Privacy Policy.
Last updated 5 November 2026.
This policy explains what personal data Examopotamia collects when you use ACPpotamia, why, how long we keep it and the choices you have.
What we collect
- Billing records: your plan, the dates and amounts of payments, the payment method (PayPal or Wayl) and the provider's reference for each payment.
- Account details: your name, email, team name and a salted hash of your password (never the password itself).
- Sign-in records: a session identifier, the IP address and browser of each sign-in, kept for the life of the session (up to 14 days).
- Call records (the audit log): for every call, the time, your agent and session names, the model, token counts, cost, outcome, timing and a one-way hash of the request.
- Request and response text: only if your team turns on payload logging (Pro and Enterprise), the first 64 KB of each request and response.
- What we do not keep: your model provider API keys. They are forwarded with each call and never stored or logged.
Why we use it
- To run the service: checking keys, forwarding calls, enforcing your limits and showing you your activity.
- To keep the service secure, for example limiting repeated failed sign-ins.
- To answer your support requests and send essential service notices.
We do not sell personal data, show advertising or use your content to train AI models.
Who processes it
- Cloudflare hosts ACPpotamia and stores its data. Account data and the audit index are stored in Cloudflare D1 in Europe; log files in Cloudflare R2.
- Your model providers (such as OpenAI or Anthropic) receive the calls you send through ACPpotamia, because you direct us to forward them. Their own privacy terms apply.
- PayPal and Wayl process payments for paid plans. They receive the payment details you give them; we receive only the payment's status, amount and reference, never your card or wallet details.
- Google Fonts serves the typeface on our web pages, which means your browser contacts Google when you load them.
How long we keep it
- Call records and payload logs: 365 days, then deleted automatically.
- Sign-in sessions: until you sign out or 14 days pass.
- Billing records: as long as tax and accounting law requires.
- Account details: while your account is open. When you ask us to close it, we delete account data within 30 days, apart from records the law requires us to keep.
Security
All traffic uses HTTPS. API keys and session tokens are stored only as SHA-256 hashes; passwords as PBKDF2 hashes. Access to production data is limited to the people who run the service.
Your rights
You can ask for a copy of your data, correct it, delete it or object to how we use it by writing to acp@examopotamia.com. We answer within 30 days. If you are in the EU, UK or another region with data-protection law, you can also complain to your local regulator. For content your own customers sent through your agents, your team is responsible for its own privacy notice, and we act on your instructions.
Cookies
We use one cookie, __Host-acp_session, to keep you signed in to the console. It is strictly necessary, so it needs no consent banner. We use no analytics or advertising cookies.
Changes
We will post changes here with a new date and email account owners about material changes before they apply.
Contact
Examopotamia · acp@examopotamia.com