Privacy policy

Last updated: 19 October 2026

This policy covers gephyr.ai, the Gephyr console, and the connectors Gephyr hosts for app companies. Questions: hello@gephyr.ai.

Who we are

Gephyr is responsible for the personal data described here. Email hello@gephyr.ai, or write to Gephyr, 275 New North Road, Islington #1618, London N1 7AA, United Kingdom.

Who this is about

Customers: people at app companies who sign in to the Gephyr console to set up connectors.
End users: people who use an app company’s connector from an AI assistant (ChatGPT, Claude, Cursor and others).

For end users, the app company is in charge of their data. Gephyr processes it only to carry out the calls the user asks for, on the app company’s behalf. The app company’s own privacy policy also applies.

What we collect

Customers

Account details from sign-in: email address, and the name and profile picture your sign-in provider shares (for example Google, or an email sign-in link).
What you set up in the console: connector settings, tool choices and sign-in configuration.
Which console notices you closed or were shown (which app, which notice, a short marker of what it said then, and when), so a notice you closed stays closed on every computer you use. Nothing about end users.
Credentials you give us to connect your API. These are encrypted and never shown back.
Computers you sign in to the Gephyr CLI: the name each one gives, a fingerprint and the first few characters of its sign-in (never the sign-in itself), your email, when it was last used, and which versions of your apps it published. When you approve a sign-in we show the city, region and country it started from (worked out by our network provider) and keep that only for the 10 minutes a code is valid, unless the sign-in came with a warning (another country than your browser’s, the Tor network, or a place our network provider couldn’t tell): then the warning and that city, region and country stay with the computer’s record, so we can spot sign-ins that weren’t yours. When a signed-in computer is refused something it isn’t allowed to do, we record which computer, which app, when, and why it was refused, for 90 days. When you publish, we record which kinds of issue the safety check found and how many, never the text it flagged, for 90 days.
Tests for testing your actions with AI: the requests you or the AI write, and the results of each test run (which action each AI model picked, and its inputs).
How much of Gephyr’s AI features your workspace uses: for each request to an AI provider, which feature it was for (such as importing API docs or a test run), the model, and the token counts and cost the provider reports. Never what was sent to the AI or what it answered.
For paid plans: your plan, and Stripe’s ids for your customer record and subscription. Card details go straight to Stripe; we never see or store them.
If Gephyr staff get in touch with you (for example because you signed up but haven’t published an app yet): a note that we did, when, which of our staff did it and, sometimes, a short note of why. We work out who to contact from what’s already described here (when you signed up and last signed in, and how far you’ve got setting up), not from anything else. These notes are deleted after two years.
When the console hits a programming error (a JavaScript error), it reports the page (with ids taken out), the error message (with any web address, email or key-like text taken out) and the file and line of our code where it happened, so we can fix it. Nothing about who saw it: not your account, workspace, network address or browser. Counts of each error per hour are kept 30 days.
A history of your workspace’s plan changes: when, from which plan and billing interval to which, and what recorded the change (Stripe, or a plan we set). We use it to understand how plans and revenue change over time.

End users

Sign-in tokens your app issues when you connect an assistant. These are encrypted at rest, used only to make the calls you ask for, and never logged.
A record of each call: which connector and action, the outcome, timing, how big the app’s answer was (its size only, never its content), which assistant made it, and the country the request came from (worked out by our network provider; your network address itself isn’t stored). When you use an assistant that runs in the cloud, that’s usually the assistant’s country, not yours. You appear only as a pseudonymous ID (a keyed hash), never by name, email or your app’s user ID.
When you approve an action that needs your OK (like a booking or payment) and it’s sent to the app: a signed receipt of it, for settling disputes. It says which app and action, when it was sent, how the approval came back and which assistant the call came from, and the result, plus fingerprints (one-way hashes) of the details and of the app’s id for it. It holds nothing about who you are: no name, email, user ID or pseudonymous ID. The app company can see and download it. You get its number and a link to it in the chat, and anyone with that link or the receipt can see it and check it’s genuine.
About the assistants themselves (not you): each assistant’s name and version as it reports them, what its software calls itself in the request (its User-Agent), the protocol version it uses and the features it says it supports, such as its own approval screens. One record per assistant version, shared across everyone who uses it, with nothing about any user.
If the app company turns it on, a short note an assistant sends when you ask for something the connector can’t do yet (up to 280 characters). It isn’t linked to your identity, but it is stored as written, so don’t put personal details in it.

