Privacy Policy

1. Who We Are

Redacta is operated by Sandia Development Group, LLC, a New Mexico limited liability company (“Redacta,” “we,” “us,” “our”). Redacta is a PII (Personally Identifiable Information) scrubbing proxy that sits between your application and LLM providers (OpenAI, Anthropic, or Google Gemini). Our service detects and replaces sensitive data before it reaches any AI model, then restores it in the response. The Service is offered to customers in the United States only.

2. Information We Collect

2.1 Account Information

When you sign up via GitHub or Google OAuth, we receive your name, email address, and profile image from the OAuth provider. We do not receive or store your OAuth provider password.

2.2 Provider API Keys

When you create a Redacta proxy key, you provide your real LLM provider API key (OpenAI or Anthropic). This key is encrypted using AES-256-GCM and stored in encrypted form only. The plaintext key exists in server memory only during the brief moment it is used to forward your request to the provider. It is never logged, displayed, or transmitted to any third party other than the LLM provider it belongs to.

2.3 Request Content (API Proxy)

When you use the API proxy, the text content of your LLM requests passes through our servers. We scan this content for PII using automated regex pattern matching and NER (Named Entity Recognition) models. For each request we store:

• Token mappings— the link between a detected PII value and its replacement token (e.g., “John Smith” maps to “[PERSON_a7f3]”). Token mappings include the original PII values in AES-256-GCM encrypted form so that we can restore them in the provider's response. Token mappings are automatically purged on your configured retention schedule. The default retention window is 24 hours, and Business-plan customers may configure any window from 1 hour up to a maximum of 90 days. We do not store the non-PII portion of the request or response text.
• Scan metadata — timestamp, provider, model, number of PII entities detected, entity type counts (for example: {US_SSN: 2, EMAIL: 1}), input/output token counts, and latency. Scan metadata does not contain PII values and is retained for dashboard reporting.

If a request to the upstream provider fails after we have scrubbed the content, the corresponding token mappings remain in the database until the retention window elapses — they are not immediately deleted on upstream failure.

2.4 Document Uploads

When you use the document scanner, the uploaded file's bytes are parsed in memory on our servers, scanned for PII, and the results are returned to you. The uploaded file itself is not persisted to disk. However, we do store a record of the scan, which includes:

• The filename you uploaded
• The file type and file size
• The number of PII entities detected
• Entity type counts (no PII values)
• Scan duration

Because filenames can themselves contain personal data (for example, “patient_records_Jane_Doe.pdf”), you should rename files before upload if you do not want the name stored.

2.5 Billing Information

Payment processing is handled entirely by Stripe, Inc. We do not receive, process, or store your credit card number, bank account details, or other payment credentials. We receive only your Stripe customer ID and subscription status.

2.6 Usage Data

We collect aggregated usage metrics: number of scans, number of redactions, entity type breakdowns, and latency measurements. This data is used to display your dashboard, enforce plan limits, and generate aggregated reports.

2.7 Audit Logs

We maintain an audit log of administrative and billing events associated with your account — for example, API key creation and revocation, plan changes, retention-window changes, and billing cycle resets. Each audit log entry stores the event type, the affected resource, structured metadata describing the event, the IP address from which the event originated, and a timestamp. Audit log entries are retained for thirteen (13) months and then automatically purged. Business-plan customers may list their own audit log entries through the dashboard.

2.8 False-Positive Reports

When you click the “Not PII” (false-positive) button on a detection in the document scanner, you affirmatively send the following data to Redacta and authorize us to store and use it:

• The flagged text, truncated to 200 characters
• The entity type our detector assigned to the flagged text
• The label you are asserting (for example, “NOT_PII”)
• Up to 500 characters of surrounding context from the document, so we can understand how the term was used

We use false-positive reports to (a) update our public blocklist once a term has been reported enough times and (b) fine-tune our proprietary PII detection models. False-positive reports are retained for up to 365 days and then automatically purged. We do not share false-positive report data with OpenAI, Anthropic, or any other third party, and we do not use it to train any LLM belonging to an LLM provider.

