Privacy

Last updated 11 October 2026.

batchrate processes account data and the prompts you submit so it can run batch jobs and bill for them.

What we store

• Account email, a PBKDF2-SHA256 password hash, and whether the email is verified.
• Session cookies. The cookie is a random token signed with HMAC. Only the SHA-256 of the token is stored.
• API keys as a SHA-256 hash and a short prefix. The full key is not stored.
• Batch files, request bodies, outputs, token counts, and credit ledger entries.
• Stripe customer email and checkout identifiers needed to credit a payment. Card numbers stay with Stripe.
• Contact messages, encrypted at rest.

Why

We use this data to authenticate you, run and retry jobs, debit credits, prevent abuse, and answer support mail. We do not sell personal data.

Subprocessors

Cloudflare hosts the site, database, file storage, and rate-limit counters, and sends verification, password-reset, receipt, and contact mail through Cloudflare Email Service from [email protected]. Stripe processes payments. GPU capacity, when the worker is connected, may be rented from providers such as Vast.ai to run the model. Prompts are sent to that worker only to produce the completion.

Retention

Input files are deleted 7 days after every batch that used them reaches a terminal state, or 7 days after upload if the file is never used. Output and error files are deleted 30 days after they are created. The periods are INPUT_RETENTION_DAYS and OUTPUT_RETENTION_DAYS. You can delete a file sooner. Deletion removes the object from storage immediately and marks the database record deleted. Ask contact if you want an account closed. We keep ledger rows that are required for accounting.

Cookies

The session cookie is HttpOnly and SameSite=Lax. It is used to keep you signed in to the console. The API itself uses bearer keys.