Privacy Policy

2.1 Account information

• Email address
• Name (from the OAuth provider, when you sign in with a third-party account)
• Authentication data handled by Supabase Auth

2.2 Tracked providers

• Provider name
• Optional endpoint URL
• Pricing type and value
• Notes

All of the above are entered manually by you.

2.3 Usage records

• Date
• Provider
• Model name
• Token or call counts
• Cost amounts

All of the above are entered manually by you.

2.4 Technical data

• IP address processed by the hosting and authentication providers
• Browser data processed by the hosting and authentication providers

3.1 Contract Performance (Art. 6(1)(b) GDPR)

• Account creation and authentication
• Providing API cost monitoring services based on the data you enter
• Delivering cost-saving recommendations
• Responding to support requests you send us

3.2 Legitimate Interest (Art. 6(1)(f) GDPR)

• Platform security and fraud prevention
• Keeping the service available and in working order
• Technical infrastructure maintenance

3.3 Legal Obligation (Art. 6(1)(c) GDPR)

• Compliance with applicable law
• Response to lawful requests from authorities

3.4 Consent (Art. 6(1)(a) GDPR)

We do not send marketing communications and we do not use non-essential cookies.

5.1 Infrastructure

The service uses the following providers. We do not operate a separate security programme of our own beyond what those providers supply:

• Supabase: database, authentication and transactional email. Any encryption, backup or authentication features are those of Supabase, as described in Supabase’s own documentation and policies.
• Vercel: hosting of the application. Transport security (HTTPS) is provided by that hosting.
• The service does not collect or store third-party API keys or credentials.

5.2 Data Location

Account and application data are stored by Supabase. The application is hosted by Vercel. We do not independently operate data centres or specify a region in this application.

5.3 Access

You access your own data through your signed-in account. We do not offer multi-factor authentication, role-based access control or security audits as features of this service. Access practices of Supabase and Vercel are described in those providers’ own policies.

6.1 Vercel (hosting)

• Purpose: Hosting and delivery of the application
• Data processed: Technical data such as IP addresses and access logs, as processed by the hosting provider
• Privacy policy: vercel.com/legal/privacy-policy

6.2 Supabase (database, authentication and transactional email)

• Purpose: Database, user authentication and transactional email
• Data processed: Account data, tracked providers and usage records you enter, and authentication data
• Privacy policy: supabase.com/privacy

8.1 Active Accounts

We keep your data while your account remains active and as needed to provide the service.

8.2 Account Deletion

You can delete your account from Settings > Danger zone. Deletion removes the account and all associated data immediately and irreversibly. Usage records are deleted, not anonymized.

8.3 Legal Requirements

We may keep information if required by applicable law.

9.1 Right of Access (Art. 15 GDPR)

You can request a copy of the personal data we hold about you by contacting the address given in this policy.

9.2 Right to Rectification (Art. 16 GDPR)

You can request correction of inaccurate or incomplete data.

9.3 Right to Erasure (Art. 17 GDPR)

You can delete your account and all associated data immediately and irreversibly from Settings > Danger zone. You can also request deletion by contacting us.

9.4 Right to Data Portability (Art. 20 GDPR)

The application does not offer an export in JSON or CSV. You may request a copy of your data by contacting the address given in this policy.

9.5 Right to Restrict Processing (Art. 18 GDPR)

You can request limitation of how we process your data.

9.6 Right to Object (Art. 21 GDPR)

You can object to processing based on legitimate interests.

9.7 Automated Decision-Making (Art. 22 GDPR)

We do not use automated decision-making or profiling that produces legal effects.

9.8 Right to Withdraw Consent

We do not currently process personal data on the basis of consent for marketing or non-essential cookies.

9.9 How to Exercise Your Rights

To exercise any of these rights, contact us at: iltuobrand@outlook.it

We will respond to your request within 30 days (extendable by 2 months for complex requests).

10.1 Essential Cookies

We use essential cookies required for:

• User authentication and session management
• Security
• Service functionality

These cookies do not require consent as they are strictly necessary for the service.

10.2 Analytics

The application does not include an analytics or tracking SDK. We do not use third-party analytics cookies.