DragonLair AI Privacy Notice

Information we receive

• Account and identity: email address, name or username, organization and project information, role, contact and verification status, and credentials or session information needed for sign-in. With Google sign-in, we request the openid, email, and profile scopes and receive a verified email, name if available, and Google account identifier. We do not request Gmail access for sign-in.
• API and inference: prompts, messages, files, tool inputs, outputs, and related content you submit; model and provider choices; request IDs, timing, token counts, errors, routing, usage, and cost records. Content can include personal information you or your users put in it.
• Credentials and settings: project API keys, optional bring-your-own-provider credentials, model configuration, budgets, and governance settings. Treat submitted credentials as secrets.
• Site and support: IP address, browser/device and request information, security events, and anything you send us in a support request. Payment or wallet information may be processed if those features are offered to your account; the public wallet offering is not generally available.

How we use information

We obtain information from you, your organization administrator, your use of the service, Google when you choose Google sign-in, and providers returning inference results. We use it to authenticate users, provision accounts, route inference requests, apply configured safety and governance controls, display usage and spend, provide support, protect the service, investigate abuse, and meet legal or accounting obligations. We may send operational or account-verification email. We do not need access to your Gmail mailbox to authenticate you with Google.

Where a legal basis is required, these activities may rely on providing the service you request, complying with law, our legitimate interests in security and operating the service, or consent where applicable. You can ask us about the basis for a particular use.

Model providers and other recipients

To complete an inference request, DragonLair AI sends the relevant request content and technical metadata to the selected model provider or to a provider configured through your own credential. The provider processes that data under its own terms and privacy practices, which may differ by model and account. Do not assume that every provider offers zero retention, a training opt-out, or a particular data region. We also share limited information with infrastructure, authentication, email-delivery, and payment service providers as needed to run features you use; with your organization administrators; and when required by law or to protect rights and security. We do not publish your prompts as public content.

Storage, retention, and security

Portal sessions use cookies; authentication and security features may also use short-lived state cookies. We keep account and operational records for as long as needed to operate the service, meet contractual or legal obligations, resolve disputes, and protect against abuse. Retention depends on the data class, your configuration, provider behavior, and any legal hold. We cannot promise universal zero-data-retention, immediate deletion of every copy, or a fixed region for every provider. See Security for currently described controls.

Processing may occur in countries other than yours when we or a selected provider operate there. Contact us if you need information about a particular provider or international transfer before sending content.

API credentials and provider secrets are sensitive. We use access controls and scoped credentials, but no system can guarantee absolute security. You should limit the personal or sensitive information you send to a model and use an appropriate provider and configuration for your needs.

Your choices and requests

You can manage account and project settings in the portal. Contact [email protected] to request access, correction, export, or deletion of personal information, or to ask about provider routing. We will verify your request and respond under applicable law. Some information may need to be retained for security, accounting, legal holds, or other lawful reasons; deletion of information already sent to a model provider is governed by that provider's process. Depending on where you live, you may have additional privacy rights and a right to appeal or contact a regulator. If your organization controls your account, we may direct you to its administrator.

Children, changes, and contact

DragonLair AI is a developer and business service, not directed to children. We may update this notice as the product or law changes; the effective date above will change when we do. Material changes will be communicated where required. Privacy questions and requests: [email protected].