Privacy Policy

• Account data: your email address and authentication details (via Supabase Auth).
• Content: the questions you submit and the council transcripts and answers generated for you, which we store so you can revisit sessions.
• API keys (optional, BYOK): if you add provider keys, they are encrypted at rest (AES-256-GCM) and used only to run your sessions.
• Usage data: plan, session counts, token usage, and estimated cost, used for limits, billing, and product analytics.
• Technical data: IP address and request metadata, used for security, rate limiting, and abuse prevention.

• To provide the Service — run councils, save your history, manage your account.
• To enforce usage limits and prevent abuse (e.g. per-IP caps, disposable-email checks).
• To process payments and manage subscriptions.
• To improve the Service and provide support.
• To comply with legal obligations.

We do not sell your personal data.

To generate answers, the questions and context you submit are sent to third-party LLM providers — OpenAI, Anthropic, and Google — either via our managed keys or your own (BYOK). Their handling of that data is governed by their respective privacy policies and API terms. Please avoid submitting sensitive personal data you would not want processed by these providers.

• Supabase — authentication and database (your account, sessions, keys).
• Vercel — application hosting and edge network.
• Resend — transactional email (e.g. confirmation emails).
• Stripe — payment processing (we do not store your full card details).
• OpenAI, Anthropic, Google — AI model inference.

We retain your account and session data while your account is active. You can delete individual sessions, your API keys, or your entire account at any time. When you delete your account, we remove your personal data within a reasonable period, except where we must retain it for legal, accounting, or security reasons.

We use encryption in transit (HTTPS) and at rest for sensitive secrets, row-level security to isolate each user's data, and rate limiting to deter abuse. No system is perfectly secure, but we take reasonable measures to protect your information.

Depending on your location, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these rights, contact us at support@debatedeskai.com. You can also manage much of your data directly in your dashboard.

The Service is not directed to children under 18, and we do not knowingly collect their data.

We may update this policy; material changes will be posted here with a new "Last updated" date. Questions or requests? Contact support@debatedeskai.com.