Privacy Policy
This policy explains what Provenance Research ("Stitch", "we") collects when you use the Stitch API and its console, and what we do with it.
What we collect
- Account details: the email addresses of account members, the company name, and when each member was added and signed in.
- Usage metadata, for every call: time, API key ID, model, token counts, cost, status and latency. We use it for billing, your usage dashboard, travel points and operating the service.
- Request and response content, only for recording keys: a copy of each request and response, after automated removal of secrets, email addresses and similar personal details. On zero-data-retention keys we store no content at all.
- Payment records: purchases, refunds and disputes. Card details are handled by Stripe; we never see or store them.
- Trip details, when the account owner books travel with points: destination, dates, travellers' full names and dates of birth (airlines need them to issue tickets), and an optional phone number and notes. We don't store passport details; if a booking needs them, we ask for them at booking time and pass them straight to the airline.
- Security data: a one-way hash of the network address used to sign up or request sign-in links, kept briefly to limit abuse. We don't store raw IP addresses.
How we use it
- To run, bill for, secure and support the service, and to email account members sign-in links, invitations and service notices (such as low credit).
- Recorded content (recording keys only): to build and improve datasets and models, which we may license to third parties in redacted form.
- We don't sell account details or usage metadata, and we don't use ZDR traffic for anything beyond the call itself.
Who we share it with
- The model provider that serves each call receives that call's request.
- Service providers that run Stitch for us: Amazon Web Services (hosting, storage, email) and Stripe (payments).
- Airlines, hotels and booking services, when we book a trip: the travellers' names, dates of birth and the trip details they need.
- Licensees of datasets built from recorded, redacted content.
- Authorities, where the law requires it.
How long we keep it
Account details and billing records: while the account is open, and afterwards as long as tax and accounting rules require. Trip details: while the account is open, so bookings can be changed or checked. Sign-in links: 15 minutes (invitations: 7 days). Sessions: 30 days. Usage metadata: while the account is open. Recorded content: until it's no longer needed for the purposes above, or until you ask us to delete it.
Your choices and rights
You can use zero-data-retention keys only. You can ask us for a copy of your personal data, to correct it, or to delete it (including recorded content from your keys), by writing to connor@provenanceresearch.ai. Depending on where you live, you may have further rights under local law.
Security
Data is encrypted in transit and at rest. API keys and sign-in tokens are stored only as one-way hashes. Access to recorded content is restricted to the systems and people that need it.
Questions: connor@provenanceresearch.ai