Do not submit text containing real personal data through the Report button. The purpose of the feature is to correct over-detection of non-PII terms; if the flagged value or surrounding context actually is sensitive, do not submit it.

You may turn off false-positive reporting for your account at any time from the Settings page. When reporting is turned off, clicks on the “Not PII” button do not transmit or store any data on our servers.

3. How We Use Your Information

• To provide the PII scrubbing proxy and document scanner
• To authenticate you and manage your account
• To process billing and enforce plan and rate limits
• To display usage statistics and reports on your dashboard
• To update our public blocklist and fine-tune our proprietary PII detection models, using false-positive reports you submit under Section 2.8
• To investigate abuse, enforce our Terms of Service, and comply with legal obligations
• To respond to support requests

Apart from false-positive reports you voluntarily submit, we do not use the content of your API requests, responses, or uploaded documents to train any machine learning model.

4. How We Protect Your Information

• Provider API keys are encrypted with AES-256-GCM using a server-side key that is never committed to source code
• Token mappings (PII values) are encrypted at rest with AES-256-GCM and automatically purged on your configured retention schedule (default 24 hours, maximum 90 days)
• All data in transit is encrypted via TLS (HTTPS)
• Database access is restricted to the application server only (no public endpoint)
• Security headers are enforced: HSTS, X-Frame-Options DENY, X-Content-Type-Options nosniff
• The PII detection service (Microsoft Presidio) runs on our own infrastructure — your data is never sent to a third-party AI service for PII detection
• We will notify affected customers of a confirmed security incident affecting their Customer Content without undue delay, and in any event within 72 hours of our confirmation, in accordance with the Terms of Service

No security program eliminates all risk. You should use API keys with the minimum permissions necessary and rotate them promptly if you suspect compromise.

5. Data Sharing and Sub-processors

We do not sell or share your personal information, as those terms are defined under the California Consumer Privacy Act (Cal. Civ. Code § 1798.140). We do not rent your personal information to anyone, and we do not use it for cross-context behavioral advertising.

We do engage the following service providers (“sub-processors”) to operate the Service. Each receives only the data necessary for its specific purpose:

• OpenAI, Inc. — When you route a request through the proxy to an OpenAI model, the scrubbed request content (with PII values replaced by placeholder tokens) is forwarded to OpenAI using your provider API key. OpenAI sees placeholder tokens in place of detected PII; it also receives the non-PII portions of your request content, including system prompts, tool definitions, and tool-call arguments, unchanged.
• Anthropic, PBC — Same as above, for requests routed to Anthropic models.
• Google LLC (Gemini API) — When you route a request through the proxy to a Google Gemini model, the scrubbed request content (with PII values replaced by placeholder tokens) is forwarded to Google's Generative Language API using your Gemini API key. Google sees placeholder tokens in place of detected PII; it also receives the non-PII portions of your request content, including system instructions and tool definitions, unchanged. This is a separate data-processor role from Google's role as an OAuth identity provider described below.
• Stripe, Inc. — For payment processing. Stripe receives your email, Stripe customer ID, and subscription details.
• Amazon Web Services, Inc. — For hosting our application, database, and infrastructure in the US-East region. AWS is a passive infrastructure provider and does not access the contents of your data.
• GitHub, Inc. and Google LLC — As OAuth identity providers for sign-in. They receive only the authentication handshake; they do not receive your request content. (Google LLC also appears above as a separate data processor for Gemini API requests.)

We may disclose information if required by a subpoena, court order, or other legal process, or when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

For business customers requiring a written data processing agreement, see our Data Processing Addendum, which is incorporated by reference into the Terms of Service for any customer who Processes personal data of individuals through the Service.

