This Policy explains how Zephex collects, uses, and shares personal information when you use our dashboard and MCP proxy.

Database and authentication

Account data (email, profile, API key hashes, usage logs, billing links) is stored in Supabase Postgres with row-level security isolating each customer. Dashboard sign-in uses Supabase Auth — email/password, GitHub/Google OAuth, magic links, and passkeys. MCP tool calls authenticate with Bearer API keys validated against hashed keys in the same database. MCP connector OAuth (Claude.ai, ChatGPT, and similar clients) uses Auth0 as the authorization server with PKCE; dashboard accounts remain on Supabase Auth. We never store plaintext API keys.

Service health for the database and auth layers is monitored at zephex.dev/status. Technical detail: Authentication docs.

Service providers

• Supabase — Postgres database and dashboard authentication (accounts, API key hashes, usage logs, sessions).
• Auth0 — OAuth authorization server for MCP connector clients (Claude.ai, ChatGPT, PKCE flows).
• Railway — MCP Server — hosts tool execution (find_code, read_code, check_test, etc.).
• Vercel — Dashboard, public MCP endpoint proxy (zephex.dev/mcp), and edge routing.
• Upstash Redis — Rate limiting, session cache, and health-check coordination.
• Stripe — Payments, subscriptions, and billing meters.
• Resend — Transactional email (verification, security alerts, billing notices).
• Sentry — Error monitoring with PII redaction.
• PostHog — Product analytics (optional; EU users can decline via cookie banner).

Information we collect

• Account: email (and optional profile details you provide).
• API keys: key metadata (prefix/ID). We do not store plaintext API keys.
• Usage: request counts, tool names, timestamps, and related usage metrics.
• Security logs: IP address, user agent, login attempts, and abuse signals used to secure the Service.
• Billing: subscription status and payment-related data handled by Stripe.

How we use information

• Provide the Service (authentication, routing, dashboards, support).
• Secure the Service (fraud prevention, rate limiting, suspicious activity detection).
• Billing and accounting (subscriptions, invoices, usage reconciliation).
• Improve reliability (debugging, performance monitoring).

Teams and organizations

If you roll Zephex out to a team, the account owner remains responsible for every API key created under that account. Each developer should use named keys per environment; shared keys in chat or public repos violate our acceptable-use rules.

Usage metadata (tool name, timestamp, success/error, latency) is stored per API key so account owners can attribute quota in the dashboard. We do not store tool arguments or outputs. Rollout guide: Team MCP rollout.

AI model training

Zephex does not use prompts, tool inputs, tool outputs, or repository content accessed through tools to train, fine-tune, or evaluate AI models. This applies to all plans without exception.

Tool call data — stored vs. not stored

Cookies

We use cookies and similar storage to keep you signed in, protect your account, and operate the dashboard. We use PostHog for product analytics (page views, feature events, session replay with masked inputs). PostHog may set cookies (e.g. ph_*). Essential cookies (session, CSRF) are always required. EU users can decline optional analytics via the cookie banner.

Sharing and processors

We share personal information only with the service providers listed above, as needed to run the Service. No processor receives plaintext API keys or full tool call content.

Data retention

We retain personal information only as long as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. Some records (for example: billing) may be retained longer where required.

Your choices

• Rotate/revoke API keys in the dashboard.
• Request export or deletion of your account data by contacting us.

California Privacy Rights (CCPA)

If you are a California resident, you have the following rights:

• Right to Know: You may request what personal information we collect and how we use it.
• Right to Delete: You may request deletion of your personal information.
• Right to Opt-Out: You may opt-out of the sale of your personal information.

We do not sell your personal information.

Children's Privacy

Zephex is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has created an account, contact support@zephex.dev and we will delete it promptly.

Data Breach Notification

In the event of a data breach that affects your personal information, we will notify you without undue delay and as required by applicable law (method and timing depend on jurisdiction and severity).

Contact

Privacy questions: support@zephex.dev