Privacy Policy

Gutter Tokens is operated by Matariki Limited, a Hong Kong limited company at 21/F, CMA Building, 64 Connaught Road Central, Hong Kong. We are the controller of the personal data described here. Privacy questions and requests go to legal@guttertokens.com.

The short version

• We do not keep the content of your requests or the models’ responses. No prompt log, no completion log, nothing.
• You must not send personal data through the API at all. Section 8 of the Terms prohibits it.
• The upstream providers who serve your requests may keep what you send them. We cannot see what they keep and cannot verify it.
• What we do hold is your account and the metadata your bill is calculated from.
• We do not sell personal data and do not share it for advertising.

1. What we collect

Account data. Your name, email address, a hash of your password, and whether the address is verified.

Usage metadata. For each request: timestamp, model, input and output token counts, duration, and cost. This is what your bill is calculated from, so it cannot be switched off while you hold an account.

Payment records. Amount, date, and a reference. Card details never reach our servers — Creem processes payment as merchant of record and holds them.

Operational and security records. The IP address a sign-up, sign-in, key issuance, checkout or account deletion came from, and the version of the Terms you accepted with the date and IP. These exist to investigate abuse and to evidence actions you may later dispute.

Correspondence. Whatever you send to our support, abuse, security or legal addresses.

2. What we do not collect

We do not retain the substance of your requests or the models’ responses. Prompts, system messages, attachments and completions are held in memory only for as long as it takes to pass them upstream and return the answer to you. They are never written to a log, a database, or a backup.

This is not a retention period that happens to be short. The content is never recorded, so there is nothing to expire.

The consequence is: we cannot show you a prompt you sent last week, cannot recover one you lost, and cannot produce one for you or for anyone who asks us for it. A support question about a failed request is answered from the metadata above, which is why the support page asks for a timestamp and a key prefix rather than for the request itself.

Checking our providers does not mean checking your traffic. Where we test how well an upstream provider is performing, we do it by sending synthetic requests of our own and looking at what comes back to us. We do not read, sample, score, or retain yours in order to do it. Section 2 of the Terms says the same thing from the other direction.

3. Personal data must not be sent through the API

Section 8 of the Terms prohibits submitting personal data — names, contact details, identifiers, account numbers, location, health or biometric data, or anything else identifying a living person — in a prompt, a system message, an attachment, or data your application inserts automatically.

Because we retain nothing of a request, we cannot find, export, correct, or delete personal data inside one. We cannot answer a data subject access request about it. We cannot tell you whether an upstream provider still holds it. There is no mechanism by which we could, and no retention setting that would change that.

If your use case requires processing personal data through a model, contract with a provider who will sign a data processing agreement covering it. We do not offer one, and this service is not built for it.

4. Upstream providers

Serving a request means transmitting its content to an upstream model provider. That is what the service does and it cannot be avoided.

What a provider retains is a matter between it and its own policies, and we cannot determine what it has kept. We have no visibility into their storage, no ability to audit it, and we make no representation that they retain nothing. Treat every request as visible to the provider serving it, and assume it may persist there.

We identify upstream providers by category rather than by name. Which of them serves a given model changes as capacity changes, and no personal data may be sent through the API in any event — so they are not recipients of personal data we hold, and we publish no subprocessor list. If your use requires a named supply chain and a data processing agreement covering it, Section 3 explains why this is not the service for that.

5. Who else we share it with

• Creem — takes payment as merchant of record and holds your card details. We never see them.
• Our email provider — sends transactional email: address verification, password resets and operational notices. Receives your email address and the message.
• Our hosting and storage providers — run the servers the application and database use, and hold our encrypted backups.

We do not sell personal data and do not share it for advertising.

We may disclose data where we are legally compelled to, and will tell you when that happens unless we are prohibited from doing so.

6. Where it is processed

The application and the database run on a server in the European Union. Encrypted backups are held with a cloud storage provider.

Transactional email is sent through a provider in the United States, so your email address and the contents of those messages are transferred there. Matariki Limited is a Hong Kong company, and account data is accessed from Hong Kong to administer the service.

7. Cookies

A session cookie signs you in. It is set when you sign in and cannot be turned off without breaking the login.

The API sets no cookies. It is machine to machine and no browser is involved.

The operator console runs on its own hostname and sets its own session cookie there. Customers never receive it.

8. How long we keep it

• Request and response content — never recorded, so never kept.
• Account data — until you delete your account. Deletion removes your name, email, password credentials and sessions immediately.
• Usage and payment records — seven years from the transaction, for tax, accounting and dispute purposes. After account deletion these survive attached to an internal numeric identifier that no longer maps to a name or an email address.
• Operational and security records — 24 months. Audit records survive account deletion with the link to your user record severed, but they still carry the IP address the action came from, which is why they expire rather than persisting indefinitely. Your record of accepting the Terms is not kept at all after deletion: it is destroyed with the account.
• Correspondence — 24 months from the last message in the thread.

9. Your rights

You can see and correct your account data from the dashboard, and delete your account there. Deletion revokes your API keys, disables further use, and forfeits any remaining credit balance — see Section 6 of the Terms.

Where Hong Kong’s Personal Data (Privacy) Ordinance applies, you have the right to ask what personal data we hold about you and to have it corrected.

Where the GDPR or UK GDPR applies to you, you also have rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to the supervisory authority in your own country. Where the CCPA applies, you have rights to know, delete and correct, and we do not sell or share personal information as that act defines those terms. We will not treat you differently for exercising any of this.

Write to legal@guttertokens.com. We verify a request by replying to the email address on the account, and answer within 30 days. Note Section 3: none of these rights can reach the content of a request, because we hold none of it.

10. Why we are allowed to hold it

Where the GDPR or UK GDPR applies: account data, usage metadata and payment records are processed to perform our contract with you. Operational and security records are processed in our legitimate interest in keeping the service secure and in being able to evidence what happened. Retention of financial records is a legal obligation.

We do not rely on consent as a lawful basis for any of the processing described above.

We make no automated decisions about you that produce legal or similarly significant effects.

11. Security

Traffic is served over TLS. Passwords are stored hashed, never in a recoverable form. API keys are shown once at creation and cannot be retrieved afterwards. Credentials held on your behalf are encrypted at rest, and database backups are encrypted. Access to production systems is limited to the operator.

If a breach affects your personal data we will tell you, and notify the relevant supervisory authority where we are required to, without undue delay.

12. Children

The service is sold for business use to people aged 18 or over. It is not directed at children and we do not knowingly collect their personal data. If we learn that we have, we will delete it.

13. Changes to this policy

The version in force and its effective date appear at the foot of this page. We give notice of a change by publishing it here and nowhere else — we do not email you about it — and it takes effect when published, on the same terms as Section 16 of the Terms. Check this page before you rely on it.

14. Contact

Privacy questions, data subject requests and legal notices: legal@guttertokens.com. Everything else, including abuse reports and security disclosures, has an address on the support page. Post reaches us at Matariki Limited, 21/F, CMA Building, 64 Connaught Road Central, Hong Kong.