Privacy Policy

1. Introduction

T34 Corporation FZCO ("PullWeights," "we," "us") operates the PullWeights AI model registry. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our website, API, and CLI tools (collectively, the "Service"). By using the Service, you agree to the practices described in this policy.

2. Information We Collect

Account Information

When you create an account, we collect your username, email address, and password (hashed using Argon2id — we never store plaintext passwords). If you sign up via Google or GitHub, we receive your name, email, and profile picture from the OAuth provider.

Model Metadata

We store metadata about models you upload, including model names, tags, version history, file names, file sizes, and SHA-256 checksums. Model file contents are stored on the distributed storage network, not on PullWeights servers.

Usage Data

We collect information about how you use the Service, including API calls, downloads, uploads, bandwidth consumption, and feature usage. This data is used for quota enforcement, billing, and service improvement.

Billing Information

Payment processing is handled by Stripe. We do not store your full credit card number. We receive and store your Stripe customer ID, subscription status, plan type, and billing cycle dates. Stripe's privacy policy governs their handling of your payment data.

Device & Browser Information

We collect IP addresses, browser type, operating system, and device information from HTTP headers for security purposes (rate limiting, abuse prevention, audit logging). CLI usage sends the CLI version and operating system.

3. How We Use Your Information

• Service Provision: To operate the registry, authenticate you, enforce quotas, and deliver your models.
• Billing: To process payments, manage subscriptions, and generate invoices.
• Communication: To send transactional emails (verification, password reset, billing receipts) and service announcements.
• Analytics: To understand usage patterns, improve the Service, and develop new features. We use aggregated and anonymized data where possible.
• Abuse Prevention: To detect and prevent fraud, abuse, and security threats through rate limiting, IP analysis, and API key audit logging.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.

4. Third-Party Services

We share information with the following categories of third parties:

• Stripe: Payment processing. Stripe receives your billing information as necessary to process payments. See Stripe's Privacy Policy.
• Distributed Storage Network: Model files are stored on a third-party distributed storage infrastructure. File contents are transmitted to and stored by this network. We do not control the storage nodes.
• Email Provider: Transactional emails are sent through a third-party email service provider that receives recipient email addresses.

We do not sell your personal information to third parties. We do not share your data with advertisers.

5. Data Retention

• Account Data: Retained for the lifetime of your account plus thirty (30) days after deletion to allow for account recovery.
• Model Data: Retained until you delete models or your account. After account deletion, model data is removed from the distributed storage network within thirty (30) days.
• Usage Logs: Retained for ninety (90) days for operational and security purposes, then aggregated or deleted.
• Billing Records: Retained for seven (7) years as required by tax and financial regulations.
• API Key Audit Logs: Retained for ninety (90) days.

6. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate personal information.
• Deletion: Request deletion of your account and associated data.
• Portability: Export your data through our API or CLI tools.
• Objection: Object to certain processing activities.
• Restriction: Request restriction of processing in certain circumstances.

To exercise these rights, contact us at [email protected]. We will respond within thirty (30) days.

7. GDPR (European Users)

If you are located in the European Economic Area (EEA) or the United Kingdom, the following applies:

• Legal Bases: We process your data based on contract performance (providing the Service), legitimate interests (security, analytics), consent (where required), and legal obligations (tax records).
• International Transfers: Your data may be transferred to and processed in the United Arab Emirates or other jurisdictions. We use Standard Contractual Clauses (SCCs) approved by the European Commission to safeguard such transfers where required.
• Supervisory Authority: You have the right to lodge a complaint with your local data protection authority.
• Data Protection Officer: For GDPR inquiries, contact [email protected].

8. CCPA (California Residents)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, and disclose.
• Request deletion of your personal information.
• Opt out of the sale of personal information — we do not sell personal information.
• Non-discrimination for exercising your privacy rights.

To exercise your CCPA rights, contact us at [email protected].

9. Security

We implement industry-standard security measures to protect your information:

• Passwords are hashed using Argon2id with per-user salts.
• All data in transit is encrypted via TLS.
• API keys are hashed with SHA-256; only the prefix is stored for identification.
• Rate limiting is applied to authentication endpoints and API access.
• JWT tokens are used for session management with configurable expiry.
• OAuth state parameters are validated to prevent CSRF attacks.

No system is perfectly secure. While we strive to protect your information, we cannot guarantee absolute security. You are responsible for maintaining the security of your account credentials and API keys.

10. Children

The Service is not intended for individuals under eighteen (18) years of age. We do not knowingly collect personal information from children. If we learn that we have collected information from a child under 18, we will delete it promptly. If you believe a child has provided us with personal information, please contact us at [email protected].

11. Cookies & Tracking

PullWeights uses essential cookies for authentication (JWT session tokens stored in local storage) and CSRF protection. We do not use third-party tracking cookies, advertising cookies, or analytics cookies. No cookie consent banner is required because we only use strictly necessary cookies.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated with at least thirty (30) days' notice via email or prominent notice on the Service. Continued use of the Service after changes take effect constitutes acceptance of the revised policy. We encourage you to review this policy periodically.

13. Contact

For questions or concerns about this Privacy Policy or our data practices, contact us at: