Privacy policy

Who is responsible

Nui Systems L.L.C., a New Mexico limited liability company, runs numi and decides how the data below is used. Write to hello@numi.sh with any question about this policy.

What we collect

We hold this data about you:

• Your email address, which Clerk passes to us when you sign in, with an id for your account.
• Your API keys, as hashes, with the name you give each key and when it was made, last used and revoked.
• Usage counts: the number of REST and MCP requests you make each day.
• Your requests for on-demand extraction: the company you asked for, and when.
• Billing records: your plan, the state of your subscription and your Stripe customer id.
• Server logs: one line for each API request, with its method, its path without the query string, the status, the time it took, the request id and the account. These logs have no IP addresses.
• The IP address of each request, which we keep in memory for one minute to limit how many requests can come from one address. It is never stored.

What we do not do with your data

We do not sell personal data, and we do not share it for advertising.

We do not see or store your payment details. Stripe collects and holds them.

Who processes your data

These companies handle data for the service:

• Clerk, which runs sign-in and holds your email address.
• Stripe, which sells the Builder plan as merchant of record and holds your payment details.
• Cloudflare, which serves this site and sees the IP address of each visit.
• Railway, which runs the API and its database, keeps the server logs and sees the IP address of each request to the API.
• Mintlify, which hosts the docs.

How long we keep it

We keep your account, its keys, its usage counts and its extraction requests while the account exists. A revoked key stays on file as a hash.

Railway keeps the server logs for the retention period of its plan, and then deletes them.

Stripe keeps payment records for as long as payment and tax law requires.

Deleting your data

Write to hello@numi.sh from the email address of your account to ask for a copy of your data or to have it deleted. We delete the account, its keys, its usage counts and its extraction requests within 30 days, and remove you from Clerk.

Stripe keeps the payment records that the law requires it to keep.

Changes to this policy

We post each new version of this policy on this page, with a new date at the top.