Privacy.

What we hold

• Account information: account ID, plan, optional label, creation date, sign-in identity link and a one-way hash of the verified email address. Our account database does not store your email address itself.
• API-key metadata: key ID, secret hash, scopes, label, creation, use and revocation times. Never the secret itself.
• Per-request admission records include an opaque request ID, account/key identifier, time, surface, operation, reserved credits, returned-row count and completion state. We also keep historical usage aggregates, without query contents.
• Billing metadata includes Stripe customer/subscription identifiers and billing events. We never receive a card number.
• Agreement evidence records account ID, document version/content hash, acceptance time and evidence source. It does not add an IP address or query contents.
• Application request logs contain request ID, method, route, status and duration, not bodies, query strings, keys, cookies or IP addresses. Restricted operational diagnostics can identify an account or provider identity when deletion needs operator follow-up.

Who processes it for us

Stripe handles payments, Checkout, subscriptions, invoices, receipts and the portal. It holds payment methods, billing addresses and optional business tax IDs, and calculates applicable tax under its own privacy policy.

WorkOS AuthKit handles sign-in, credentials, email verification and identity. We receive its user ID and your verified email at sign-in.

The API runs on Fly.io, the site on Vercel and the account database on Supabase PostgreSQL. Hosting providers may independently retain security/request metadata, including IP addresses.

Cookies

The site uses an encrypted sign-in session cookie and does not use advertising or analytics cookies. Vercel Web Analytics and Speed Insights are disabled for the project.

Closing your account and what we keep

At closure every API key is revoked, the local session ends, and WorkOS identity deletion is requested. The account's sign-in link and email-address hash are removed immediately. Provider failures are flagged for operator follow-up.

The reopening window is 30 days. Remaining live account/key labels become eligible for operator-controlled scrubbing after that window. Alex runs cleanup and provider-deletion retries weekly by hand, so eligible records are handled 30–37 days after closure. Contact support to confirm completion.

Usage, billing and agreement records remain personal data and are retained for seven years for accounting, tax, audit and agreement evidence. Stripe keeps its own records under its own policy. Legacy email-signup request rows expire after 30 days.

Access-restricted encrypted backups and operational audit archives may retain metadata after live-record deletion. Database backups expire within 30 days; the currently verified Supabase period is seven days. Encrypted operational exports expire after 30 days except that the latest is retained for recovery. A live scrub does not rewrite backups or exports.

The request-log retention policy is 30 days. Final hosting-provider retention configuration remains part of prelaunch review. Closure does not immediately erase every retained copy.

Your rights

Wherever you are, you can ask for access, correction, deletion, a machine-readable copy, or restriction/objection to processing based on our legitimate interests. Using these rights does not change your plan or service.

Write to hello@scientiabasis.com from your account email. We may ask you to sign in to verify your request and answer within 30 days. You can complain to your local data-protection authority.

Why we use your data

We process account, keys, allowance and billing information to perform our contract with you; keep usage and financial records for legal obligations; and use security/failure-diagnostic/fraud-prevention information for our legitimate interests.

Where your data is processed

Fly.io, Vercel, Supabase, WorkOS and Stripe process data in the United States. Transfers from jurisdictions that restrict them are subject to safeguards in the applicable provider data-processing terms, including standard contractual clauses where applicable.

Business customers

If you need a data-processing agreement for names or other information you send us to screen, write to hello@scientiabasis.com. We do not keep query contents.

Children

The service is not directed at children under 13. We do not knowingly collect their personal information; if we learn that we have, we delete it. Account holders must be at least 18 under the Terms of Use.

People named in our data

We compile public and licensed sources, including government sanctions lists and trade records, for business screening and supply-chain research. Some records name people. Our legitimate interests and those of our customers include sanctions compliance and research. Records carry source provenance and dates.

If a record names you, write to hello@scientiabasis.com to ask what we hold and where it came from, request correction of a discrepancy from the source, or object to processing. We answer within 30 days. Official-source corrections may need to be made at that source first; we identify the relevant source.

Contact

The controller is Scientia Basis LLC, 252 NW 29th St, 9th Floor, Miami, FL 33127. Write to hello@scientiabasis.com with your account ID. Do not send a password, API-key secret or card number.