Privacy Policy

Last updated: August 27, 2026 · Differson LLC

By creating a Clancy account, you acknowledge that you have read this Privacy Policy and you consent to the collection, use, and processing of your information as described here. If you do not agree, do not create an account or otherwise use the Service.

This Privacy Policy describes how Differson LLC ("we," "us," "Differson") collects, uses, discloses, and protects information in connection with Clancy — our API, hosted inference service, dashboard, and related websites (the "Service"). It should be read together with our Terms of Use. Differson LLC is the data controller for the information described in this policy.

1. Information We Collect

Category	What it includes
Account information	Email address, username, password (hashed by our authentication provider — we never see or store it in plain text), signup timestamp, and the timestamp you accepted these terms.
Billing information	Subscription tier, status, renewal and billing-period dates, and payment history. Full card numbers are handled entirely by Stripe, our payment processor — we never receive or store your complete card number.
API content ("Input" & "Output")	The request and response content sent through the API, prompt and completion token counts, timestamps, and which API key was used.
API keys	We store a one-way cryptographic hash of each key, never the key itself. A lost key cannot be recovered from our systems — only regenerated.
Technical & log data	IP address, browser or client type, and request metadata generated automatically when you use the Service, retained for security and troubleshooting.
Support communications	Content of any message you send us, e.g. by email, for the purpose of responding to you.

2. How & Why We Use Information

We process your information for the following purposes and on the following legal bases (where applicable, e.g. under GDPR):

To provide the Service — authenticating requests, enforcing quotas and rate limits, and returning model output. (Necessary to perform our contract with you.)
To bill you — metering usage against your tier and reporting charges to Stripe for invoicing. (Necessary to perform our contract with you.)
For security and abuse prevention — investigating suspected abuse, fraud, or key compromise, and enforcing our Terms of Use. (Our legitimate interest in keeping the Service secure and available.)
To improve the Service — understanding aggregate usage patterns to plan capacity, reliability, and pricing. (Our legitimate interest in operating and improving the Service.)
To communicate with you — service notices, billing receipts, security alerts, and responses to your support requests. (Necessary to perform our contract with you.)
To comply with the law — responding to legal process, tax and accounting obligations, and enforcing our agreements. (Legal obligation.)

3. What We Do Not Do

We do not sell your Input or Output content to third parties, and we do not use your API Input or Output to train, fine-tune, or otherwise improve models made available to other customers. Clancy's model is trained on a separate, purpose-built data pipeline unrelated to customer API traffic. We do not use your data for third-party advertising.

4. How We Share Information

We share information only as described here:

Service providers ("sub-processors"): Google Firebase / Google Cloud (authentication, database, hosting, and serverless compute) and Stripe (payment processing and billing). Each processes data on our behalf, under their own data-processing terms, solely to provide these services to us.
Legal requirements: if required to do so by law, subpoena, or other legal process, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
Business transfers: if Differson LLC is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction, subject to this policy or a policy at least as protective.

We do not otherwise sell, rent, or trade your personal information to third parties.

5. International Data Transfers

Our infrastructure providers (Google Firebase / Google Cloud) may process and store data in the United States and other countries. By using the Service, you understand that your information may be transferred to and processed in countries other than your own, which may have different data-protection laws.

6. Data Retention

We retain account information for as long as your account is active, and for a limited period afterward for legal, tax, and accounting purposes. API usage logs (Input/Output content and token counts) are retained for as long as needed for billing disputes, abuse investigation, and service operation, and are deleted or anonymized on a rolling basis thereafter. You may request earlier deletion of your account as described in Section 7.

7. Your Rights

Depending on your location, you may have some or all of the following rights regarding your personal information:

Access — request a copy of the personal information we hold about you.
Correction — request correction of inaccurate or incomplete information.
Deletion — request deletion of your account and associated personal information, subject to the retention needs described in Section 6.
Portability — request a copy of your data in a structured, commonly-used format.
Objection & restriction — object to or request that we limit certain processing based on legitimate interest.
Withdraw consent — where processing is based on consent, withdraw it at any time (this does not affect processing that occurred before withdrawal, or processing based on another legal basis, such as billing records we must keep by law).

To exercise any of these rights, contact contact@differson.net. We will respond within the timeframe required by applicable law (e.g. GDPR or CCPA).

8. Security

We use reasonable technical and organizational measures designed to protect your information, including encryption of data in transit, hashed storage of passwords and API keys, and access controls limiting who can reach production data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Children's Privacy

The Service is intended for users 18 and older. We do not knowingly collect personal information from anyone under 13. If we become aware that we have done so, we will delete it. A parent or guardian who believes a child under 13 has provided us with personal information should contact contact@differson.net.

10. Cookies & Similar Technologies

We use essential cookies and similar local storage necessary to keep you signed in and to operate the dashboard. We do not use third-party advertising trackers.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through an in-app notice before the change takes effect. Continued use of the Service after a change becomes effective constitutes acceptance of the updated policy.

12. Contact

Privacy questions or rights requests: contact@differson.net
Differson LLC