This Policy explains how Zephex collects, uses, and shares personal information when you use our dashboard and proxy.

Information we collect

• Account: email (and optional profile details you provide).
• API keys: key metadata (prefix/ID). We do not store plaintext API keys.
• Usage: request counts, tool names, timestamps, and related usage metrics.
• Security logs: IP address, user agent, login attempts, and abuse signals used to secure the Service.
• Billing: subscription status and payment-related data handled by Stripe.

How we use information

• Provide the Service (authentication, routing, dashboards, support).
• Secure the Service (fraud prevention, rate limiting, suspicious activity detection).
• Billing and accounting (subscriptions, invoices, usage reconciliation).
• Improve reliability (debugging, performance monitoring).

Cookies

We use cookies and similar storage to keep you signed in, protect your account, and operate the dashboard. Optional analytics may be used to improve the product.

Sharing and processors

We share personal information only with service providers (“processors”) as needed to run the Service, including:

• Supabase (database and authentication)
• Stripe (payments and billing)
• Upstash (rate limiting)
• Email providers (transactional emails)
• Error monitoring (to detect and fix outages)
• Hosting/CDN providers (to serve the app)

Data retention

We retain personal information only as long as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. Some records (for example: billing) may be retained longer where required.

Your choices

• Rotate/revoke API keys in the dashboard.
• Request export or deletion of your account data by contacting us.

California Privacy Rights (CCPA)

If you are a California resident, you have the following rights:

• Right to Know: You may request what personal information we collect and how we use it.
• Right to Delete: You may request deletion of your personal information.
• Right to Opt-Out: You may opt-out of the sale of your personal information.

We do not sell your personal information.

Children's Privacy

We do not knowingly collect personal information from children under 13 years of age. If we become aware that we have collected data from a child under 13, we will delete it promptly.

Data Breach Notification

In the event of a data breach that affects your personal information, we will notify you via email within 72 hours of discovering the breach, as required by applicable law.

Contact

Privacy questions: support@zephex.dev