Privacy Policy

We collect the bare minimum amount of information required to provide you with secure API access:

• Account Information: Developer account email addresses, registration details, and authentication metadata.

• API Usage Metadata: API key prefixes, hashed key material, and technical routing configurations.

• Usage Events: Transactional metrics including API call modes, SKUs, token counts, timestamps, and billable amounts.

• Payment Data: All payments are processed securely by Stripe. We do not collect, store, or access full credit card numbers. Stripe provides us only with a generic customer token and payment confirmation metadata.

• Images and API requests: The Service is designed to be stateless. We do not persist camera frames, text payloads, or image uploads on our servers after processing. Payload data is transmitted securely to our upstream infrastructure partners for automated, contextual analysis and is instantly discarded from our application layer memory upon delivery of the API response. We retain only operational technical metadata (such as status codes, latency, and token counts) for billing and system security purposes.

We use the collected data strictly to:

• Provision, maintain, and secure your developer account and API keys.

• Calculate your real-time usage for our pay-as-you-go billing tiers.

• Send you critical technical notifications, system updates, or required 30-day service deprecation warnings.

• Detect, prevent, and mitigate malicious activity, prompt-injection attacks, abuse, or security vulnerabilities.

We use cookies and similar technologies to ensure the security, functionality, and proper operation of the developer portal. Because we do not use advertising tracking or third-party marketing pixels, we do not track your activity across the internet.

We utilize the following types of essential data storage:

• Authentication Cookies (Supabase): When you log in using your email, password, and multi-factor authentication (MFA), our authentication provider sets strictly necessary session cookies. These cookies identify your developer session and keep you securely signed in as you navigate the dashboard. Session cookies automatically refresh during active use. They remain active until you explicitly sign out, manually clear your browser data, or the session naturally expires under our security settings.

• Security & Infrastructure Cookies (Cloudflare): Our hosting and security provider sets essential cookies and processes incoming request metadata. This data is strictly used to optimize portal performance, ensure site stability, and protect our infrastructure from malicious abuse and cyber threats.

• Third-Party Billing Cookies (Stripe): If you access or use our billing and payment features, you will be securely redirected to our payment processor. They set independent cookies required to process payments securely and prevent fraud, subject to their own privacy policy.

• Local Preferences: We store small, non-tracking preference variables directly in your browser's local storage. This is used solely to improve your user experience, such as remembering that you have dismissed a specific dashboard announcement so it does not appear again.

Because these technologies are strictly necessary for security, fraud prevention, and core portal functionality, they cannot be disabled if you wish to use the developer portal.

When you integrate our Service into your software application, you transmit data and image payloads through our infrastructure.

• Role as Data Processor: We act strictly as a technical data processor for any data or image payloads transmitted through our API endpoints.

• No Retention of Payload Data: We do not permanently store, archive, or inspect the data or image payloads processed by your API calls. Payloads are processed in volatile memory and instantly discarded after the API response is delivered.

• Your Duty: If your application sends end-user personal data through live API keys, you are entirely responsible for providing end-user privacy notices, establishing a lawful basis for processing, and obtaining necessary consent. HorusEngine acts as a processor for that API data under these terms.

We do not sell, rent, or trade your account information to third parties. We share data only with trusted service providers necessary to operate our infrastructure and fulfill your API requests:

• OpenAI: Data payloads containing images and text are transmitted securely via API for machine processing, inference, and contextual vision analysis. OpenAI does not use data submitted via their developer API to train their AI models, and retains data for a maximum of 30 days strictly for abuse and misuse monitoring.

• Supabase: Used to securely store and manage developer account profiles, access credentials, authentication records, and active account credit balances.

• Cloudflare (Pages & Workers): Used to host our developer portal frontend, deploy edge computing functions, and cache static documentation. Cloudflare may process network request metadata, technical device data, and IP addresses to optimize routing and protect against distributed denial-of-service (DDoS) attacks.

• Resend: Used to manage and reliably deliver transactional emails, system alerts, technical notifications, and critical account lifecycle updates to developers.

• Stripe: Used to securely manage payment tokenization, auto-reloads, and transaction processing.

• Fly.io: Used to host our API servers and route real-time network traffic.

We employ industry-standard technical measures to protect your developer keys and account credentials. However, no internet transmission or server architecture is 100% secure. You are entirely responsible for keeping your generated API secret keys hidden and secure within your own application backend.

You may close your account at any time via the self-service account deletion tool located within your developer portal dashboard, or by contacting us at info@zoeark.com. ZOEARK LLC utilizes a hard-close and data anonymization workflow for account deletions:

• Immediate Deactivation: Upon initiating self-service account deletion, your portal login is permanently removed, your active API keys are immediately revoked, and your right to access the Service ceases.

• Data Anonymization and Telemetry Purge: Your account email address is permanently removed and anonymized within our production databases (Postgres). We retain only an irreversible cryptographic hash of your email address (email_hash) solely for account lookup, system security, and re-activation mapping. All raw API usage events and telemetry data associated with the account are permanently deleted and purged from our systems ninety (90) days after account deletion.

• Authentication diagnostic logs. To troubleshoot signup, email confirmation, and password-reset issues and to detect abuse, we maintain a short-lived operations log in our Supabase database. Each entry records the event type, outcome, a one-way hash of the developer email address (not the plain email), sanitized error information where applicable, and limited technical metadata. Passwords, one-time codes, and session tokens are never written to this log. Entries are automatically deleted thirty (30) days after they are created. Closing your account does not immediately purge log entries that are still within that window.

• Re-Activation Rules: If you register for a new account in the future using the same email address, our system will link the registration to your existing internal developer identifier (id). However, your previous configuration is not restored; your starting account balance will reset to zero dollars ($0.00) and you must generate entirely new API keys.

• Regulatory Tax Retention: In compliance with financial and tax regulations, historical transactional data (including your balance ledger, credit grants, and Stripe invoice) will be securely retained for a period of ten (10) years following account closure. This data is maintained in an anonymized or securely isolated format.

We reserve the right to modify this Privacy Policy at any time. Any changes will be posted on this page with an updated "Last Updated" date. Your continued use of the Service after changes are posted constitutes your acceptance of the revised policy.

For any privacy inquiries, DPA requests, or to request account deletion, please contact us at: info@zoeark.com