We never log passwords, tokens, keys, or the content of calls (what you asked for and what the app returned). Apps on Firebase or Supabase Auth use a Gephyr sign-in page whose password goes from your browser straight to that provider and never reaches Gephyr.

Website visitors (gephyr.ai)

We count visits ourselves, without cookies or third-party scripts: the page, the site that sent you (its name only, like google.com), and your country (worked out by our network provider). To count each person once a day we use a pseudonymous ID, a keyed hash of your network address and browser type together with the date, so it changes every day and can’t link your visits across days. Your network address itself isn’t stored, and nothing is stored in your browser. If your browser sends Do Not Track or Global Privacy Control, nothing is counted.
If you email us we keep your message so we can reply. We don’t use advertising trackers.

How we use it

To run the service: sign you in, carry out calls, enforce each connector’s rules and confirmations.
To bill app companies per successful call.
To get in touch with customers who signed up but haven’t finished setting up, at the email they signed in with.
To keep the service secure and fix problems.
To show app companies how their connector is used, in aggregate and without identifying end users.
To see how the website is used, in aggregate (visits a day, pages, referring sites, countries).

We don’t sell personal data or use it for advertising. We don’t use customer or end-user data to train AI models.

The app company whose connector you use, as described above.
Service providers that host our infrastructure, database and website, bound to process data only for us.
AI providers (Anthropic, and others such as OpenAI through OpenRouter) when you use AI features in the console: drafting actions from your API docs, writing and running tests of your actions, and Gephyr AI suggestions (descriptions, notes for agents, why an action fails, feature requests matched to your API). They get your app’s actions, descriptions and notes, your API docs, your tests and counts of your app’s calls; never end users’ identities, chats or your API’s answers. Matching feature requests, which you ask for, also sends the text of the requests your users chose to send, without who sent them.
Stripe, which processes payments for paid plans and, through Link, sells them as merchant of record (taking payment, handling tax and receipts): the workspace name and the owner’s email, plus what you enter at checkout, such as your billing address. Stripe and Link handle that under their own privacy policies.
Authorities, if the law requires it.

How long we keep it

Console accounts: until you delete your account.
Console notices you closed or were shown: until you delete your account or the app.
End-user sign-ins: until you disconnect, the app company disconnects or blocks you, the app is deleted, or 90 days without use. Your tokens for the app go when the sign-in ends; a record that you signed in (your pseudonymous ID, when, and through which assistant) stays 90 days more for the app company’s dashboard, then goes too.
If the app company blocks you from its connector: your pseudonymous ID on its blocked list, until it unblocks you or deletes the connector.
Call records, and the notes assistants send when you ask for something a connector can’t do: 90 days, or until the app company deletes the connector.
Receipts of approved actions: 18 months, so they cover card chargebacks.
Website visit counts: 90 days.
Console error reports: 30 days.
What each assistant version supports: 180 days after we last see it.
Tests and test runs: until you delete them or the app. How many test runs your workspace used each month (a count, nothing else): 70 days.
Your workspace’s AI requests (feature, model, token counts and cost): 100 days.
Monthly call totals for each app company’s workspace, used for billing: as long as the workspace exists. They’re counts only and don’t identify end users.
A workspace’s plan history: as long as the workspace exists.

Your choices

Disconnect a connector from your assistant at any time. It stops working on the next request.
Ask us to access, correct or delete your data: email hello@gephyr.ai. If you’re an end user, we may pass the request to the app company, since they control your data.

Security

See the security overview for how we protect data: encryption, per-company keys, locked-down outbound calls and what we log.

Changes

If we make material changes we’ll update this page and the date above, and tell customers by email.

Something missing or wrong? Email hello@gephyr.ai.