Privacy Policy

1. Who processes your data

Individual Entrepreneur Mikita Valkunovich (identification number 300412284, registered in Georgia; see the Terms of Service for full registration detail) operates CompresLM and acts as the data controller for the account data described below.

2. What we collect

• Account data: your email address, an argon2 password hash (never the plain password), and account creation/verification timestamps.
• API token data: a hash and short prefix of each CompresLM token you generate — never the full token after the one time it's shown to you.
• Usage metering: per-request token counts, estimated cost before/after compression, model name, and timestamp — used to run the free tier and billing. This is numeric metering only.
• Session cookie: a signed, httponly, secure cookie that identifies your logged-in session. No analytics or advertising cookies are set.

3. What we deliberately do not store

• Your upstream provider API key (OpenAI/Anthropic/local): read from the X-LLM-API-Key header, held in memory only for the duration of that single request, then discarded. It is never written to a database, file, or log.
• Prompt and completion content: the text you send and receive is processed transiently to apply compression and is forwarded to your chosen upstream provider; we do not retain it as a product dataset, and it is not used to train any model.

Short-lived operational logs (e.g. error traces from our hosting provider) may exist for a limited period for debugging and abuse prevention. They are not mined for content, not sold, and not shared with third parties beyond what section 5 describes.

4. Legal basis and use

We process account and metering data to provide the service you signed up for (contract performance), to enforce the free tier and calculate fees (contract performance / legitimate interest), and to secure the service against abuse (legitimate interest). We do not sell personal data.

5. Who else sees data

• MailerSend (mailersend.com) — sends your email-verification code. Receives your email address for that purpose only.
• Your chosen upstream LLM provider (OpenAI, Anthropic, or your own self-hosted endpoint) — receives the (compressed) request content directly, using the key you supplied, exactly as if you had called them yourself. Their own privacy policy governs what happens on their side.
• Our hosting/database provider (Railway) — stores account and metering data on our behalf, under its own infrastructure-level security controls.
• A payment processor (e.g. Stripe or equivalent) — once card billing is enabled, to process payment beyond the free tier. We do not store card numbers ourselves.

6. Retention

Account data is kept while your account is active. Usage-metering records are kept as long as needed for billing, accounting, and tax records (which may exceed account lifetime under applicable law). You can request deletion of your account and associated personal data at any time (see section 8); metering rows required for completed billing periods may be retained in anonymized/aggregated form.

7. Security

• Passwords hashed with argon2, never stored or logged in plain text.
• Session cookies are signed, httponly, and secure.
• All traffic to the service runs over TLS.
• Provider API keys travel per-request and are never persisted (section 3).

8. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, or to object to or restrict certain processing. To exercise any of these, contact us (below); we will respond within a reasonable time and may need to verify your identity first.

9. Children

CompresLM is not directed at, and should not be used by, anyone under 18.

10. Changes

We may update this Policy. Material changes will be reflected here with a new date; continued use after an update takes effect constitutes acceptance.

11. Contact

Privacy questions or data requests: use the contact form.