Privacy Policy

Scope

This policy applies to the LatteCode website at lattecode.net, the LatteCode API at api.lattecode.net, and the accounts, API keys, and billing associated with them. LatteCode is a large language model API gateway for developers: it forwards your API requests to upstream model providers and bills them against a prepaid balance.

Data we collect

Account data: your email address, a display name, and a password hash if you choose to set a password.

Authentication data: email verification codes, session tokens, the sign-in method you used, and the IP address of sign-in attempts, which we use for rate limiting and abuse prevention.

Billing data: orders, your prepaid balance, balance ledger entries, invoices you request, and the payment reference returned by the payment provider. We never see or store card numbers or wallet private keys.

API usage data: the names and hashed values of your API keys, and for every request the model, token counts, cost, timestamps, status, and the IP address it came from.

Request content: the prompts and responses that pass through the API are not retained for successful requests. When a request fails or is interrupted, or while an administrator has temporarily enabled diagnostic capture, a copy of the request and response may be kept so we can diagnose the problem.

Signing in with Google

If you choose to sign in with Google, Google sends us the email address of your Google account, whether that address is verified, and your name. We use the email address to find your existing LatteCode account or to create a new one, and your name only as the initial display name of a new account.

We request no other Google data. We do not store your Google account identifier or profile picture, and we never read, write, or post anything in your Google account. You can also sign in with an email verification code or a password without using Google at all.

Google user data is used only to sign you in. It is never used for advertising, sold to data brokers, or used to develop, improve, or train artificial intelligence or machine learning models. Our handling of Google user data complies with the Google API Services User Data Policy, including its Limited Use requirements.

How we use data

We use the data above to authenticate you, serve and route your API requests, calculate usage and charge your balance, send verification codes and account or order notices by email, enforce rate limits and prevent abuse, troubleshoot incidents, and meet legal obligations. We do not use your data for advertising and we do not sell it.

Where data is stored and how it is protected

Data is stored in a database on servers operated by LatteCode and backed up by our hosting provider. Connections to lattecode.net and api.lattecode.net are encrypted with TLS. Passwords are stored as salted hashes and API keys as hashes, so neither can be recovered from the database. Access to production systems is limited to the people who operate the service.

Who we share data with

Model providers: the content of your API requests is forwarded to the upstream model provider that serves the request so that it can generate the response.

Payment providers: when you top up, the payment provider receives the order amount and reference. Crypto payments are received at a fixed address on a public blockchain; the transaction itself carries no account information.

Infrastructure providers: our hosting provider and Cloudflare process traffic in order to deliver the service, and our email provider receives your address in order to deliver verification codes and notices.

Legal requirements: we disclose data when required by law or when necessary to protect the service and its users from abuse. We never sell personal data.

Retention and deletion

Account and billing records are kept for as long as your account exists and for as long as we need them to document payments. Request logs and diagnostic copies are deleted automatically after a retention period set by LatteCode. Verification codes and sign-in challenges expire within minutes. You can delete API keys at any time from the console.

To delete your account, email [email protected] from the address on your account. We remove your account data within 30 days, except billing records we are required to keep for accounting purposes.

Changes to this policy

We update this page when our practices change and show the date of the latest revision at the top. If a change affects how Google user data is handled, we notify account holders by email before it takes effect.

Contact

For privacy questions, account deletion, or data requests, contact [email protected] from the email associated with your account.