saler.ai Privacy Policy

1. What we collect (itemised — no "etc.")

1. Account information: email address, name (if provided), payment identifier (we never handle full card numbers).
2. API call metadata: time, endpoint, parameter hash, response status, credits consumed, key id.
3. Query content: domains, keywords, prompts (questions).
   • ⚠️ Stated plainly: what is retained long-term is not "plaintext kept for 7 days" but the normalized observation text (question / answer text) — the factual basis of the service you purchased. What is kept for 7 days is the upstream raw payload (raw_payloads). See §5.
4. Technical logs: IP (used for risk control only, never written to the cold store), user agent, request id.
5. Documentation-site cookies / analytics (if used).

2. Purposes and Legal Bases (GDPR Art.6)

1. Performance of a contract: providing the service, billing, fraud prevention.
2. Legitimate interests: service improvement, abuse prevention, aggregate analysis (a balancing assessment has been carried out).
3. Consent: the external-data-product grant (where applicable, see ToS §7).
4. Legal obligation: tax and judicial requirements.

3. Data Sharing and Subprocessors

1. MoR payment processors (list and purposes to be completed on integration).
2. Cloud infrastructure: Cloudflare (Workers / D1 / R2 / Queues).
3. Upstream data vendors (DataForSEO and others) — your queries are forwarded to these third parties. This is a necessary part of how the service operates and is disclosed explicitly.
4. Email / support tooling.
5. The subprocessor list page (changes visible at any time) → satisfies GDPR Art.28. See the Subprocessors document.

4. International Transfers

1. Data is processed across Cloudflare's global network and may leave your jurisdiction.
2. Transfer safeguards (SCCs or an equivalent mechanism).

5. Retention (⚠️ consistent with "raw data short-lived, derived data long-lived")

The text below quotes the effective version of docs/data-authorization-terms.md §3 verbatim and is not reworded here.

Chinese (effective)

B5 保留期限

1. 上游原始响应（raw payload）： 自采集之时起保留 7 天，到期自动删除（配置 SALER_RAW_TTL_DAYS，上限 30 天，当前值为 7）。清除任务随每日采样任务执行，即使当日采样停摆，清除任务仍会运行。

2. 归一化观测记录： 我们长期保留去标识化后的观测记录，包括问句文本、回答文本、以及由二者计算得到的可见度指标。这类记录是您所购买服务的事实依据（例如"某品牌在某日某引擎的回答中被提及"），删除它等于无法复核已交付的结论。该等记录已在采集时完成归一化与哈希，是派生资产而非原始报文。

3. 计算得到的指标与聚合数据： 长期保留。

4. 计费与对账日志： 保留至法定或财务必要的期限。

5. 来源 IP： 不进入任何数据存储。我们仅将来源地址以加盐哈希的形式用于请求频率限制的计数（不可反查，且不与您的账户关联）。

English (effective)

B5 Retention

1. Upstream raw responses: retained for 7 days from collection and then automatically deleted (config SALER_RAW_TTL_DAYS, max 30; current value 7). The purge runs together with the daily sampling job — and runs even if sampling itself is stalled that day.

2. Normalized observation records: we retain de-identified observation records long-term, including question text, answer text, and the visibility metrics computed from them. These records are the factual basis of the service you purchased (e.g. "brand X was mentioned in engine Y's answer on date Z"); deleting them would make delivered conclusions impossible to verify. They are normalized and hashed at collection time — derived assets, not raw payloads.

3. Computed metrics and aggregates: retained long-term.

4. Billing and reconciliation logs: retained for the period required for legal or financial purposes.

5. Source IP addresses: not written to any data store. We use the source address only as a salted hash for request-rate counting (not reversible, and not linked to your account).

6. Your Rights and Response Times

1. Access / rectification / erasure / restriction of processing / objection / portability.
2. How to opt out of aggregate improvement (currently by written notice only; a self-service entry point is still to be built).
3. DSAR response time (30 days under GDPR); contact address: service@saler.ai.
4. Complaints channel (where applicable, pointing to the supervisory authority).

7. Other

1. Children: the service is not directed at anyone under 16.
2. How we notify you of changes to this policy.
3. Data protection contact (DPO or designated mailbox): service@saler.ai (currently collected through the operations channel; a formal DPO is to be appointed).
4. Summary of security measures: encryption, keys stored only as hashes, least privilege.

Open items

• The DSAR entry point is set at service@saler.ai; the formal DPO and the status-page address remain to be completed.
• The opt-out self-service entry point (legal-checklist O3) will be built together with the tenant self-service surface.
• The Chinese text is the master; this English text is its full translation and is issued together with it.