Privacy Policy

This notice explains what personal information we collect when you use the Rhodes API and portal, why, who we share it with, and how long we keep it.

It covers our customers — the developers and companies who hold an account. For data about your own end users, you are the controller and we are a processor.

Account Information

• Your email address
• Authentication identifiers from our identity provider
• Stripe customer ID (we do not store card numbers)
• Account status (active or suspended)
• Signup IP address (to enforce trial credit limits)
• Account creation and activity timestamps

Credit Records

One record per credit movement: the amount, the type (purchase, trial, refund, adjustment), the Stripe event identifier, and a timestamp. This table is append-only for money integrity.

Usage Metadata

Per-request records containing: timestamp, model name, token counts, cost, and your customer identifier. These records do not contain your prompts or the model's responses.

What We Do Not Store

• Card numbers or payment instrument data (Stripe holds these)
• Passwords (authentication is handled by our identity provider)
• API key secrets in cleartext (shown once at creation, never stored)
• Prompt or response content (see section 4)

We may disclose information where required by law, to enforce our terms, to investigate fraud or abuse, or in connection with a corporate transaction. We do not sell personal information and we do not share it for advertising.

We do not retain the content of your requests or the model's responses. The gateway's per-request log records metadata only — timestamp, model, token counts, cost, and customer identifier. Storing prompt and response content is not enabled in our configuration.

Your prompts are transmitted. To serve a request, the full content is sent to the third-party model-hosting provider that fulfills it, and the response comes back through us to you. This is unavoidable — it is how the product works.

The providers have their own retention. What a provider does with a request it receives is governed by that provider's own terms and retention practices, not by ours.

• Providing the Service: Account management, API keys, usage tracking
• Billing and metering: Credit tracking, usage records, payment processing
• Fraud prevention: Signup IP tracking, trial credit limits, rate limiting
• Communications: Low credit warnings, service notifications
• Security and compliance: Logs, metrics, incident response

We implement the following security measures:

• TLS encryption in transit (TLS 1.2/1.3)
• Database and cache encryption at rest
• API key secrets never stored in cleartext
• Secret redaction in logs
• Hard prepaid spend cap enforced before dispatch
• Per-key and per-IP rate limits
• Token-based authentication with RS256 verification
• Encrypted backups with point-in-time recovery
• Server-side only portal (no secrets in browser)

We are not SOC 2 audited, not ISO 27001 certified, and not HIPAA compliant. No system is perfectly secure. We cannot guarantee the security of information you transmit to us.

You can view your account details, balance, credit history, usage, and keys in the portal at any time, and you can revoke a key yourself.

Service emails (low credit, credit exhausted, credit added) cannot be switched off while the account is active. We send no marketing email.

Depending on where you live, you may have rights to access, correct, delete, or port your personal information, and to appeal a refusal. Contact us at privacy@rhodes.ai to exercise these rights.

Do not send us, or send through the API, special-category or regulated data — including protected health information, payment card data, government identifiers, or children's data. We are not built or certified for it, and prompts are transmitted to third-party providers.

We may update this policy from time to time. We will notify you of material changes by email or through the Service. Continued use after changes constitutes acceptance.