Privacy Policy
Last updated 21 October 2026
This explains what Hephaestus collects, why, and who sees it. We handle personal data in line with the Nigeria Data Protection Act 2023.
What we collect
- Account details: your name, email address, optional business name, and a hashed password. We never store your password itself.
- Onboarding answers: what you're building and how you heard about us. We use these to understand which channels work and to shape the product.
- Billing records: your top-ups and, for each API request, the model, token counts, cost and time. We use these to charge you correctly and show you your usage.
- Technical data: your IP address and browser details in server logs and for abuse and rate-limit protection.
- Payments: handled by Flutterwave. We receive confirmation and a reference, never your card number.
What we do not collect
We do not store the content of your prompts or Claude's responses. They pass through our servers to Anthropic and back, and we keep only the billing record described above.
Who else sees it
- Anthropic receives your requests in order to answer them, and handles that content under its own policies. Don't send anything you aren't comfortable sharing with them.
- Flutterwave processes your payments.
- Resend delivers our emails (for example password resets).
- Our hosting provider stores our database and logs.
We don't sell your data.
Cookies
One essential cookie keeps you signed in. We don't use advertising or tracking cookies.
How long we keep it
We keep account and billing records while your account is open and for as long afterwards as the law requires us to keep financial records. Password reset links expire after one hour.
Your rights
You can ask to see, correct or delete your personal data, or object to how we use it, by emailing support@gethephaestus.com. You can also complain to the Nigeria Data Protection Commission.
Changes
If we change this policy we'll update the date above.