Privacy Policy

1. What we do

Andora provides a financial firewall for AI agents (Shield): virtual keys, spend budgets, proxy routing, and related dashboards. We collect only what we need to run that service.

2. Information we collect

• Account — name, email, company, role, auth provider metadata.
• Billing — plan, trial dates, payment processor tokens (not full card numbers; handled by Lemon Squeezy when enabled).
• Shield / proxy metadata — tokens, cost, model, latency, status, virtual-key identifiers. Prompt/response bodies only if your workspace opts in (e.g. response cache).
• Provider secrets — encrypted at rest; never returned after save.
• Support — messages you send to our mailboxes.
• Technical logs — IP, user agent, and security events needed to operate and secure the service.

3. Cookies and analytics

We use essential cookies for authentication (session) and security. We do not currently run third-party advertising cookies. If we add product analytics, we will update this policy and, where required, request consent.

4. Retention

• Account data — for the life of the account, then deleted or anonymized on request.
• Proxy logs — per plan retention (e.g. 7 / 30 / 365 days); zero-retention mode available.
• Billing records — as required by tax and accounting law.
• Security logs — typically up to 90 days unless investigating an incident.

5. International transfers

Primary database region is EU (Supabase eu-central-1). Some sub-processors operate in the US or globally (see sub-processors). Transfers are covered by the mechanisms in your DPA (e.g. SCCs) when applicable.

6. Your rights

Depending on your location (including GDPR and Nigeria NDPR where applicable), you may request access, correction, deletion, restriction, portability, or objection. Email privacy@useandora.com. We respond within one month where required by law.

7. Children

The Service is for business users. We do not knowingly collect data from children.

8. Contact

Privacy: privacy@useandora.com. Security: security@useandora.com. DPA: /dpa.

This policy is a product disclosure, not legal advice. Counsel should review before you rely on it in enterprise contracts.