Contact SalesSign Up

Privacy Policy

Last updated: September 24, 2026

This Privacy Policy explains how Akkru Inc. ("we", "us") collects, uses, retains, and shares personal information when you use AkkruData (the "Service"). We keep what we collect to the minimum needed to operate the Service, and we do not sell personal information.

Information we collect

  • Account information you provide: email address, password (stored only as a salted hash), and any profile data you supply.
  • Sign-in metadata from OAuth providers (Google, GitHub) if you choose them: the provider's user ID and your verified email. We never receive your provider password.
  • API and tool usage logs: which endpoint or MCP tool was called, the channel (API key, MCP, or web app), the API key name used (never the key value), credits charged, and a UTC timestamp. These rows are retained for 90 days, then automatically deleted.
  • Payment information when you purchase a plan or credit pack: handled by Stripe, Inc. as our payment processor. We receive a customer ID and the metadata needed to reconcile a transaction; full card numbers are never sent to us.
  • Technical metadata necessary to operate the Service: IP address (used to rate-limit, prevent abuse, and detect suspicious activity), browser user-agent, and request timestamps. We do not use IP addresses for profiling or advertising; see Cookies below for what Google receives if you accept advertising cookies.
  • Authentication cookies (HTTP-only, SameSite=Lax) so you stay signed in. Separately, our pages load Google Ads conversion-measurement tags (gtag.js). They set advertising cookies only after you choose Accept all in the cookie banner; until then, and if you choose Essential only, every advertising and analytics consent signal stays denied (Google Consent Mode v2). You can change your choice at any time under Cookie Settings in the footer. We do not embed analytics or session-replay scripts.

How we use it

We use this information to operate, authenticate, secure, bill, and improve the Service — signing you in, deducting credits, enforcing rate limits, processing payments, sending essential service emails, and investigating fraud or abuse. We do not use your information to train AI models, and we do not build advertising profiles of you. If you accept advertising cookies, Google Ads measures whether our advertising led to a sign-up, under Google's privacy policy.

Who we share it with

  • Stripe, Inc. (payment processor) — to bill subscriptions and credit packs and to comply with payment-network and tax requirements. Stripe's handling is governed by its own Privacy Policy.
  • Google LLC and GitHub, Inc. — only if you choose OAuth sign-in, and only to verify your account, under their respective privacy policies.
  • Google LLC (Google Ads) — only if you accept advertising cookies, to measure whether our advertising led to a sign-up; Google's handling is governed by its own Privacy Policy.
  • Cloudflare, Inc. — our edge / CDN provider; sees request metadata in transit for DDoS protection and rate limiting.
  • MiniMax (LLM inference provider) — when a line-item or statement-name lookup cannot be resolved by exact matching, we send the query text and a shortlist of candidate labels from that filing to MiniMax's API to pick the match. No account identity, email address, or API keys are included; that exchange is governed by MiniMax's own privacy policy.
  • When you connect AkkruData to a third-party LLM client (Claude, ChatGPT, Gemini, etc.) over MCP, your tool calls and responses pass through that provider's platform; those interactions are governed by that provider's terms and privacy policy. We do not receive the surrounding conversation outside the MCP tool call.
  • Government, legal, or regulatory authorities when required to comply with a valid legal process or to protect rights, safety, or property.
  • We do not sell or rent personal information.

How long we keep it

  • Account data (email, profile, hashed password, OAuth links) — until you delete your account.
  • API and tool usage logs — 90 days, then automatically purged.
  • Payment and billing records — as required by tax and accounting law (typically 7 years in the United States).
  • Security event logs (including IP addresses) — 90 days, then automatically deleted. Server access logs — short windows for security investigation, then rotated.

Your rights

You can view and update your profile from the dashboard, generate or revoke API keys, view your 90-day usage history, and delete your account at any time. To exercise rights to access, correction, deletion, portability, or restriction under applicable law (including the California Consumer Privacy Act), email [email protected]. We respond within the timeframe required by law (typically 45 days under the CCPA).

Where data is stored

The Service is hosted on infrastructure located in the United States. If you access the Service from another country, you consent to your information being transferred to and processed in the United States.

Children

AkkruData is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe we have collected such information, contact us so we can delete it.

Changes to this policy

We may update this Privacy Policy from time to time. We will revise the "Last updated" date and, for material changes, notify you by email or in-app notice.

Contact

Akkru Inc. (Delaware C-Corporation, with operations in California). For privacy questions or to exercise your rights, email [email protected].