Absorb.dev LLC ("Absorb", "we", "us") collects little personal data: what you send us, what our servers log, and what we need to license and support our software. This policy explains what we collect through absorb.dev (the "Site"), our sales and support channels, and our licensing, and how we use it.
1. Who we are
Absorb.dev LLC is the controller of the personal data described here. Contact: [email protected].
2. Absorb software is self-hosted
Absorb runs in your infrastructure. We do not receive your API traffic, agent requests, tool responses, audit logs, credentials, or policy files. That data stays with you unless you choose to send it to us, for example in a support request. When a customer sends us personal data for support, we process it as a processor under our Data Processing Addendum.
3. Data we collect
| Source | Data | Purpose | Legal basis (EU/UK) |
|---|---|---|---|
| Contact and demo requests | Name, work email, company, role, message | Respond, arrange demos and evaluations | Legitimate interests; steps before a contract |
| Community license requests | Name, work email, organization, record of terms accepted | Issue and renew the free license, sign-in links | Contract |
| Online purchases | Name, work email, organization, customer and subscription identifiers, add-ons chosen, billing status from Dodo Payments | Issue licenses, renewal reminders, account access | Contract; legal obligation |
| Customer accounts and Order Forms | Signatory and billing contact names, emails, phone numbers, billing address | Contracting, invoicing, notices | Contract; legal obligation |
| Licensing | License holder organization, contact, edition, licensed API count, license identifiers, usage reports you send us | Issue and verify licenses, renewals, compliance | Contract; legitimate interests |
| Support | Contact details and any logs, configuration, or screenshots you send | Resolve support requests | Contract; legitimate interests |
| Server and security logs | IP address, user agent, requested URL, referrer, timestamps | Deliver the Site, prevent abuse, security | Legitimate interests |
| Email correspondence | Content and metadata of emails with us | Communicate, keep business records | Legitimate interests; legal obligation |
We never receive card or bank details. Dodo Payments, our merchant of record, collects them at checkout as an independent controller under its own privacy notice. We do not collect sensitive personal data, and we ask you not to send it. The Site does not use advertising or cross-site tracking. See our Cookie Notice for details.
4. How we use data
We use personal data only for the purposes in Section 3, to protect our rights and security, and to comply with law. We do not sell personal data, share it for cross-context behavioral advertising, or use it to train AI models. We send marketing emails only to business contacts who have engaged with us, and you can opt out at any time.
5. Sharing
We share personal data only with:
- Service providers acting on our instructions, listed on our Subprocessors page.
- Dodo Payments, which processes online payments, taxes, and invoices as merchant of record.
- Professional advisers, such as lawyers, accountants, and auditors, under confidentiality duties.
- Authorities, when required by law or to protect rights, safety, and security.
- A successor, in a merger, acquisition, or sale of assets, under this policy's protections.
6. International transfers
We are based in the United States, and our providers may process data in other countries. For transfers from the EEA, UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses, the UK Addendum, or another lawful transfer mechanism.
7. Retention
| Data | Retention |
|---|---|
| Contact requests with no resulting contract | 24 months after last contact |
| Contract, billing, and license records | Term of the agreement plus 7 years |
| Support requests and attachments | 24 months after closure, attachments deleted within 90 days of closure |
| Server and security logs | Up to 90 days, longer if needed to investigate an incident |
8. Security
We use access controls, encryption in transit, least-privilege access, and vendor review to protect personal data. No system is fully secure. We will notify affected people and authorities of a personal data breach where the law requires.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict, or port your personal data, to object to processing, and to withdraw consent. EU and UK residents may complain to their data protection authority. To exercise a right, email [email protected]. We will verify your request and respond within the time the law requires, usually 30 days, and at most 45 days.
10. U.S. state privacy rights
Residents of California and other states with privacy laws may request access to, correction of, and deletion of their personal data, and may use an authorized agent. We do not sell or share personal data as those laws define the terms, and we do not use sensitive personal information. We will not discriminate against you for using your rights.
11. Children
The Site and our software are for businesses. We do not knowingly collect personal data from anyone under 18.
12. Changes
We will post any update here with a new effective date. For material changes, we will also notify customers by email.
13. Contact
Absorb.dev LLC, [email protected]