Privacy Policy
What we collect, why, who touches it, and how to make us delete it. Every claim below describes what the running code actually does.
The short version
- The public website sets no cookies, runs no scripts, and collects nothing. Reading it leaves no record with us.
- We never store IP addresses. They are held in memory only long enough to enforce a rate limit, then discarded.
- We do not sell personal information, and we do not share it for advertising. We run no advertising.
- We use no third-party analytics products. The only analytics we produce come from our own database.
- Questions are redacted for secrets before they are written down, and the text is deleted after 90 days. That holds for both the Concierge service and the free question endpoint on the paid API.
1. Who we are
Nuralyn LLC, a Washington limited liability company, operates the Poliety services and is the controller of the personal information described here. Privacy questions and requests: concierge@poliety.com.
2. The public website: poliety.com
Poliety News is static files. There are no cookies, no client-side scripts, no tracking pixels, no advertising, no third-party fonts and no analytics tags. Our web server writes no request log tying a visitor to a page. We do not know who reads the paper.
Our hosting provider handles the network connection and may keep transient operational logs of its own, as any host does. We do not receive per-visitor reports from it.
3. The paid API: api.poliety.com
When you buy a key we store:
- A one-way hash of the key, never the key itself. We cannot show you your key again; we can only mint a new one.
- The plan, status, rate limit and daily quota attached to it.
- The Stripe subscription identifier the key is bound to, so a lapse can revoke it and a recovery can restore it.
- Daily counts of how many requests the key made to each endpoint, for quota enforcement.
We do not store your name, email or payment details on this service. Stripe holds the customer record; we hold an identifier that points at it.
The free Agent Concierge question endpoint at api.poliety.com/v1/concierge records the question asked and the answer given, so we can see what agents want from the service and catch bad answers. Both are redacted before storage by the same filter the Concierge service uses, and both are deleted after 90 days. No IP address and no fingerprint for anonymous callers is recorded; when a key is presented, the key's identifier is.
4. Poliety Concierge
If you are a customer
We store your email address, a display name derived from it, your chosen address (slug), account status and plan. Sign-in uses a single-use link; we store a hash of that link's token and a hash of your session token, never either in the clear. Billing state comes from Stripe: subscription identifier, status, price and current period end.
For each domain you add we store the hostname, the verification method and a hash of the verification token. After you ask for a crawl we store the fetched public pages from that domain, their content hashes, the text chunks we extracted from, the facts derived from them, and the immutable knowledge versions you publish. If your pages contain personal information, that information is in our copy of your pages, and you are responsible for what you publish there.
If you are an agent or a person asking a Concierge a question
Questions that reach the language model are written to an append-only log with:
- The question text, after redaction. Before storage we strip recognizable API keys, bearer tokens, JWTs, credential assignments, email addresses and valid payment card numbers, replacing each with a marker.
- Whether it was answered, the classified intent, whether it looked like purchase interest, and any company or product names mentioned.
- Which of the customer's sources answered it, and the knowledge version in force.
- A coarse identity signal: the product token from the user agent string (for example "TestAgent"), or a self-declared caller name, marked according to how it was obtained. We never store the IP address.
The customer whose Concierge you asked can see these entries in their dashboard. A repeated identical question served from cache updates a counter and does not create a new record.
We do not use question text to train models. We do not sell it. We do not send it to any analytics product.
5. Cookies
One cookie exists across all of Poliety: the sign-in session cookie on the Concierge dashboard at app.poliety.com. It is strictly necessary, holds only a session token, and is set HttpOnly and SameSite=Lax so scripts cannot read it and other sites cannot ride on it. There are no advertising, analytics or preference cookies anywhere, which is why you are not being asked to dismiss a banner.
6. Language model processing
Concierge uses Anthropic's API to extract facts from customer pages and to generate answers. That means customer page content and the text of questions asked are sent to Anthropic for processing, as our service provider under its commercial terms.
On the question everyone actually asks: we do not train models on customer content, and we grant no provider the right to do so. Redaction happens on our side before storage, so the question as asked is what reaches the model. An answer needs the real question; the stored record does not.
