This policy explains what TKOResearch LLC (“Scrip”) collects when you use the service, what we deliberately do not collect, and the only circumstances under which we disclose anything. We wrote it to be read, not to cover us — the “private” in the product is a claim we intend to be able to prove.
What we collect
The minimum needed to run a billing ledger:
- Account email — for sign-in and receipts.
- Payment references — a Stripe customer/session id, or a crypto transaction hash. Card details are held by Stripe; we never see or store them.
- Per-request accounting — timestamp, model, token counts, upstream cost, amount charged, and which key was used.
What we do not collect
- The content of your requests or the model’s responses. Prompts and completions pass through in memory and are never written to any store, log, or analytics event.
- Your identity forwarded to the model vendor. We authenticate to the upstream provider with our own key; your account is not attached to the upstream request.
- Profiles, device fingerprints, or data sold to anyone. Customer data is not a revenue stream.
How we retain it
We keep as much as we can hold responsibly, and anonymize everything that isn’t billing:
- Billing data stays identified because a balance has to belong to someone — limited to what billing needs, access-controlled.
- Usage telemetry is keyed by a rotating, salted hash rather than your account id, and is decoupled from your identity.
- Aggregate analytics carry no per-account key and are kept indefinitely.
- Request content is not retained at all. A no-log key additionally routes only to models that retain nothing upstream.
When we disclose
We disclose customer information only when compelled by valid legal process — a subpoena, court order, or warrant properly served — and only the specific data it compels, which (per the above) is accounting metadata, not content we don’t keep. We do not run any covert disclosure pipeline and we do not volunteer or sell data. Where lawful, we aim to notify affected customers of legal process.
Cookies and analytics
The marketing site uses privacy-respecting product analytics only when enabled, with IP anonymization and input masking. We do not use advertising trackers. The authenticated API does not set tracking cookies.
Your choices
You can export or delete your account data from the dashboard, or by contacting us. On account closure we delete what we hold, minus anything a law requires us to keep.
Changes and contact
Material changes are posted here with a new effective date. Privacy questions: privacy@scrip.ai.