Privacy policy

1. Who we are

typestrict.ai is the controller of your account data. For the data you upload about your own customers, you are the controller and we are the processor. Contact: privacy@typestrict.ai.

2. What we collect

• Account: name, email, password (stored only as a hash), passkeys, and your Google profile if you sign in with Google.
• Files and sources you send us, and the datasets and models made from them.
• Payments: Stripe handles your card. We receive the amount, the status of the payment and your email, never the card number.
• Contact, consulting and investor forms: name, email, company and message, used only to reply and kept in our mailbox.
• Security: IP address, browser and access times, to protect accounts, limit abuse and keep the access logs the law requires.

3. How we treat the files you upload

• First step, before anything else: we mask personal data (names, emails, phone numbers, documents such as CPF and CNPJ, card numbers).
• The original upload is deleted as soon as the masked copy exists.
• Our structuring agent (a language model reached through OpenRouter) sees only the shape of your data and masked samples, never the raw files.
• Training runs on GPUs rented from vast.ai, whose machines belong to third parties. They only receive masked data, and each machine is destroyed when the run ends.
• The comparison with Jev sends the masked held-out examples to Jev through OpenRouter. Jev's answers are used only to measure, never to train.
• If you tell us your files hold no personal data, masking is skipped at your request and responsibility.
• After training, the model runs in your environment: what you ask it never comes back to us.

4. Why, and on what legal basis

• To run the service you hired: performance of a contract.
• To protect accounts and the service: legitimate interest.
• To keep tax records and access logs: legal obligation.
• Product emails (sign-up, password, receipts) are part of the service. We do not send marketing without your consent.

5. Who processes data for us

• Railway: application hosting and database (United States).
• Cloudflare: file storage (R2), bot protection (Turnstile), content delivery and cookieless visit and performance statistics (Web Analytics).
• Better Stack: uptime and technical error monitoring (without the content of your data) and, only if you accept analytics cookies, real user monitoring: pages visited, load times, clicks and errors in the browser. The content of the signed-in area is excluded.
• vast.ai and its hosts: GPU machines for training, masked data only.
• OpenRouter and the model providers behind it: the structuring agent and the Jev comparison, masked data only.
• Stripe: payments. Resend: transactional email and form messages. Google: sign-in, if you choose it, and Google Analytics, only if you accept analytics cookies.

Some of them are outside Brazil. Those transfers rely on contractual safeguards with each provider. We do not sell personal data.

6. How long we keep it

• Original uploads: deleted right after masking.
• Masked data and datasets: until 90 days after their last use (a training started on them, or a copy to adjust). Uploads that never finished, or failed: 30 days.
• Trained models: the files can be downloaded for 30 days after the training. A model that did not beat Jev has its files deleted at once (the credit came back), and a published model's files move to your Hugging Face. The record of each training (its numbers, verdict and audit) stays while your account exists.
• Closed accounts: everything is deleted 30 days after you ask, unless you cancel before.
• Payment records: 5 years, as tax law requires.
• Access logs: 6 months, as the Marco Civil da Internet requires.

7. Your rights

You can ask for confirmation, access, correction, anonymization, portability or deletion of your data, information about sharing, and review of consent, by writing to privacy@typestrict.ai. Many of these you can do yourself in the dashboard. You may also complain to the ANPD (Brazil) or to your data protection authority.

8. Security

Traffic is encrypted (TLS), storage is encrypted at rest by our providers, and access to customer data is restricted to what running the service needs.

9. Children

The service is not meant for people under 18, and we do not knowingly collect their data.

10. Changes

If this policy changes in a way that matters, we will tell you by email before the change takes effect.