Skip to content
Theyfetch

Privacy posture

You are the controller of workspace data. Theyfetch is the processor. The legal policy is on Privacy. A DPA is available on request.

  • No IPs kept. The address is used to match a published operator list, then discarded.
  • No full user agents. We keep the matched bot token and purpose, not the raw string.
  • Only AI traffic. Human browsers and unknown crawlers are dropped at ingest. Request bodies are never logged.
  • Prompt runs. Answer text, citations, search queries, model, surface and cost stay on the workspace so you can audit an answer.
  • Subprocessors. Cloudflare (app and D1), Tinybird (citation analytics, EU), Resend (email), Stripe (billing). Provider APIs run the prompts you configure.