Privacy Policy

This policy explains how Mortera Cloud collects, stores, uses, shares, retains, and protects personal data when you use the Service. We process data to perform our contract with you, protect the Service, comply with law, and obtain consent where applicable.

• Account: name, email address and verification status; optional username, profile image, or verified phone number if you provide one through a supported feature; locale, theme, mode, notification and referral preferences; a salted password hash (never the plaintext password); and the time and version of your Terms and Privacy Policy acceptance.
• Payments: payment rail, transaction and provider references, amount, currency, status, verification result, top-up and package purchase history, balances, invoices, and the package/version purchased. We do not store a full payment-card number in the account database.
• API usage: request timestamps, model, token counts, response status, error codes, and package used. For routing and security we also record a short client summary derived from your User-Agent - for example "Kilo Code 7 · Windows" - instead of the raw header (unrecognized clients keep only a 60-character prefix), plus the session identifier and app name your client sends in its x-session-id, X-Title, or HTTP-Referer headers, when present. Your prompt and output text is never part of this record.
• Technical: your IP address and device or application information supplied with each request. An active authentication session may temporarily retain the raw IP address and browser or application string supplied with the login. Separate fraud, referral, and security signals retain only cryptographically salted hashes of the IP address and, where supplied, a device identifier. A standard web request may include a referring page, but the application does not add that page to your account or API usage ledger.
• Communications: message content you provide when contacting support.

We do not request national identification numbers, full payment-card numbers, or biometric data as account fields. Do not place sensitive personal data in prompts or support messages unless it is necessary and lawful to do so.

• Operations: authentication, API authorization, provisioning, and billing.
• Billing: top-ups, transaction validation, and balance recording.
• Security and abuse prevention: self-referral and abuse detection, credential-abuse throttles, fraud prevention, and incident investigation.
• Communication: verification, notifications, announcements, and support responses.
• Service improvement: aggregate, anonymous analysis.

We do not sell, rent, or trade your personal data to third parties. Data is shared only when required by law or as described in this policy.

• Payment processors: payment processors and network providers receive transaction references, amounts, currency, and information that you provide directly to them as needed to process, verify, or investigate a payment.
• AI model providers and developers: the provider or model developer selected to fulfill a request receives prompt or input content and the request metadata needed to run the model. We do not send your Mortera Cloud payment history to them as part of an API request.
• Infrastructure and communications: hosting, database, cache, email, logging, and network vendors process the limited data needed to operate and secure their part of the Service.
• Security services: Cloudflare Turnstile and similar security services may receive IP address, browser/application information, and challenge results to detect automated or abusive traffic.
• Legal and safety disclosures: we may disclose data when reasonably necessary to comply with law, enforce these terms, protect users or the Service, investigate fraud, or respond to a valid legal request.

We use essential cookies to maintain login state and preferences. Cloudflare Turnstile may use cookies or similar signals for bot and abuse prevention. We do not currently use Google Analytics, Meta Pixel, advertising cookies, or retargeting. Blocking essential cookies or security technology may prevent registration or login.

• Passwords are protected as salted password hashes and are never stored in plaintext.
• API keys are authenticated by hashed lookup and stored encrypted at rest so they remain copyable from the console; treat them as secrets.
• Dedicated security signals use cryptographically salted IP/device hashes. As a limited exception, an active authentication session may temporarily store raw IP address and browser/application information until the session expires or is revoked.
• Public website and API connections are protected with HTTPS/TLS.
• Rate limits and abuse controls may be applied by IP address, account, API key, or other security signal.
• Administrative access is restricted, and sensitive administrative actions are recorded in audit logs.
• We investigate suspected incidents and provide legally required notices to affected users and authorities within the periods required by applicable law.

• Account data is retained while the account is active and as needed afterward to handle closure, disputes, security, and legal obligations.
• Authentication sessions normally expire after seven days and may be refreshed while in use. Expired or revoked session records, including their temporary raw IP and browser/application information, are removed by scheduled cleanup or revocation.
• Salted IP/device security signals have a configurable retention period (currently 90 days by default) and scheduled cleanup.
• Administrative audit logs have a configurable retention period (currently 24 months by default). API usage, payment, invoice, balance, and immutable ledger records are retained as needed for billing, reconciliation, fraud prevention, accounting, tax, disputes, and legal obligations; they are not covered by the session-retention period. Idempotency records - which hold no prompt text and, at most, one day of response replay data - are deleted by a scheduled hourly cleanup.
• When we process an account anonymization request, we remove sessions and credentials and replace or redact direct identifiers where operationally supported. Financial, usage, and audit records may remain linked to a pseudonymous account identifier where retention is necessary.

• Access: request a copy of your personal data.
• Correction: correct inaccurate personal data.
• Deletion: delete your account and data, subject to legal retention obligations.
• Withdrawal of consent: withdraw consent, which may disable the Service for your account.
• Portability: receive your data in a machine-readable format.

Submit a request from your registered email address. We verify identity and respond within the period required by applicable law; some rights may be limited by another person's rights or a legal retention obligation.

The Service is not intended for users under 17 years old. We do not knowingly collect children's data. Contact us to request deletion if such data is discovered.

The version date of this policy appears under its title. When we make material changes to how personal data is handled, we announce them through email to your registered address, an announcement in the dashboard panel, or both, at least 7 days before they take effect, unless law requires shorter notice or a security incident leaves no reasonable alternative. Continuing to use the Service after the effective date counts as accepting the updated policy.

Reach us any time through the Support item in your Mortera Cloud panel - there are no office hours. Terms of Service.