Who is responsible
[[COMPANY LEGAL NAME]], [[REGISTERED ADDRESS]] ("Mortar", "we") is responsible for the personal data described here. Contact us about it at [[PRIVACY CONTACT EMAIL]].
When a customer's organisation uses Mortar to process personal data of its own, such as personal data inside prompts, Mortar processes it on the customer's behalf under the data processing addendum.
What we collect
- Your account
- Your email address, name and avatar URL, and the account id of each identity provider you sign in with (GitHub, Google or Microsoft), or the email address you enter for a sign-in link. We record when the account was created and last used.
- Your organisation
- The organisations you belong to and your role in each. For invitations, the invited email address, the role offered and who sent it.
- Sessions
- A random session id linked to your account and chosen organisation, and, while a sign-in is in progress, the values that tie it to your browser.
- API keys
- Each key's label, visible prefix and hash, who created it, and when it was created, last used and revoked. Never the key itself.
- Audit events
- Changes made in your organisation, with who made them, when, and from which IP address.
- Request logs
- For each request: method, path, response status and size, duration, a request id and the time. Your IP address when a request is rate limited.
- Prompts and completions
- Processed by the data plane to answer your requests. Conversations are held in memory only and are not written to logs.
- Cookies
- A session cookie and a theme preference. The cookies page lists each one.
Why we use it
- To provide the service
- Signing you in and keeping you signed in, running your organisation's members and keys, and answering API requests. Proposed legal basis: performance of our contract with you.
- To keep it secure
- Rate limiting, request logs and the audit log, which protect you, other customers and the service. Proposed legal basis: our legitimate interest in operating a secure service.
- To reach you
- Sending the sign-in links and invitations you or your colleagues request. Proposed legal basis: performance of our contract with you.
How long we keep it
- Sessions
- Until you sign out, or 14 days after your last request. Expired sessions are deleted within 10 minutes.
- Sign-in links
- Deleted once used, or after 15 minutes.
- Invitations
- Deleted once accepted or revoked, or after 7 days.
- Conversations
- Until the data plane restarts.
- Account, organisation, key and audit records
- While your account exists, and for [[RETENTION AFTER ACCOUNT CLOSURE]] after it is closed.
- Request logs
- [[LOG RETENTION PERIOD]].
- Backups
- [[BACKUP RETENTION PERIOD]].
Who we share it with
The sub-processors that run parts of the service for us, each receiving only what its task needs, and the identity provider you choose to sign in with. Transfers outside your country rely on [[INTERNATIONAL TRANSFER MECHANISM]].
Your rights
You can ask for a copy of your personal data, ask us to correct or delete it, object to how we use it, or ask for it in a portable format. Write to [[PRIVACY CONTACT EMAIL]]. You can also complain to your data protection authority.
How we protect it
The security page describes the controls the service implements.
Changes to this notice
We publish changes on this page and update the effective date at the top.