What we keep, and why.

Who we are

Exorails is operated from France. Contact: [email protected].

What we collect

• Account — email, name, password hash, optional social sign-in identifiers, two-factor seed (encrypted), sessions (IP address, browser).
• Environments — names, upstream server addresses, secrets (encrypted, never readable by us through the product), OAuth grants (encrypted).
• Call log — for each tool call: tool name, agent name, status, latency, sizes, a redacted error message. Arguments and results are not stored unless you enable argument logging for an environment.
• Billing — handled by Stripe; we keep the customer and subscription identifiers and usage counters.
• Support — messages you send us and notes we take to help you.

Why

To run the gateway, bill fairly, keep the service secure, answer support and meet legal obligations. We do not sell data, do not run advertising, and do not use tool calls or their results to train anything.

Retention

• Call log: 24 hours on Free, 30 days on Pro, 90 days on Team, custom on Enterprise.
• Account data: as long as the account exists. Deleting the account deletes environments, destroys vault keys and anonymizes the account record.
• Billing records: as long as tax law requires.

Sub-processors

Listed in the docs and updated before any change: hosting in the EU, Cloudflare, Stripe, Resend, GitHub and Google for optional sign-in.

Your rights

Access, rectification, erasure, portability and objection under the GDPR. Most of it is self-service in Settings; for the rest, write to [email protected]. You can also complain to the CNIL.

Cookies

One session cookie to keep you signed in and one to remember the organization you are looking at. No tracking cookies.