What happens to your prompts, files and outputs when you use Ablit. This page is the plain-language version; the Privacy Policy is the legal one, and the Trust page lists the controls and sub-processors behind it.
The short version
- Your conversations are stored for you, so you can come back to them, continue them and share them if you choose. Ablit is a workspace, not a stateless API: history is a feature, and you delete it whenever you want.
- Your content is never used to train models. Not ours, not our providers'. We contractually prohibit training on content we send to providers wherever the provider offers that choice, and we choose providers accordingly.
- Model providers see what a request needs: the prompt, the relevant context and attached files, for the time it takes to answer. They do not get your account details.
- Our own infrastructure is in Germany (Frankfurt and Falkenstein). Model providers are mostly in the United States.
- Delete means delete. Deleting a conversation removes it from the live database immediately; backups are rotated out within 7 days.
What we store, and for how long
| Data | Stored? | Where | Kept until |
|---|---|---|---|
| Messages, replies, attachments, generated media, tool output | Yes | Database and file storage in Germany | You delete the conversation or close your account |
| Projects, saved prompts, scheduled tasks, installed skills, MCP connections | Yes | Database in Germany | You delete them or close your account |
| Run records: status, timing, model, tokens, cost | Yes | Database in Germany | Your account is closed |
| Execution traces of tool calls (secrets redacted) | Yes, for debugging | Database in Germany | Your account is closed, or on request |
| Security-tool workspace files | Yes | Isolated container storage in Germany | The conversation is deleted |
| Account, plan, credits, invoices | Yes | Database in Germany; Stripe | Account closure; invoices for the legal retention period |
| Card numbers | No | Stripe only | Managed by Stripe |
| API key secrets | No, only a hash | Database in Germany | You revoke the key |
| Passwords | No, only a salted hash | Database in Germany | You change them or close your account |
| Analytics events | Yes, pseudonymous | PostHog, EU cloud | 12 months |
| Error reports | Yes, technical context only | Bugsink on our servers in Germany | 30 days |
What leaves our systems, and to whom
| Step | Who receives data | What they receive |
|---|---|---|
| A model answers | The inference provider behind the model you picked | The prompt, the conversation context the model needs and attached files; not your identity |
| Image, video, audio or voice generation | The media provider behind that feature | The prompt and any reference media |
| Web search | Brave Search or Serper | The search query |
| Web browsing and fetching | The websites the agent visits | Whatever a normal visitor sends: the request, and anything the agent types or uploads on your instruction |
| Resend | Your email address and the message | |
| Payment | Stripe | Billing details and the amount |
| Sign-in with Google | Your Google account identity | |
| Analytics | PostHog (EU) | Pseudonymous usage events |
Provider retention is theirs, not ours. Most model providers either keep nothing after the response or keep abuse-monitoring logs for a limited period under their own policies; business customers can obtain the per-model provider list under NDA.
Model training
We do not train models on your content, and we do not let anyone else. New execution traces are excluded from any training use by default, and nothing is exported for training without a separate, explicit review that has never been run on customer data. If that ever changes, this page, the Privacy Policy and your account will say so first, and it will be opt-in.
Cloud runs, ABLIT CODE and the API
- Cloud runs continue on our workers after you close the tab, so their conversations and traces are stored the same way as chat.
- ABLIT CODE runs on your machine. Your repository stays there; what reaches Ablit is what the agent sends to the model: your instructions, the parts of files it reads, tool results and command output. The CLI stores its own sessions and your API key locally, under your user account.
- The API (
ide.ablit.app) records each request like a chat run. Requests are tied to the API key that made them, so you can see them in your account.
Security tools and browsing
The security (Kali) workspace and the browser run in isolated containers per conversation. Network rules block our internal systems and cloud metadata addresses. Commands, targets and results are stored with the conversation; so is anything the agent downloads. You are responsible for pointing these tools only at systems you are authorised to test.
Sharing and exports
A share link makes that one conversation readable by anyone who has the link, without an account, until you turn the link off. Files the agent produces can be downloaded from the conversation at any time. For a copy of your account data, write to help@ablit.app.
Deleting
- A conversation, project, prompt, task, key or share link: in the product, immediately.
- Everything: write to help@ablit.app from your account email. We close the account and delete or anonymise your data within 30 days, except billing records we must keep by law. Backups are rotated out within 7 days of the live deletion.
Questions
help@ablit.app. For security issues, security@ablit.app.
Back to homepage