NordAI

Legal

Privacy policy

What we collect, why, how long we keep it, and the settings that control it.

Last updated: 29 October 2026. NordAI processes account data and request metadata to operate the service. This policy describes the actual behaviour of the deployed system.

1. Data we collect

  • Account data: email address, display name, hashed password, role, account status, email verification time and optional TOTP secret.
  • Authentication data: session records (IP address, user agent, timestamps), API key prefixes and hashes, device credentials and login attempts used for throttling.
  • Usage metadata: per-request model id, request id, status, latency, token counts when reported by the upstream, and estimated upstream cost when pricing is configured.
  • Billing data: invoices, order ids, amounts, payment status and provider references.
  • CLI sessions: only when you are signed in and the CLI mirrors a session — its title, model, message transcript and tool names.

2. What we do not collect by default

Request bodies, prompts, file contents and command output are not stored by the API gateway and are not written to application logs. Logs contain request metadata (method, path, status, duration, request id). The CLI keeps workspace file changes on your machine.

3. How data is used

  • To authenticate you and authorize each request.
  • To count usage against your plan and enforce quotas and rate limits.
  • To activate and reconcile subscriptions and prevent payment fraud or replay.
  • To investigate abuse, secure the service and produce administrative audit records.
  • To answer support requests you open.

4. Sharing

Prompts are transmitted to the AI provider selected by the router in order to produce a response. Payment data is shared with the configured QRIS provider to create and settle invoices. We do not sell personal data.

5. Retention

  • Raw request events: 90 days, then deleted by the retention job.
  • Daily aggregate usage: retained for plan accounting and dashboards.
  • Audit logs: retained for security and compliance review.
  • Expired sessions, device codes and email tokens: cleaned up automatically.
  • CLI transcripts: kept until you delete the session or your account.

6. Your controls

  • Revoke API keys and device credentials at any time from the dashboard.
  • Sign out individual sessions or all other sessions.
  • Enable or disable two-factor authentication.
  • Request account deletion through support; deletion removes account-scoped rows, including sessions, keys, usage events and CLI transcripts.

7. Security

Passwords are hashed with bcrypt, API keys are stored only as hashes, session cookies are HttpOnly and Secure in production, mutating browser requests require a CSRF token, and administrative actions are audited. No system is perfectly secure; report suspected issues to support@nordai.my.id.

8. Contact

Privacy questions: support@nordai.my.id.