ASTERHOP · Beta
Data & Privacy
A practical guide to how the current ASTERHOP Beta handles your data. This is a product explanation, not a consent form.
Reviewed on
What passes through ASTERHOP
Your messages, relevant conversation context and uploads pass through ASTERHOP and are sent to OpenAI to count input tokens where needed and generate replies.
Registration and sign-in use your email and password through Supabase Auth. Verification emails use the configured email delivery service. These credentials are not included in model requests.
Our AI provider
The current models use the OpenAI Responses API. Images and PDFs are included in the request itself; ASTERHOP does not create persistent OpenAI Files uploads or a file-search library.
We set store: false so generated Responses are not stored for later API retrieval. This does not disable all provider-side retention.
Model training is different from retention
OpenAI does not use API inputs or outputs to train models by default. The API account owner can opt in to sharing data for model improvement.
Project-specific data-sharing, Zero Data Retention and Modified Abuse Monitoring settings have not been verified for this notice. We do not promise special retention exemptions.
OpenAI retention and safety
Default abuse-monitoring logs may include content and are kept for up to 30 days, with possible legal or safety extensions. Prompt caching can retain encrypted processing state for up to 24 hours.
Images and files are safety-scanned; flagged material may be retained for review. Special retention controls require OpenAI approval and have exceptions.
Current chat storage
ASTERHOP saves Playground text messages, assistant responses and bounded attachment metadata as your conversation history. Original image/PDF bytes and provider file IDs are not stored in history.
Only newly accepted turns extend retention. Conversations expire after 90 days of inactivity; reading, renaming or reopening them does not extend that period. Public API requests remain stateless.
Temporary processing
Images and PDFs are processed transiently for validation and inference, then released. Reopened chats require explicit replacement uploads when earlier attachments are needed; replacements are not verified as the original files.
Account, keys and usage records
We retain account identifiers/status, API-key labels and safe prefixes, request/model references, token counts, timestamps, charges, credit movements and operator audit records to run the service and keep accounting auditable. Email is kept in the authentication service and is visible to authorized administrators. Usage records do not contain chat text or attachment contents.
Supabase Auth manages password verification and sessions. Confirm password is checked and discarded before signup reaches Supabase. API-key secrets are shown once; the application stores a digest, not the original secret. Sign-in uses protected cookies, and a separate cookie remembers language.
Operational logs and backups
Normal application logs record operational outcomes, not prompts, replies or attachment data. The reverse proxy also records connection/request metadata, including IP addresses and status, with request headers and URLs omitted from its access log. Infrastructure and authentication services have their own operational records.
Conversation content may exist in encrypted backups retained for 30 days. Restore requires authenticated deletion evidence and expiry replay; if deletion coverage cannot be established, recovered conversation content is not reopened.
Clearing content and requesting deletion
Delete a conversation in Playground to remove its content from the current application database and immediately hide it from history. Usage and accounting evidence remain. Historical backups follow the 30-day retention policy.
Clearing a page does not delete provider safety logs or existing backups. ASTERHOP cannot promise deletion of records outside its control; provider policies and applicable recordkeeping requirements still apply.
Contact during Beta
For data questions or requests, contact the ASTERHOP team member who invited you or your existing account contact. Please do not send passwords, API keys or sensitive documents in a support message.