# Privacy Policy

Last updated: 2 November 2026

This policy explains what personal data Ablit ("Ablit", "we", "us") collects when you use ablit.app, the Ablit apps, ABLIT CODE and the Ablit API (together, "the Service"), why we collect it, who receives it, how long we keep it and the rights you have.

**Who is responsible.** The Service is operated by Ablit. For anything in this policy, write to [help@ablit.app](mailto:help@ablit.app). Security reports go to [security@ablit.app](mailto:security@ablit.app). We answer requests about your data within one month.

## 1. Data we collect

**Account data.** Your email address; your name and profile image if you sign in with Google; a salted hash of your password if you use one (we never store the password itself); one-time sign-in codes while they are valid; your plan, credit balance, role, language and the dates you registered and were last active.

**Content you give us.** Messages you type, files and images you upload, voice recordings you send for transcription, saved prompts, projects, scheduled tasks, share links you create, and the output the Service produces for you: replies, generated images, video and audio, documents, code and tool results. Conversations are stored so you can return to them.

**Content produced by tools.** When you use tools such as web browsing, code execution, cloud runs or the security (Kali) workspace, the commands, targets, results and files involved are stored with the conversation so you can see and resume your work.

**Technical records of runs.** For each chat, cloud run or API request we record status, timing, the model used, token counts and cost, and, for debugging, an execution trace of tool calls and their results. Known secrets and credentials are redacted from traces before they are stored. Traces are never used to train models.

**Billing data.** Your plan, purchases, credit top-ups, auto top-up settings, invoices and discount codes. Card details go directly to Stripe; we never see or store your full card number, only the card brand, last four digits and expiry that Stripe returns to us.

**API keys, CLI and IDE use.** The name, permissions, prefix and last-use time of API keys you create. The key itself is stored only as a hash. Requests made with a key are recorded like any other run.

**Usage and device data.** Pages you view, actions you take in the product, your IP address and the approximate location derived from it, browser and device type, and error reports with the technical context of the error.

**Email and support.** Messages you send us and records of emails we send you, including delivery, open and unsubscribe status.

**Affiliate data.** If you join the affiliate programme: your codes, referrals, earnings, payout history and the wallet or account you give us for payouts.

**Safety records.** Where a request is blocked by our child-safety policy, we keep a record of the incident for enforcement and, where the law requires, reporting.

## 2. Why we use your data and the legal basis

| Purpose | Data | Legal basis (GDPR) |
| --- | --- | --- |
| Run the Service: answer your requests, run tools, store your history, bill you | Account, content, run records, billing | Performance of a contract |
| Keep the Service secure, prevent abuse and fraud, enforce our Terms and the child-safety policy | Account, run records, IP address, usage, safety records | Legitimate interests (a safe, lawful service) and legal obligation |
| Find and fix bugs, keep the Service reliable | Error reports, server logs, execution traces | Legitimate interests |
| Understand and improve the product | Analytics events | Consent where the law requires it; otherwise legitimate interests |
| Measure advertising (Google Ads, Meta) | Sign-up and purchase events, advertising identifiers | Consent |
| Send service emails: receipts, security notices, changes to the Service | Email, account | Contract and legitimate interests |
| Send product news, offers and win-back emails | Email | Consent, or where allowed legitimate interests; every message has an unsubscribe link |
| Run the affiliate programme and pay affiliates | Affiliate data | Contract |
| Meet legal duties: tax, accounting, lawful requests from authorities | Billing, account | Legal obligation |

We do not sell your personal data. We do not use your prompts, files, conversations or outputs to train our own or anyone else's AI models.

## 3. Who receives your data

We use service providers that process data for us under written contracts (sub-processors). The current list, with locations, is kept on our [Trust page](/trust#subprocessors). In summary:

- **Hosting and storage.** Vercel (the web app and API edge, deployed in Frankfurt, Germany, with a global content delivery network; file storage), Hetzner Online (our own servers in Falkenstein, Germany, which run the database, background workers, the IDE gateway, the isolated security-tool environments and monitoring).
- **Payments.** Stripe processes card payments, subscriptions and invoices.
- **Email.** Resend delivers the emails we send.
- **Sign-in.** Google, if you choose to sign in with Google.
- **Analytics and errors.** PostHog (EU cloud) for product analytics; error reports go to a Bugsink instance we host on our own servers.
- **AI model and media providers.** To answer a request we send the prompt, the relevant conversation context and any files you attached to the model or media provider that produces the reply. Which provider depends on the model you choose. Each has its own terms and retention rules; most of them are in the United States, and none of them receives your account details. Business customers can obtain the provider list under NDA.
- **Web search.** When the agent searches the web, the query goes to Brave Search or Serper.
- **Advertising measurement.** Google Ads and Meta receive conversion events only where you have consented to marketing cookies.

