Privacy Policy

1. Data we collect

• Account data: username, email address, display name, role, hashed password and account preferences.
• Authentication and security data: session metadata (device label, IP address, timestamps), audit events and password-reset / email-change records.
• Billing data: credit balance, top-up history, payment-provider references, payment-intent status and invoice records. Card details are entered directly with Stripe and never reach our servers. Historical USDT entries may include a destination address and transaction hash from the former payment flow.
• Usage data: model, endpoint, token counts (including cache tokens), latency, HTTP status, error codes and request identifiers. We do not retain prompt or completion bodies for ordinary API calls.
• Content you choose to create: generated media artifacts, playground inputs you save, and messages you send to support.
• Technical data: IP address, browser type, requested pages and aggregate service metrics.

2. How we use data

• provide, secure and operate the Service, including routing requests to model providers;
• meter usage, calculate charges, issue invoices and prevent fraud or abuse;
• send transactional email such as verification, password reset, email-change confirmation and daily usage statements;
• respond to support requests and enforce our Terms;
• comply with legal, tax and accounting obligations;
• improve reliability and performance using aggregated, de-identified metrics.

3. Legal bases

Where data-protection law requires a legal basis, we rely on: performance of our contract with you (providing the Service and billing); our legitimate interests (security, fraud prevention, service improvement); compliance with legal obligations (tax and accounting); and consent where we specifically ask for it. You may withdraw consent at any time without affecting prior processing.

4. Sharing

We share data only as needed to run the Service, with processors bound by confidentiality and data-protection terms:

• model providers, which receive the request content needed to generate your result;
• Stripe, for card payment processing and invoicing;
• Changelly, for hosted crypto checkout and payment status callbacks;
• email delivery providers, for transactional messages;
• cloud hosting and database providers that store account and usage data;
• professional advisers, auditors and authorities where required by law.

5. International transfers

Our providers may process data in countries other than yours. Where required, we use appropriate safeguards such as standard contractual clauses. Changelly processes crypto checkout details under its own terms and privacy policy.

6. Retention

Account data is kept while your account is active and for a reasonable period afterwards to meet legal, tax and dispute-resolution obligations. Usage and billing records are retained for accounting and abuse-prevention purposes. Support conversations are kept only as long as needed to resolve the issue. Backups are rotated on a fixed schedule.

7. Security

Passwords are hashed with Argon2id; refresh tokens and email tokens are stored only as SHA-256 hashes; channel credentials are encrypted at rest. Access to production systems is restricted and audited. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

8. Your rights

Depending on your jurisdiction, you may have the right to access, correct, delete or port your personal data, to object to or restrict certain processing, and to lodge a complaint with a supervisory authority. Contact support@allgate.ai to exercise these rights; we may need to verify your identity. Deleting your account removes account data, subject to records we must retain by law.

9. Cookies and local storage

The console uses local storage for your session, locale and interface preferences. We do not use advertising trackers. Stripe may set cookies on its own checkout domain when you pay; those are governed by Stripe’s privacy policy.

10. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has created an account, contact us and we will remove it.

11. Changes and contact

We may update this policy; the new version will be posted here with a new "last updated" date. Material changes will be announced by email or in the console.

Privacy questions and requests: support@allgate.ai.

Website acquisition analytics

We use minimal first-party data to understand how visitors discover Allgate and which sources lead to verified new accounts. Your browser keeps a random session UUID in sessionStorage; the identifier is limited to that browser tab session.

Acquisition events contain that temporary UUID, the page path, the referring hostname when present, and UTM source, medium, campaign, content and term values when present. This analytics collection does not record IP addresses, full referring URLs or page query strings, uses no personal advertising cookies, and does not send the data to advertising networks. Do not put personal information in UTM values.

Browsers that enable Do Not Track (DNT) or Global Privacy Control (GPC) do not send these acquisition events. If you register from an acquisition session, attribution is linked only to a server-verified newly created account to measure conversion. Account security logs are handled separately from this acquisition analytics collection.