delete your personal data within a reasonable period, except where we are required to retain certain records (for example, for tax or legal compliance). Server logs are retained only as long as needed for the purposes described above and are deleted on a routine schedule. Specific retention periods are documented in our internal data-retention schedule and are available on request.

6. Security

Passwords are hashed, never stored in plaintext. API keys are stored as one-way hashes. Traffic between your client and the Service is encrypted in transit. Access to production systems is restricted to authorized personnel. No method of transmission or storage is fully secure, but we apply safeguards appropriate to the sensitivity of the data and respond promptly to reported security incidents.

7. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Receive a copy of your data in a portable format.
• Correct inaccurate or incomplete data.
• Delete your account and associated personal data.
• Restrict or object to certain processing.
• Withdraw consent for processing based on consent.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, email [email protected]. We will respond within a reasonable timeframe and at most within 30 days. We do not discriminate against users who exercise their privacy rights.

8. Cookies

The Cloud dashboard uses essential cookies to maintain your authenticated session. If you accept analytics, the marketing site loads Google Analytics, which may set analytics cookies or use similar technologies to measure site traffic and interactions. You can decline or later change this choice through Cookie settings. We do not use advertising cookies or use analytics data for targeted advertising.

9. International data transfers

Our team and infrastructure may be located in jurisdictions other than your own. Where your data is transferred across borders, we rely on appropriate safeguards to ensure a level of protection consistent with this policy and applicable law.

10. Children’s privacy

The Service is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe we have collected data from a minor, contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy as the Service evolves. Material changes will be posted on this page with an updated “Last updated” date. For significant changes affecting how we process your data, we will notify you before the change takes effect.

12. Contact

For privacy questions, data requests, or to exercise your rights, contact [email protected]. The data controller responsible for your information is Kourier AI Inc, a Texas corporation.