We may also disclose data to professional advisers, to authorities when the law requires it, to parties involved in enforcing our child-safety policy where the law requires reporting, and to a buyer or successor if the business is sold, with notice to you where the law requires it.

If you create a share link, anyone with the link can read that conversation until you turn the link off.

## 4. How long we keep data

- **Conversations, projects, files and other content:** until you delete them or close your account. Deleting a conversation removes it from the live database at once; backup copies are rotated out within 7 days.
- **Run records and execution traces:** while your account is active, and deleted with it. You can ask us to delete the traces of specific runs sooner.
- **Account data:** until you close your account. Write to help@ablit.app to close it; we delete or anonymise your data within 30 days, except what we must keep by law.
- **Billing records and invoices:** for the period required by tax and accounting law, up to 10 years.
- **Analytics:** 12 months.
- **Error reports and server logs:** 30 days.
- **Email delivery records:** 12 months; unsubscribe records for as long as needed to honour them.
- **Security-tool workspaces:** until the conversation is deleted.
- **Safety records:** as long as needed for enforcement and any legal reporting duty.

## 5. International transfers

Our own infrastructure is in Germany. Some providers, in particular the AI model providers, Stripe, Google and Meta, process data in the United States and elsewhere. Where personal data leaves the EU/EEA we rely on an adequacy decision (for example the EU-US Data Privacy Framework for certified providers) or on the European Commission's Standard Contractual Clauses, with additional safeguards where needed. You can ask us for a copy of the safeguards at help@ablit.app.

## 6. Cookies, analytics and similar technologies

- **Necessary:** the sign-in session, security tokens, your language and a remembered consent choice. The Service does not work without them.
- **Analytics (PostHog):** an identifier stored in your browser, the pages you view and the actions you take. Signed-in events are linked to your account ID and plan. Message text and tool output are never recorded, and the Service respects browser Do Not Track for analytics.
- **Advertising (Google Ads, Meta):** conversion tags that fire on sign-up and purchase, only after you accept marketing cookies.

Where the law requires it, we ask before any optional cookie is set, and you can change your choice at any time from the consent control in the product.

## 7. Security

Everything travels over TLS. Passwords are stored as salted scrypt hashes and API keys only as hashes. Agent tools run in isolated containers with network rules that block our internal systems and cloud metadata addresses. Secrets are redacted from stored traces. The database is backed up nightly and the backups are rotated. Infrastructure access is limited to named administrators over key-based SSH from allow-listed addresses. Details, and what we do not yet have, are on the [Trust page](/trust). No system is perfectly secure; if a breach affects your data we will notify you and the competent authority as the law requires.

## 8. Your rights

Depending on where you live, you can ask us to access, correct or delete your data, restrict or object to some processing, receive a portable copy, and withdraw consent at any time without affecting earlier processing. You can delete conversations, projects, files, API keys and share links in the product. For anything else, including closing your account, write to help@ablit.app. You also have the right to complain to your data protection authority. Residents of California and other US states have equivalent rights; we do not sell or share personal information for cross-context behavioural advertising.

## 9. Children

The Service is for adults. You must be at least 18 to use it. We do not knowingly collect data from anyone under 18; if we learn that we have, we delete it.

## 10. Automated processing

AI models generate replies and run tools at your request. We do not make decisions with legal or similarly significant effects about you based solely on automated processing. Limits, pauses or bans for abuse may be triggered by automated signals and are reviewed by a person when you ask at help@ablit.app.

## 11. Changes

We post changes here with a new date. For material changes we tell you by email or in the product before they take effect.

## 12. Contact

Ablit, operator of ablit.app. Email: [help@ablit.app](mailto:help@ablit.app). Security: [security@ablit.app](mailto:security@ablit.app).