Privacy Policy

1. What you send to the API

What it covers. The states, questions, images, video frames and answers of your API and Playground requests ("request content").

What happens to it by default:

• Processed only to answer. We use request content only to answer your request. We don't write it to our database or our logs.
• Briefly held in memory. To answer repeat requests faster, the model server keeps recent answers, and the model's working cache, in memory. They aren't written to disk, and they're discarded as new requests arrive or when the server restarts. Add "cache": 0 to a request to skip the answer cache.
• Never used for training. We don't use request content to train or improve our models.

2. Data sharing (off unless you turn it on)

In the console, under Settings → Data sharing, you can choose to let us keep request content and use it to improve Simo. Accounts that share data may be offered discounted pricing.

• It's off for every account until you turn it on.
• We record your choice: when you turned it on, and the version of this policy you agreed to.
• Only requests sent while it's on may be kept. Turning it off stops this immediately.
• You can withdraw at any time. Turn it off in Settings, and ask us at hello@temprl.org to delete what you shared.
• Don't share data you can't share. Leave it off if your requests contain personal or confidential data you're not allowed to share with us.

3. What we collect

• Account:
  • your email and name;
  • a one-way hash of your password (never the password itself);
  • if you sign in with Google, your Google account ID, email and name;
  • when you joined and last signed in;
  • whether your email is confirmed.
• Security:
  • for each sign-in session, the IP address and browser type;
  • for sign-in attempts and email confirmation links, the email and IP address, used to stop password guessing and email abuse.
• API keys: a name, the first characters and a one-way hash. We can't see your full key after creating it.
• Usage records, for billing:
  • for each request: the time, model, key used, status, number of questions, tokens, cost and latency;
  • not the request content.
• Billing:
  • your balance and its history;
  • each top-up's amount, and the payment and checkout IDs from Dodo Payments.

  Dodo, the merchant of record, collects your card or payment details, billing name and address, and handles tax. We don't receive your card number.

• Website analytics on temprl.org:
  • Google Analytics records pages viewed and general device information.
  • PostHog records page views, the referring page and screen width. It doesn't record your sessions.
  • Only with your consent does either store anything in your browser (Google Analytics cookies, a random PostHog visitor ID). A banner asks the first time you visit. Until you accept, Google Analytics runs in its cookieless consent mode and PostHog uses a temporary ID that isn't saved.

  The console and the docs don't load these analytics tools.

• Messages: what you send us by email.

4. How we use it

• To run the service: accounts, sign-in, answering requests, billing and invoices.
• To keep it secure: stopping abuse, fraud and free-credit farming.
• To send you service emails: confirmation links, receipts, important changes. We don't send marketing email without your consent.
• To understand and improve the website.
• To meet legal, tax and accounting obligations.

Our legal bases. We rely on:

• providing the service you asked for (the contract);
• our legitimate interests in security and improving the website;
• legal obligations;
• your consent, for data sharing and for analytics cookies.

5. Who processes it

We don't sell personal data. We share it only with providers that run parts of the service for us, and only for that purpose:

• Cloudflare: hosting of the API, console and docs, our database, and email delivery.
• A cloud GPU provider in the United States: runs the model server.
• Vercel: hosts the website.
• Dodo Payments: payments, tax and invoices, as merchant of record.
• Google: Google sign-in and Google Analytics.
• PostHog: website analytics.

We may also disclose data if the law requires it, or to protect people or the service. If the business is sold or merged, this policy continues to apply to your data.

6. Where it is processed

We're based in India. Our providers process data in India, the United States and other countries where they operate, including Cloudflare's global network. Where the law requires, we rely on appropriate safeguards for these transfers.

7. How long we keep it

• Account, usage and billing records: while your account is open. After you close it, we delete or anonymise them within 30 days, except billing and tax records, which we keep as long as accounting and tax law requires.
• Sign-in sessions: until they expire, at most 30 days after last use.
• Sign-in attempts: 24 hours.
• Email confirmation links: until used or 24 hours.
• Request content: not kept (see section 1), unless you opt in to data sharing. Shared data is kept until you ask us to delete it, or until it's no longer needed to improve Simo.

8. Your rights

• What you can ask. Depending on where you live (including under India's Digital Personal Data Protection Act, 2023, and the EU and UK GDPR), you can ask to:
  • access, correct or delete your personal data;
  • get a copy of it;
  • object to or restrict some uses;
  • withdraw consent at any time.
• How to ask. Email hello@temprl.org from your account's address. We reply within 30 days.
• Complaints. If you're unhappy with our answer, you can complain to your data protection authority. In India, that's the Data Protection Board of India.
• Grievance officer. Reach our grievance officer for privacy matters at hello@temprl.org.

9. Security

• Passwords are stored only as salted one-way hashes (PBKDF2), and API keys only as hashes.
• Connections to the website, console and API use HTTPS.
• Access to production systems is limited to the people who run them.

No system is perfectly secure. If we learn of a breach that affects your data, we'll tell you and the authorities as the law requires.

10. Cookies and browser storage

Here's what each site stores in your browser:

• The website remembers your cookie choice. Only if you accept analytics does it also set Google Analytics cookies and store a random PostHog visitor ID. Change your choice at any time with Cookie settings (also in the footer of every page). Rejecting deletes the analytics cookies and the visitor ID.
• The console stores your sign-in session token and your light or dark theme choice. It sets no tracking cookies.
• The docs remember your theme and preferred code language.

You can clear or block these in your browser settings. Blocking the console's storage will sign you out.

11. Children

The service is for people aged 18 and over. We don't knowingly collect data from children. If you think a child has given us data, email hello@temprl.org and we'll delete it.

12. Changes

We'll update this policy when what we collect or how we use it changes. If a change matters, we'll tell you in the console or by email before it applies.

A change to data sharing never applies to you without your agreement: if what data sharing means changes, we'll ask you to opt in again.

13. Contact

Temprl Business Private Limited, India. Email hello@temprl.org.