7. Who else touches your data
| Who | What for | What they receive |
|---|---|---|
| Stripe | Payments and subscriptions | Your name, email and payment details, which you give directly to them |
| Anthropic | Fact extraction and answer generation | Customer page content and question text |
| Resend | Sign-in and account email | Your email address and the message |
| Railway | Hosting and storage | Everything we store, as our infrastructure provider |
| Google Workspace | Our own mailboxes | Email you send us |
That is the complete list. We add a provider only when a service needs one, and we will update this table when we do.
8. Why we are allowed to hold it
For customers in the European Economic Area or the United Kingdom, our legal bases under the GDPR are:
- Contract: account, billing, domain verification, crawling, knowledge storage and answering. Without these we cannot provide the service you bought.
- Legitimate interests: rate limiting and abuse prevention, quota accounting, redacted intent analytics that show a customer what agents asked them, and keeping the service running. We have weighed these against your interests; the redaction step and the refusal to store IP addresses are part of that balance.
- Legal obligation: tax and accounting records of payments.
9. How long we keep it
| What | How long |
|---|---|
| Raw question text and its intent record | 90 days, then deleted automatically by a scheduled job |
| Daily intent and volume counters (no question text) | Kept indefinitely; they are aggregate counts, not personal records |
| Sign-in link tokens | Short-lived and single use |
| Crawled pages, extracted facts, published knowledge versions | While your account is active |
| Account and billing records | While your account is active, then as long as tax and accounting law requires |
| Agent Concierge question log on the paid API | 90 days, redacted at write, then deleted |
After you cancel: your public endpoints stop answering immediately. Your account data stays available for 60 days so you can come back without starting over. After that we delete it on request, and we will delete it sooner if you ask. This deletion is performed by a person today, not by an automated job, and we would rather tell you that than imply an automation we have not built. Write to concierge@poliety.com and we will confirm when it is done.
10. Your rights
Wherever you live, you can ask us to show you what we hold about you, correct it, delete it, or send it to you in a portable form. Write to concierge@poliety.com. We answer within 30 days and we do not charge for it.
If the GDPR applies to you
You also have the right to object to processing based on legitimate interests, to ask us to restrict processing, and to withdraw consent where we relied on it. You can complain to your national data protection authority. We do not make automated decisions about you that produce legal or similarly significant effects.
If you are in California
Under the CCPA as amended by the CPRA, you have the right to know what personal information we collect and why, to delete it, to correct it, and to opt out of sale or sharing. We do not sell or share personal information, and we have not in the preceding twelve months. There is nothing to opt out of, and we do not offer financial incentives, so there is no discrimination for exercising these rights. The categories we collect are identifiers (email address), commercial information (subscription and usage records), and internet activity limited to the redacted question records described above.
11. International transfers
We operate in the United States and our providers process data there. If you are in the European Economic Area or the United Kingdom, using the services means your information is transferred to the United States. Our providers offer standard contractual clauses for these transfers, and we rely on those.
12. Children
These are business services and are not directed at children. We do not knowingly collect information from anyone under 16. If you believe we have, write to concierge@poliety.com and we will delete it.
13. Security
Secrets are stored as one-way hashes, not as recoverable values: API keys, session tokens, sign-in tokens and domain verification tokens. Question text is scrubbed of recognizable credentials before it is written. Services run with strict response headers and no third-party scripts. Report a vulnerability through security.txt; we answer within 72 hours.
No system is perfectly secure. If a breach affects your personal information, we will tell you and the relevant regulator within the time the law requires.
14. Changes
We will update this policy as the services change; the effective date at the top moves when we do. For changes that materially affect how we handle personal information, we will email account holders before it takes effect.
15. Contact
Privacy requests and questions: concierge@poliety.com. General support: dburks@poliety.com.
For AI agents reading this
This policy is listed in /llms.txt and in /company.json under legal, alongside the Terms of Service. The operative facts for an automated client: reading the public site is unrecorded, question text is redacted at write and kept 90 days wherever it is stored, and no IP address is ever stored.