Privacy Policy

Summary

We do not train models on your prompts. We do not sell your data. We collect the minimum required to run the Service and to give your organisation an audit trail. Where prompts contain PII, we redact it before any third-party LLM sees it.

1. What we collect

• Account data: email, display name, hashed password (PBKDF2-SHA512 · 600k iterations) or SSO subject claim from your IdP.
• Prompts and responses: stored as sanitised text — original PII values are tokenised before storage. We retain conversation history for your own session re-injection and for the optional Consensus training corpus.
• Audit metadata: request timestamps, outcome codes, token counts, latency, provider used. We never store PII values in the audit log — only types and counts.
• Usage counters: monthly token, cost, request, and blocked counts per tenant for billing and quota enforcement.
• Diagnostics: IP address and user-agent on consent click-throughs (kept for legal defensibility), and on DSAR requests.

2. Why we process it

• To deliver the Service you asked for — routing your sanitised prompt to your selected LLM.
• To enforce your organisation's RBAC, PII rules, quotas, and ethical guards.
• To give your tenant administrators an audit trail required by their own compliance obligations.
• To detect and prevent abuse of the Service.
• To meet our legal and contractual obligations.

Legal bases (where GDPR / UAE NDPL / India DPDP apply): performance of contract, legitimate interest in maintaining the Service securely, and your consent for non-essential processing.

3. How PII is handled

1. Detection. Every prompt passes through our PII engine which applies country-, domain-, and tenant-specific rules to find spans of personal data.
2. Tokenisation. Each detected span is replaced with an opaque placeholder like <<EMAIL_1>>. The original is AES-256-GCM encrypted and written to a tenant-scoped vault.
3. Forwarding. Only the tokenised prompt — never the original PII — reaches the LLM provider.
4. Re-injection. When the response returns, placeholders are decrypted back to original values only for the session owner. Any other user requesting the same session receives a 403.
5. Audit. The audit log records the count and type of redactions (e.g. "Email × 1, Phone × 1"), never the values.

4. Who we share with

• LLM providers you have selected (Anthropic Claude, OpenAI, Google Gemini, X.AI Grok, Z.AI, DeepSeek, Qwen, Featherless, or your own Ollama). They receive only the sanitised prompt.
• Stripe for billing, where you choose a paid plan. They process card data on their own systems; we never see your card number.
• Microsoft Azure / Google Cloud as your OIDC identity providers, if you choose SSO.
• Legal authorities only if compelled by a valid court order in a jurisdiction that binds us.

We do not share your data with advertisers. We do not sell your data.

5. Retention

• Vault entries (PII placeholders): 30 days by default, configurable per tenant.
• Conversation history: 90 days by default.
• Audit log: 7 years (2 555 days) — required for downstream compliance.
• Consent receipts: retained for the life of the account plus the limitation period of the applicable jurisdiction.
• Deleted accounts: hard-deleted 30 days after a successful DSAR delete request, unless you cancel.

6. Your rights

• Access. Use GET /v1/me/dsar/export to download a JSON of your data.
• Erasure. Use POST /v1/me/dsar/delete to schedule a deletion. Account is suspended immediately; data hard-deleted after 30 days unless you cancel.
• Rectification. Update your profile via the admin console or contact your tenant admin.
• Portability. The DSAR export is machine-readable JSON.
• Withdraw consent. Revoke any T&C / Privacy / DPA acceptance at any time; we will block further use until a new version is accepted.
• Complain. File a complaint with the data-protection authority of your jurisdiction.

7. Data residency

Each tenant is tagged with a primary DataRegion. For MVO, all data is stored in the United Arab Emirates region. We will publish additional regions (India, EU, Singapore, US) before opening them for tenant selection. We will not migrate your data to a different region without your tenant admin's explicit authorisation.

8. Contact

Reach our Privacy team at privacy@clab.stellarchd.com. We will respond within 30 days for DSARs and 5 business days for general privacy enquiries.