Privacy Policy

1. Data Controller & Data Processor Roles

For SafePipe's own account and service management purposes, the data controller is:

2. What Data We Process

2.1 Data We DO Process (Temporarily)

• API Request Content: Prompts and messages sent through our API are processed in memory to apply PII redaction and content filtering. This data is never written to disk.
• API Response Content: Responses from AI providers pass through our servers for filtering. This data is never written to disk.

2.2 Data We DO Store

• Account Information: Email address, name, company name (if provided)
• Authentication Data: Hashed API keys, OAuth tokens
• Request Metadata: Timestamps, model used, latency, token counts, PII detection flags (boolean only, not the actual PII)
• Billing Information: Processed by Stripe; we do not store full payment details
• Configuration: Your protection settings and preferences

2.3 Data We DO NOT Store

3. Infrastructure & Data Location

Your data never leaves the European Economic Area (EEA). When routing to AI providers, we only send redacted/cleaned data, and we prioritize EU-based endpoints where available.

4. Legal Basis for Processing (GDPR)

We process your data based on the following legal grounds:

• Contract Performance (Art. 6(1)(b)): To provide the SafePipe service
• Legitimate Interest (Art. 6(1)(f)): For security, fraud prevention, and service improvement
• Legal Obligation (Art. 6(1)(c)): For tax and accounting requirements
• Consent (Art. 6(1)(a)): For optional marketing communications (which you can opt out of anytime)

5. Data Retention

6. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the following rights:

• Right of Access (Art. 15): Request a copy of your personal data
• Right to Rectification (Art. 16): Correct inaccurate data
• Right to Erasure (Art. 17): Request deletion of your data
• Right to Restrict Processing (Art. 18): Limit how we use your data
• Right to Data Portability (Art. 20): Receive your data in a machine-readable format
• Right to Object (Art. 21): Object to processing based on legitimate interest
• Right to Withdraw Consent (Art. 7): Withdraw consent at any time

To exercise any of these rights, contact us at privacy@safepipe.eu. We will respond within 30 days.

7. Third-Party Services

We use the following third-party services:

• Stripe: Payment processing (PCI-DSS compliant)
• Supabase: Database and authentication (EU region)
• Vercel: Hosting (EU region)
• OpenAI / Anthropic / DeepSeek / Mistral: AI providers (receive only cleaned/redacted data)

8. Security Measures

We implement industry-standard security measures including:

• TLS 1.3 encryption for all data in transit
• AES-256 encryption for data at rest
• Regular security audits and penetration testing
• Access controls and principle of least privilege
• 24/7 infrastructure monitoring

9. Cookies

We use only essential cookies required for authentication and session management. We do not use tracking cookies or advertising cookies.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email and by posting the updated policy on this page.

11. Supervisory Authority

You have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is: