Privacy Policy

Selan is operated by Selan UAB, a private limited liability company registered in Lithuania under company code 308105472. For anything about your data, including a request to see or delete it, write to info@selan.ai — it reaches a person, not a queue.

The controller is named above. Its registered address is given on request — ask at info@selan.ai and you will have it the same day. Data protection law entitles you to know who the controller is, and that is the company named above rather than any individual.

We are the controller for account data — who signed in, which organisation they belong to, what role they hold. We are a processor acting on your organisation's instructions for usage records generated by your people's work. Being a small company changes none of those obligations.

There is one exception, and it is a response, not a request. When a provider replies with something that is not a success (and is not an authentication failure, which is stripped), the first 2 KB of that reply is written to our request log, so we can tell you why the call failed. On a malformed request a provider’s message can quote the part of your request it objected to. That is content, in a log we can read, and a policy that said never would be wrong. It is described the same way on our Trust page.

When a reply fails part-way through, two more things are written. The provider's error message, whole, because a stream that broke has no status code to explain it; and a description of the request we had sent, covering its last forty items: how many there were, what kind each one was, and how many bytes. That is a description of your content, not your content: it holds no words from it.

Your provider does receive the content of every request, because it has to in order to answer it. What they keep is governed by their privacy terms, not ours — see section 5.

Your identity, from Google or Microsoft sign-in

Email address, display name and profile photo URL, from whichever of the two you used. We never receive your password from either.

Your membership

Which organisation you belong to and your role in it.

Sessions

A hash of your session token — not the token itself — with its expiry and whether it has been revoked. We cannot reconstruct a token from what we store. A session lasts thirty days of not being used, and every request resets that clock; removing a member ends their sessions at once and revokes every access token they created.

Sign-in events

Time, outcome, the email involved, which identity provider, and the IP address and browser user-agent of the attempt. Kept to investigate account misuse.

Usage records

Per request: your email, your organisation, which credential served it, the model asked for and the model served, token counts split into input, output, cache-read and cache-write, the cost, the response status, how long the provider took, a request id and a session id, the request path, the browser or CLI user-agent, the name of the repository your CLI reported, how much rate-limit headroom the credential had, whether the request failed over to another credential, and the time we received it. This is what makes per-person usage and spend limits possible. The repository name is the one that may surprise you: it is the name only, never a path and never the contents.

Secret detections, when your organisation has turned scanning on

Which rule matched, how many distinct matches it found, and a SHA-256 hash of each match truncated to twelve hex characters: enough to notice the same secret twice, not enough to reconstruct it. The matched value itself is not stored.

Connector credentials your admins add

A few connectors cannot register a client automatically, so an admin creates an OAuth client at that service and gives us its id and secret. We encrypt both before storing them and never render them back — not even to the admin who added them. We do not store your own sign-in to a connector: that is an exchange between the app on your machine and the connector's own service, and we are not in it, which is also why we cannot tell your admin which connectors you use.

Provider credentials your admins add

Encrypted before storage, with the key held in a managed secret store, and never displayed back. Not personal data as such, but the thing we guard most carefully.

The marketing site runs Google Analytics, which sets its own cookies to tell one visit from the next. It records the pages you open, where you arrived from, and a coarse location and device — not your name, and we do not join it to your account. The product sets one session cookie, which exists only to keep you signed in.

We do not sell personal data, and we do not use it to train any model.

Our database and services run in Google Cloud’s europe-central2 region — Warsaw, Poland, inside the EU. Sign-in and provider requests may involve transfers outside the EEA; where they do, they rely on the European Commission’s standard contractual clauses or another lawful transfer mechanism.

What that means in practice:

• Ask and it goes. Email us and we will delete your organisation's data, or your own, and confirm when it is done.
• Sessions expire on their own and can be revoked from the CLI with selan logout; the expired row remains until cleaned up.
• Connector credentials are deleted when an admin removes the connector. Your own sign-in to a connector is not ours to delete — revoke it at that service, which takes effect regardless of anything we do.
• Provider credentials are deleted the moment an admin removes them. You can also revoke at the provider whenever you like, which takes effect regardless of anything we do.
• When early access ends or you stop using it, tell us and we delete everything of yours.

Automatic expiry is on the list. When it exists this page will say what the periods are, and the service will actually enforce them.

Under the GDPR you may ask for access to your personal data, correction, deletion, restriction or portability, and you may object to processing based on legitimate interest. Write to info@selan.ai and we will respond within one month.

Where we act as processor for your employer, some requests are theirs to decide — we will pass you to them and help them answer. You may also complain to your data protection authority; in Lithuania that is the State Data Protection Inspectorate (VDAI).

Credentials are encrypted at rest and never rendered back. Data is separated by organisation and every read is scoped to the organisation making it. Sessions are stored as hashes, expire, and can be revoked. Prompts and responses are never written down. Access to production is limited to the people who need it.

No system is completely secure, and we do not claim otherwise. If a breach affects your personal data we will notify you and the relevant authority as the GDPR requires. What we can promise about outcomes is limited — see the Terms of Service.

Being straight about early access: there is no third-party security audit, no certification, and one person has production access. That is the honest position, and it is why the advice on the Terms page is to cap your spend at the provider and route nothing you cannot afford to have go wrong.

Selan is for organisations and their staff. It is not intended for anyone under 16.

We will update this page when our processing changes, and change the date at the top. Material changes will be announced by email or in the product.