Privacy Policy
Effective date: October 8, 2026
pseudonymize.io is operated by Paolo Mazza (ma2za). Contact [email protected] for privacy questions and data requests, or [email protected] for security reports.
Account and operational data
We store account names, email addresses, profile information, password hashes or authentication-provider records, sessions, and verification records. Session records can include IP addresses and browser user agents. Organization memberships, invitations, API key names, SHA-256 key hashes, non-secret prefixes, and webhook configuration are also stored. Raw API key secrets are shown at creation and are not stored in the API key table.
Billing and usage records include account and organization identifiers, credit balances, payment event identifiers, endpoint names, request identifiers, idempotency keys, timestamps, and sanitized reservation error codes. Gateway metric logs include operational identifiers, status codes, credits, and latency. Do not put personal data or secrets in request identifiers, idempotency keys, API key names, or webhook URLs.
API payloads and retry responses
The gateway reads submitted text and JSON in application memory and forwards it to the configured Python engine. The gateway's billing database records do not include API request or response bodies, and its structured request metrics do not include those bodies.
When an Idempotency-Key is supplied, a successful response is cached in gateway process memory for a five-minute replay window. The cached response includes the engine's entity details, which can contain original identifiers. Expired entries cannot be replayed and are removed when accessed or by a cleanup sweep running every minute. Removing references does not guarantee immediate physical erasure of memory.
We do not promise zero retention across the entire processing chain. Engine logging, reverse proxies, operating-system swap, crash dumps, and infrastructure backups require separate operational controls. No verified end-to-end retention or backup deletion schedule is currently published. Do not rely on this service for a contractual zero-retention requirement without an agreed processing arrangement.
Service providers
The gateway and account database run on Hetzner Cloud in Nuremberg, Germany. Cloudflare provides the public edge and receives traffic passing through it, including API requests. The Python engine is a separate configured service; its current provider, processing region, and retention controls must be confirmed for any deployment-specific commitment.
Stripe processes payments; Resend delivers transactional emails, including verification, password resets, invitations, and configured registration notifications; Google provides optional sign-in. Payment, email, and sign-in providers receive data needed for those operations. Browser analytics collection through PostHog is disabled. This policy does not assert that all providers process exclusively in the EU or that particular transfer agreements have been verified.
Retention and deletion requests
Account and operational metadata remain stored while needed to operate the service. The current implementation has no general automatic expiry for usage, reservation, or payment event records.
Dashboard account deletion removes the user and related sessions, authentication records, API keys, usage records, memberships, invitations sent by that user, and webhook endpoints. Reservation and payment event records can remain, as can shared organization records, invitations addressed to the account's email, provider records, operational logs, and backups. Account deletion is not an immediate purge of every copy held by every provider.
Contact [email protected] to request access, correction, export, or deletion of personal data. Requests are assessed under applicable data protection law, including any retention obligations. For sensitive or regulated workloads, contact us to agree the processing scope, subprocessors, retention schedule, and a suitable DPA before use.