6. Data Retention

• Account data — retained while your account is active; deleted within 30 days of a verified account deletion request.
• Token mappings — encrypted at rest, purged on your configured schedule: 24-hour default, or any value from 1 hour up to 90 days on the Business plan.
• Scan metadata — retained for dashboard and reporting purposes. Contains no PII values.
• Document scan records — the scan metadata and filename are retained for dashboard display. The uploaded file bytes are not persisted.
• Audit logs — retained for 13 months, then automatically purged.
• False-positive reports — retained for up to 365 days, then automatically purged.

7. Your Rights

You have the right to:

• Access your personal data stored in your account
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Export your scan metadata via the Reports CSV export feature
• Revoke API keys at any time via the dashboard
• Turn off false-positive reporting for your account at any time from the Settings page

To exercise these rights, contact us at privacy@getredacta.com. We will respond within 30 days of a verified request.

8. California Privacy Rights

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”), grants you specific rights regarding the personal information we collect:

• Right to know — the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties to whom it is disclosed. The categories we collect are: identifiers (name, email, OAuth profile), commercial information (subscription and billing data), internet or network activity (IP addresses in audit logs, usage metrics), and the content of false-positive reports you voluntarily submit.
• Right to delete — the personal information we have collected from you, subject to legal exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing — we do not sell or share personal information as those terms are defined in the CCPA, so there is nothing to opt out of, but you have the right to request confirmation.
• Right to limit the use of sensitive personal information — we do not use sensitive personal information for any purpose beyond providing the Service.
• Right to non-discrimination — we will not discriminate against you for exercising any of these rights.

To exercise a California privacy right, email privacy@getredacta.com. We will verify your request by matching the email address on file for your account.

9. Cookies

We use a single session cookie for authentication (a NextAuth JWT session cookie). We do not use tracking cookies, advertising cookies, or third-party analytics services.

9a. Browser Extension Data Practices

Redacta publishes a browser extension for Chrome, Edge, Firefox, and Safari that scrubs personal information in messages and file uploads on the four supported AI chat sites (claude.ai, chatgpt.com, chat.openai.com, and gemini.google.com). This section applies to the extension specifically.

Default behavior: With usage reporting turned off (the default), the extension collects nothing. Detection runs locally in your browser using regular-expression matching. The text of your messages, the contents of the files you upload, and the original PII values never leave your browser.

If you opt into usage reporting: When you toggle “Report to my account” on in the extension popup, the extension sends an anonymized aggregate to https://api.getredacta.com/api/extension/redactions after each redaction event. The aggregate contains: the provider host (e.g. “claude.ai”), a count of redactions performed, and entity-type counts (for example, { EMAIL: 2, US_SSN: 1 }). The extension never transmits message text, file contents, redacted values, or original PII values to any server.

No third parties: Data received via the reporting endpoint is used only to populate your own Redacta dashboard and to enforce the redaction limit on your plan. It is not shared with any third party, and is not used to train any machine-learning model.

Permissions and why they exist: The extension requests storage (to save your preferences in local browser storage), activeTab (to display the correct provider in the popup), and host access to the four listed chat sites plus api.getredacta.com. No other hosts are accessed.

You can turn off the extension at any time from the popup, disable reporting separately, or uninstall it from your browser's extension manager. No server-side record of the extension ever existed if you never opted into reporting.

10. Children's Privacy

Redacta is not intended for use by individuals under the age of 18, consistent with Section 3 of our Terms of Service. We do not knowingly collect personal information from children under 13 as defined by the Children's Online Privacy Protection Act (COPPA). If we learn that we have inadvertently collected personal information from a child under 13, we will delete it.

11. Changes to This Policy

We may update this privacy policy from time to time. For material changes, we will notify registered users by email at least 30 days before the change takes effect. The “Last updated” date at the top of this page indicates the most recent revision.

12. Contact Us

For questions about this privacy policy or our data practices, contact us at privacy@getredacta.com.

Sandia Development Group, LLC
New Mexico, United States