Privacy Policy

1. Who we are and how to reach us

Logyak is provided by [Company legal name] ([ABN or company number]), [Registered address] ("we", "us"). This policy explains what personal data we collect, why, how long we keep it, who helps us process it, and the rights you have.

For anything about your personal data, email hello@logyak.com. We answer within one month (30 days under Australian law), and tell you if we need longer.

EU representative: [EU representative under Article 27 GDPR, if required: name and address]. UK representative: [UK representative under Article 27 UK GDPR, if required: name and address].

2. Two roles: controller and processor

We handle two different kinds of personal data, in two different roles:

• Account holders: the people who sign up for Logyak, their team members and people they invite. For this data we are the controller: we decide why and how it is processed. Sections 3 to 5 describe it.
• Log data: the log lines our customers send to Logyak from their own apps. Those lines can contain personal data about the customer's end users and staff, such as IP addresses in HTTP request logs, email addresses or user ids, depending on what the customer's app writes. The customer decides what its apps log and sends to us, so the customer is the controller and we are their processor, acting only on their instructions under our Data Processing Agreement. Sections 6 and 7 describe it; for anything else about that data, please contact the company whose app you used, whose own privacy policy applies.

3. What we collect about account holders

• Account: your name, email address, your password as a one-way hash (bcrypt, never the password itself) or your Google account identifier if you sign in with Google, the time zone your browser reports, your light or dark mode choice, whether you confirmed your email address, and your role in each workspace.
• Workspace content: the names of your workspaces and log sources and the platform each one uses, saved searches, the people you invite, and API key names. Ingest tokens and API keys are stored only as hashes. A Railway API token or a Vercel drain secret you give us is encrypted with AES-256-GCM and is never shown again.
• Billing: your plan and the Stripe customer and subscription identifiers. Your card details go straight to Stripe and never reach our servers.
• Usage: how many log lines and bytes each source sent in each month, and how many were dropped, used to apply your plan's allowance and kept as billing records.
• Security records: for each sign-in, failed attempt, password change and signed-out session, the IP address, the approximate location derived from it (city, region, country, network provider) and the browser and device type. You can see this log in Settings.
• Emails we sent you: the address, subject, time and delivery status, so we can help when an email does not arrive.
• AI usage: when you use "Explain with AI", the masked lines and question that were sent (section 7), the model, token counts, credits and time taken.
• Support and audit: what you send us, and a record of actions our staff take on accounts (for example a suspension or plan change).

4. Why we use it, and our legal bases

Under the GDPR and UK GDPR we must have a legal basis for each use:

Where we rely on legitimate interests you can object (section 12). Where we rely on consent you can withdraw it at any time, without affecting what was done before.

5. Where the data comes from

From you (sign-up, settings, support), from your use of the service (security records, usage), from Google if you choose to sign in with Google (name, email, profile picture), from Stripe about your subscription, and from team members who invite you (your email address).

6. Log data our customers send us

We process this on behalf of our customers (section 2). A customer connects its apps in one of these ways:

• Railway: the customer gives us a Railway API token. We store it encrypted (AES-256-GCM) and use it to read the app logs and, if the customer switches it on, the HTTP request logs of the services the customer picked.
• Vercel and Netlify: the customer sets up a log drain on that platform, which sends log lines to a private address at Logyak.
• Render: the customer sets up a log stream, which sends log lines to us as syslog over TLS.
• Any app: the customer's own code sends log lines to us over HTTPS with a source token.

For each log line we store: its time and the time we received it, its level (for example info or error), its kind, the service and host it came from, the message (cut at 16 KB), for HTTP request lines the method, path, status code, duration and request id, and any other fields the line carries as attributes (cut at 8 KB). HTTP request lines from Railway, Vercel and Netlify can include the IP address and browser of the person who made the request. What else a line contains depends entirely on what the customer's app writes, which can include email addresses, user ids or other personal data.

• We use log data only to store it, show it to the customer's workspace, search it, count it against the customer's plan and, when a user asks, explain it with AI (section 7). We do not read it for our own purposes, combine it with other customers' data, or use it to train AI models.
• Our staff screens show how much each account sends, never the lines themselves.
• Each source has its own ingest token, stored only as a SHA-256 hash. The customer can rotate it at any time, and the old token stops working at once.
• Log lines are kept for the retention of the customer's plan and then deleted (section 10). Deleting a source deletes all of its lines at once.

If your personal data may be in a customer's logs and you want to exercise your rights, contact that customer. If you contact us, we will pass your request to the customer and help it respond.

7. Explain with AI

"Explain with AI" runs only when a signed-in user clicks it. Then the lines that user picked, with a few lines around them (at most 60 in all), and the user's optional question are sent to the AI provider Logyak is configured to use: OpenAI, Anthropic or Groq.

Before anything leaves our servers, we replace IP addresses, email addresses, bearer tokens, JSON web tokens, card-like numbers and secrets written as key=value (for example password=...) with placeholders such as [ip] and [email]. Client IP addresses and browser details kept as attributes are left out altogether. The masked text is what the provider receives and what our AI usage log keeps.

