Privacy Policy — SEPANAI.COM

What we collect

When you submit a private trial application on SEPANAI.COM, we collect the information you provide on that form:

• Name
• Email address
• Country or region
• How you are joining (for example, individual, student, or business)
• What you want to use SEPANAI.COM for
• What you would like SEPANAI.COM to help you with
• Your consent to be contacted about the application
• The date and time of your application and consent

If you are given access to an AI workspace, we process the goal, instructions and context you choose to submit, together with the AI-generated response, so that we can provide the requested AI feature.

The shared SEPANAI AI audit log does not store the raw goal, context or generated answer. It stores limited operational metadata such as a request identifier, the SEPANAI product making the request, capability, privacy and quality mode, processing status, provider route and model used, character and token counts, latency and timestamp.

Why we use it

We use private trial information to review your application, contact you about it, administer early access, and share launch or trial information you have asked to receive.

We process AI workspace content to provide the AI task you actively request, return the result, protect the service from abuse, control cost and reliability, investigate failures, and maintain a minimal security audit trail.

How AI processing works

SEPANAI.COM is vendor-independent. A request may be routed to an approved model provider according to the task, availability, privacy mode, quality and cost. The underlying provider can change without changing the purpose for which your content is processed.

Private mode is the default. It is intended for founder, family and other private-trial work. SEPANAI prefers a paid or otherwise privacy-controlled provider path and can use Vercel AI Gateway with its no-prompt-training routing control. Private mode does not use SEPANAI's direct Google free-tier route.

Low-cost mode is optional and separate. If you expressly enable it for a non-sensitive task, SEPANAI may use the Google Gemini Developer API free tier first when that route is configured. Google states that content submitted through its free tier may be used to improve Google products. We therefore record a separate acknowledgement before this mode can be used. You can leave low-cost mode off and continue using private mode.

We minimise the information sent. Do not use low-cost mode for sensitive family, health, financial, credential, confidential business or other information that should remain on the private processing route.

AI-generated proposed actions are not treated as completed actions. Consequential external actions require a separate authorised action path and user approval unless a future feature clearly explains a different, expressly authorised automation rule.

Connectors, plugins, skills and MCP

Private-trial users may be given access to capabilities such as connectors, reusable skills, plugins and Model Context Protocol (MCP) servers. Capability registration, security review, user enablement and execution are separate controls.

The current MCP review feature can contact a registered public HTTPS MCP endpoint to discover its declared capabilities and tool descriptions. MCP tool execution is not enabled merely because a server is registered or discovered. Credentials are referenced separately and are not stored as plain secrets in capability manifests.

Service providers and sharing

We use service providers only where needed to operate the service. These can include Vercel for hosting and AI routing, Supabase for authentication, database and server-side functions, approved AI model providers for inference, and Resend for application-related email.

We do not sell your personal information and do not disclose AI content to advertisers. The optional low-cost free-provider route is not used unless you separately enable that mode after seeing its privacy notice.

Retention

SEPANAI AI Core operational audit metadata is automatically deleted after 30 days. The shared audit does not retain the raw AI prompt, context or generated answer.

Private trial application, invitation, membership, consent and usage-control records are kept only for as long as needed to administer the application or trial, maintain appropriate consent and suppression records, enforce trial limits, meet legal obligations, and resolve legitimate service or security issues. We review those records and delete or anonymise information that is no longer needed.

International processing

Some service providers may process information outside the United Kingdom. Where UK data-protection law requires safeguards for an international transfer, we use the applicable transfer mechanism, such as an adequacy arrangement or contractual safeguards provided by the relevant processor.

What we don't do

• We do not sell your data.
• We do not use AI workspace content for advertising profiles.
• We do not send private-mode requests through SEPANAI's direct Google free-tier route.
• We do not silently turn a discovered connector or MCP tool into an executed action.
• We do not make solely automated decisions in the private AI trial that have legal or similarly significant effects on you.

Legal basis

We rely on your consent for the private trial application and the communications covered by that consent. We separately record your choice if you opt into the low-cost provider mode described above.

Where you use an AI feature, we process the content needed to provide the service you request. We also use limited operational metadata for our legitimate interests in securing, measuring and reliably operating the service, provided those interests are not overridden by your rights and freedoms.

Your rights

Depending on the circumstances, you may have rights to access, correct, delete or restrict personal information, receive certain data in a portable form, object to particular processing, and withdraw consent where consent is the legal basis. You can unsubscribe using the link in an email we send. To exercise a right, contact hello@sepanai.com.

Keep sensitive information out unless it is needed

Do not submit passwords, API keys, payment-card details, authentication secrets, or sensitive personal information that is not necessary for the task. If sensitive information is genuinely needed for an approved use case, keep low-cost mode off and follow the product-specific privacy controls.

Contact

Questions about this policy or our use of personal information: hello@sepanai.com