privacy policy

01the short version

we collect what we need to run the service and bill it accurately, and nothing we are not using. we do not sell your personal data. this page is a plain-language draft of that intent, pending review by counsel.

02what we collect

account data: your email and the credentials or tokens needed to sign you in and identify your account.

usage data: the sites and hostnames you ask us about, the api calls you make, your token ledger, and your api keys and webhook endpoints. we need this to deliver results, meter usage, and keep the service working.

operational data: standard logs such as ip address, timestamps, and request metadata, used for security, rate limiting, and debugging.

03how we use it

we use your data to provide the service, run and settle metering, keep the current-best configuration fresh, secure the platform, prevent abuse, and support you. we may use aggregated, de-identified data to improve the accuracy of the matrix and the intelligence consoles.

we do not use the private detail of what you look up to build a public profile of you.

04what we do not do

we do not sell your personal data. we do not share the specific sites you query with other customers. the public matrix and news feed are built from our own benchmarking fleet and public sources, not from your private lookups.

05sharing with providers

we use infrastructure and service providers (for example hosting, databases, and payment processing) that handle data on our behalf under contract. they may only use it to provide their service to us. we will list the material categories of these providers as this policy is finalized.

06retention

we keep account and billing records for as long as your account is active and as required for legal, accounting, and security reasons. operational logs are kept for a limited window. when data is no longer needed, we delete or de-identify it.

07your choices

you can access and update your account details, rotate or revoke api keys, and remove webhook endpoints at any time. you can request a copy of your data or ask us to delete it, subject to records we must keep by law. depending on where you live, you may have additional rights, which we will honor as required.

08security

we hash secrets at rest, validate outbound webhook destinations to guard against server-side request forgery, sign webhook deliveries so you can verify them, and rate limit the api. no system is perfectly secure, but we work to protect your data and to respond quickly if something goes wrong.

09changes and contact

we may update this policy as the product and its legal review evolve, and we will change the last-updated date when we do. questions or requests can go to privacy@automation-benchmark.dev.