Privacy Policy

1. Introduction

Zuplo, Inc. ("the Company," "we," "us," or "our") develops and runs a config-as-code API gateway for teams creating products with large language model (LLM) APIs and Model Context Protocol (MCP) servers. The Company runs gozuplo.org (the "Site") and the Zuplo developer platform, together called the "Service."

This Privacy Policy describes information collected through the Service, its uses, the parties receiving it, and your available choices. It covers information gathered through the Service and through direct communications with the Company.

The Company is located at 10500 NE 8th Street, Suite 1400, Bellevue, WA 98004; contact [email protected].

2. Information We Collect

2.1 Information You Provide

Information you provide directly includes:

• Contact details (name, work email, phone number) when registering for a developer account, completing a form, or requesting platform access;
• Company and project context (employer name, role, API use case) you elect to provide during signup or in a support request;
• The contents of messages you send to us.

2.2 Information Collected Automatically

gozuplo.org automatically gathers limited technical details when you visit:

• IP address and approximate city or region;
• Browser, operating system, and device class;
• Visited pages, referring URLs, page time;
• Cookies, similar identifiers (see Section 5).

2.3 Gateway Traffic Data

When you deploy a Zuplo gateway project, API request metadata passes through the Company's routing layer. For every gateway-processed request, the Company records:

• Endpoint path and HTTP method;
• HTTP status code and latency;
• Request time and approximate country or region of origin;
• For LLM-proxied routes: model identifier, provider, and separate prompt and completion token counts;
• The associated API key identifier as a hashed or truncated reference, never as the raw key value.

By default, the Company does not record LLM request or response payloads or MCP tool-call arguments. You may explicitly enable request-body logging in your project settings, and you control that setting. If enabled, payloads are stored in your project account and follow the Section 6 retention schedule.

2.4 We Do Not Knowingly Collect Children's Data

gozuplo.org is a developer platform not intended for children under 13. We do not knowingly collect children's personal information. If you believe a child submitted information, contact [email protected] and we will delete it.

3. How We Use Information

Collected information is used to:

• Answer inquiries and supply requested information;
• Run, maintain, and enhance the Service;
• Apply rate limits, API key authentication, and token budget policies specified in your gateway configuration;
• Produce per-project usage reports and latency analytics shown in your developer console;
• Identify and stop abuse, credential misuse, rate-limit evasion, and unusual traffic patterns that may impact platform stability;
• Send service updates, security notices, and product communications, with consent where required;
• Meet legal obligations.

We do not sell personal information for monetary value. If state law classifies certain advertising arrangements as a "sale" or "share," consult the section for your state below.

4. Sharing of Information

Personal information is shared with:

• Service providers, including cloud hosting, email delivery, and analytics, under contractual confidentiality terms;
• Authorities when required by law or to protect rights, safety, or property;
• A successor entity after a merger, acquisition, or asset sale, subject to this Policy.

We do not sell personal information to third parties.

5. Cookies and Tracking

Cookies and similar technologies operate the site, remember preferences, and measure usage. For details and choices, see our Cookie Policy.

6. Data Retention

Information is kept only as long as necessary for the stated purposes, legal and accounting duties, and dispute resolution:

• API request log metadata: 30-day rolling basis, then aggregated monthly stats kept 24 months;
• API key audit events (issuance, revocation, rotation): retained 12 months;
• Account/project config data: life of account + 90 days after closure, then deleted;
• Marketing-list contacts: 24 months of inactivity, then purged;
• Site access logs: 90 days then aggregated.

7. Security

We use administrative, technical, and physical safeguards, including TLS encryption in transit, restricted-access databases, and least-privilege access controls, to protect personal information. No system is perfectly secure; absolute security is not guaranteed.

8. Your General Rights

Rights may vary by jurisdiction and can include access, correction, deletion, and limits on certain processing. Send requests to [email protected]. We will reply within the period applicable law requires.

9. Washington Residents

Washington does not currently have a comprehensive consumer privacy statute. As a matter of policy, we extend the following baseline rights to all U.S. residents regardless of state of residence.

9.1 Baseline Rights

• Right to Know: request the categories of personal information we have collected about you.
• Right to Delete: request deletion of personal information you have provided.
• Right to Correct: request correction of inaccurate personal information.
• Right to Opt Out of Marketing: unsubscribe from marketing emails or opt out via the link in each marketing message.

9.2 How to Exercise

Email [email protected] with a description of your request and enough detail for us to verify your identity. We respond within 45 days.

9.3 Sector-Specific Rights

If you are protected by federal sector laws (for example, HIPAA, GLBA, FERPA), those laws may give you additional rights with respect to data covered by them.

9.4 California Visitors

If you are a California resident visiting from another state, you may also exercise the rights granted under the California Consumer Privacy Act ("CCPA") and California Privacy Rights Act ("CPRA"), including the right to know, the right to delete, the right to correct, and the right to opt out of sale or sharing. We do not sell personal information and do not "share" personal information for cross-context behavioral advertising.

To submit a CCPA/CPRA request, email [email protected] with the subject line "California Privacy Request."

10. Changes to This Policy

This Policy may be revised periodically. Material revisions will appear with a new "Last updated" date and, when appropriate, a notice on the Service.

11. Contact

Send questions, requests, or complaints to: