Privacy Policy

1. Scope

This policy covers:

• Our website, hopscotchlabs.ai, and its subdomains.
• The Hopscotch API and dashboard.
• Your account and billing with us.

It does not cover the model providers that serve your requests, or tools you connect to Hopscotch. They have their own privacy policies.

2. Data we collect

2.1 Account and billing data

When you sign up, we collect your name and email. If you invite teammates, we collect their emails too. When you add credit, our payment processor handles your card. We never see or store your full card number.

2.2 API request data

When you call the API, your prompts and the model's responses pass through Hopscotch to the provider and back. By default, we never store them. Storing them is always your choice, and it stays off until you turn it on.

For every request, we keep metadata:

• The model, the provider that served it, and the API key used.
• Token counts, cost, timing, and the result.
• The IP address the request came from.
• Error details when a request fails.

This is what your Activity log shows. It does not include the content of your prompts or responses.

2.3 Website data

When you visit hopscotchlabs.ai, we collect standard analytics through Google Tag Manager: pages viewed, referrer, device and browser type, and rough location from your IP address.

If you arrive from an ad, we save the ad's click ID and campaign tags in a cookie and in your browser's local storage. This tells us which ad brought you when you sign up.

3. How we use data

We use the data above to:

• Send your requests to the provider and return the response.
• Run, monitor, and secure the service.
• Bill your usage and enforce the spend limits you set.
• Investigate abuse, fraud, and breaches of our Terms of Service.
• Email you about your account and changes to the service, and about product news if you opt in.

4. Model training

We do not train models on your prompts or responses. They are never used to train, fine-tune, or otherwise improve any model. We do not sell them, and we do not share them with anyone for training.

Each provider has its own policy on training. Check the provider's terms for the models you use.

We use aggregated metadata, such as token counts, latency, and error rates, to improve the reliability and speed of the service.

5. Model providers

To answer a request, we send it to the provider that runs the model you named. That provider processes your prompt and the response under its own terms and privacy policy.

If you add your own provider key, the request runs on your key, and your own agreement with that provider applies.

6. Data retention

• Prompts and responses are not stored by default. Every account has Zero Data Retention, described in section 7, until you choose otherwise.
• If you turn storage on, we keep prompts and responses so you can see them in your dashboard. You can turn it off at any time.
• Request metadata, such as token counts, latency, and error codes, is kept for billing, usage reports, security, and abuse prevention.
• Account and billing records are kept while your account is open, and after that for as long as tax and accounting laws require.

7. Zero Data Retention (ZDR)

Every Hopscotch account has Zero Data Retention by default. While it is on:

• Prompts and responses are not written to durable storage after the request is processed.
• Prompts and responses are not used to train any model.
• We keep only the metadata needed to run the service, bill usage, and prevent abuse: token counts, timestamps, request IDs, the model, and latency.

ZDR does not cover requests you make while prompt and response storage is on.

ZDR covers what Hopscotch stores. The provider that serves a request may keep it under its own terms. Check the provider's retention policy for the models you use.

8. Sharing and disclosure

We share data only as needed to run the service:

• Model providers. Each request goes to the provider that serves it.
• Infrastructure providers. The cloud and hosting partners that run Hopscotch process data only on our instructions, under confidentiality and data protection terms.
• Payment and business tools. Our payment processor, email, and support tools get the data they need to do their job.
• Legal requests. We may disclose data to comply with valid legal process, or to protect our rights, our users, or the public.
• Business transfers. If Hopscotch is part of a merger, acquisition, or asset sale, your data may move with it, still under this policy.

We do not sell personal data. We do not share prompts or responses with advertisers or data brokers.

9. Security

We use industry-standard safeguards: TLS encryption in transit, encryption at rest, access controls on internal systems, and audit logging. No system is perfectly secure, so we cannot promise absolute security.

10. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, or to object to some processing. Email us to make a request. We will verify your identity first.

You can also:

• Delete your API keys at any time from your dashboard.
• Ask us to delete your account and its data, subject to legal retention rules.
• Unsubscribe from marketing emails with the link in any of them.

11. International users

Hopscotch is based in Canada. We and our providers may process your data in Canada, the United States, and other countries, which may have different data protection laws than yours. By using the service, you agree to this transfer.

12. Children's privacy

Hopscotch is not meant for children under 13, or the minimum age where you live. We do not knowingly collect their data. If you think a child has given us personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy. We will post the new version at hopscotchlabs.ai/privacy and change the “Last updated” date. For material changes, we will tell you before they take effect, by email or in the dashboard.