Privacy policy

What we collect from you, as a tenant

When you create an account we store your email address and hashed credential, and your tenant membership and role. Security-relevant actions are recorded in an internal, append-only audit log with who acted and when: creating or deleting a workspace, adding a member, signing in, issuing, rotating, disabling or revoking an API key (by its short prefix, never the key itself), changing a list's visibility or deleting it, publishing or rolling back a version, granting, approving, suspending or revoking a subscription, plan changes, and claiming or removing a custom domain.

What we collect about your end users

Autocomplete query and selection activity is recorded as aggregate signal — which canonical item was shown and which was picked — to improve future ranking. It is associated with a request id, not an end-user identity. AutoSugges does not build per-user profiles or store end-user PII. This aggregate signal is written to a separate schema that no API role can reach, and processed asynchronously, off the request path your users wait on.

Performance measurement

On our marketing and documentation pages we measure page performance — Core Web Vitals (largest contentful paint, layout shift, interaction responsiveness) and time to first byte — using the browser's own performance APIs. Each measurement is a metric value plus the page path, sent when you leave the page. It carries no identifier and is not linked to your account, session or IP address.

We also count visits to those pages by the kind of site that referred you (for example a search engine, an AI assistant, or none) and any utm_source tag in the link. We keep the page path and that category only — never the full referring address, your IP address or an identifier. We use Cloudflare Web Analytics, which sets no cookies, for aggregate page-view counts.

Bot and abuse protection

Cloudflare Turnstile runs at sign-up and key provisioning to distinguish humans from automated abuse. It never runs per keystroke on the autocomplete path.

Billing data

Payment details are handled by Stripe directly — we do not store card numbers. AutoSugges keeps its own record of your plan and entitlement, reconciled against Stripe's records rather than read live from them on every request.

Where data lives, and for how long — by data class

Retention differs by what the data is. This is what each class actually gets today, not a target we intend to reach later.

Authoring data (your workspace, lists, items)

Lives in our database, isolated to your tenant, for as long as your workspace exists. Deleting a workspace suspends it immediately — no key issued against it keeps serving — and opens a grace window before the row is physically removed, so a mistaken deletion has a recovery path.

Published versions (edge-served)

Cloudflare holds the active published version plus the five most recently superseded versions. A superseded version's copy is deleted 30 days after it is deactivated.

Raw autocomplete query and selection events

Stored separately from your list data, associated with a request id rather than an end-user identity, and processed asynchronously into the aggregates below. We do not yet publish a fixed deletion age for the raw event rows themselves — treat this as narrower than a commitment, and ask at the address below if the distinction matters to you.

Aggregated ranking signal

Item-level counts derived from the raw events above, favored for ranking over keeping raw events indefinitely. Retained for as long as the list they describe exists.

Billing records

Our own plan and entitlement state is reconciled against Stripe's records rather than read live from them on every request, and is kept for as long as your workspace exists plus whatever period applicable tax and accounting law requires afterward. Stripe holds the underlying payment records directly; we never store card numbers.

Operational logs

Structured request logs are written to Cloudflare's runtime log stream. No long-term log retention pipeline (e.g. Logpush) is configured today, so beyond Cloudflare's own real-time tooling we do not hold a separate durable copy.

Sub-processors

• Supabase — Database for account and tenant data, and authentication for sign-in.
• Cloudflare — Edge hosting and storage of published versions, and bot/abuse challenge (Turnstile) at sign-up and key provisioning.
• Stripe — Payment processing and subscription billing.
• Bird — Delivery of transactional email (e.g. account and billing notifications).

Contact

Questions about this policy, or a request about your data, go to support@autosugges.com.