Masking works on patterns, so it cannot recognise every kind of personal data, for example a person's name written in a message. Customers should keep such data out of their logs where they can (Terms, "Acceptable use").

8. Who we share data with

We never sell personal data and never share it for advertising (including "sharing" as defined by California law). We use these providers (sub-processors) to run the service; each receives only what its job needs, under a written contract:

When a customer connects Railway, Vercel, Netlify or Render, those platforms are the customer's own providers: they send us the customer's logs at the customer's request, under the customer's agreement with them.

When you let another app use the API, with one of your API keys or by signing in to it, what it reads is sent to that app under its own terms: you choose to share it, as with any API client you run. We keep only hashes of its keys and tokens, and revoking access deletes them at once.

We may also disclose data when the law requires it, to protect rights and safety, or to a buyer if the business is sold (under the same protections). Our customers' log data is shared with no one except these providers.

9. International transfers

Our app and database run in Singapore and several providers are in the United States. When personal data from the European Economic Area, the United Kingdom or Switzerland goes to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum), or on the provider's certification under the EU-U.S. Data Privacy Framework where it has one, together with the safeguards described in section 11. You can ask us for a copy of the relevant safeguards.

10. How long we keep it

11. How we protect it

• Encryption in transit (HTTPS everywhere, HSTS; syslog over TLS) and at rest by our hosting provider.
• Passwords hashed with bcrypt; ingest tokens, API keys and session tokens stored only as hashes; Railway tokens and drain secrets encrypted with AES-256-GCM.
• Every request checks who you are and which workspace you may see; one workspace can never read another's log lines. Staff access is limited by role, staff screens never show log lines, and every staff action is audited.
• IP addresses, email addresses and secrets are masked before any log line goes to an AI provider.
• Short-lived sign-in tokens, stolen-session detection, rate limits on sign-in and on log intake, and a log of every sign-in you can review.
• If a personal data breach is likely to put you at risk, we will tell you and the relevant regulator as the law requires (under the GDPR, the regulator within 72 hours of becoming aware).

12. Your rights

Depending on where you live, you can:

• Access the personal data we hold about you and get a copy (GDPR Art. 15; CCPA right to know; APP 12).
• Correct it if it is wrong (Art. 16; APP 13). Most of it you can change yourself in Settings.
• Delete it (Art. 17; CCPA right to delete). Log sources, workspaces and keys can be deleted in the app; to close your whole account, email us.
• Restrict or object to processing based on legitimate interests (Art. 18 and 21), including any direct marketing, at any time.
• Receive your data in a portable, machine-readable form (Art. 20).
• Withdraw consent at any time, where we rely on it.
• Not be discriminated against for exercising your rights (CCPA).
• Complain to your data protection authority: in the EU your local authority, in the UK the Information Commissioner's Office (ico.org.uk), in Australia the Office of the Australian Information Commissioner (oaic.gov.au). We would appreciate the chance to resolve it first.

To use a right, email hello@logyak.com from the address on your account (or tell us how to verify you). An authorised agent may act for you with your signed permission. For personal data inside a customer's logs, see section 6. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

13. Cookies

Our site and app use only the cookies and browser storage needed to sign you in and remember your settings. Logyak puts nothing on the devices of our customers' end users. Statistics cookies are used only if switched on and only with your consent. The Cookie Policy lists each one.

14. Children

Logyak is a business service and not intended for anyone under 16. We do not knowingly collect personal data from children; if you believe a child has given us data, contact us and we will delete it.

15. Google user data

If you choose "Continue with Google", Logyak asks Google only for the basic sign-in scopes: openid, email and profile. Google then tells us your Google account identifier, your email address and whether Google has verified it, your name, and the address of your profile picture.

We do not ask for and cannot see anything else in your Google account: not your Gmail, contacts, calendar, Drive files or any other Google data.

• How we use it: to create your Logyak account or sign you in to it, as your account email, and to show your name and picture in the app. That is all.
• How we share it: with no one, except the providers that host our app and database (section 8) under written contracts, when the law requires it, or with a buyer if the business is sold, under the same protections.
• How we store and protect it: in our database, protected as described in section 11. Google gives us a short-lived access token during sign-in; we use it once to read the details above and then discard it. We never store Google access or refresh tokens.
• How long we keep it and how to delete it: while your account is open. To delete it, close your account or email hello@logyak.com, and we delete it within 30 days.
• How to revoke access: at any time at https://myaccount.google.com/permissions. After that, sign in to Logyak with your email and a password (set one with "Forgot password" on the sign-in page).
• We do not use Google user data for advertising, we do not sell it, and we do not use it to develop, improve or train AI or machine learning models.

Logyak's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

16. Changes to this policy

We will post any change here with a new date. If a change is significant, we will tell account holders by email or in the app before it takes effect.