Legal
Privacy
Metadata is what makes metering and your dashboard work. Content is not needed for either, so it is not kept.
Last reviewed 21 August 2026
The short version
SP Cambo needs to know that you made a request, which alias and key it used, when, and how many tokens it consumed. It does not need to know what you asked. Content logging is off by default and usage logging is metadata-only.
What is stored
| Category | Examples | Why |
|---|---|---|
| Account | Name, email address, a hash of your password, account status. | To let you sign in and to attribute purchases and usage to you. |
| Orders and payments | Order records, amounts, currency, payment state, verification results. | To fulfil purchases, keep an auditable ledger, and answer billing questions. |
| API keys | A lookup hash, an encrypted recovery copy for customer-owned inference keys, a display prefix, the last four characters, scope, status. | To authenticate requests and let the signed-in owner explicitly re-copy their own inference key without exposing it in normal key lists. |
| Request metadata | Model alias, key used, timestamps, duration, token counts, settlement state, error code. | To meter accurately, show you your own activity, and diagnose failures. |
| Operational logs | Server logs with request identifiers, IP address and user agent. | Security, abuse prevention and debugging. Secrets are redacted before anything is written. |
Your activity view shows the request metadata that is retained about you. If a field is not visible there, it is not being kept.
What is not stored
- Prompt text you send to a model.
- Completion text a model returns.
- Tool call arguments and results, and file contents you attach.
- System prompts and conversation history.
- Card or bank credentials. Payment happens on the payment network, not here.
This is a design decision, not a promise about intentions. The metering path reads token counts, not text, so there is nowhere for prompt content to be persisted on the way through.
Who else sees your requests
Your request is forwarded to an upstream model provider in order to be answered, so that provider necessarily receives its content and handles it under its own policies and retention rules. SP Cambo cannot make an upstream provider forget a request on your behalf.
SP Cambo does not publish which upstream provider serves a given alias, and does not expose internal routing. If you require a specific provider's data-handling terms for a compliance review, ask the operator before you build on it — do not infer it from a model name.
Payments are processed over the Bakong payment network, which receives what it needs to settle the transaction.
How it is protected
- Passwords are hashed, never stored or transmitted in a recoverable form.
- Inference API keys use a lookup hash for authentication. Customer-owned keys also keep an encrypted recovery copy so the signed-in owner can explicitly re-copy the current secret.
- Secrets are redacted from logs and error reports.
- Privileged administrative actions are recorded in an audit trail.
- Traffic is served over TLS, and browser sessions are separate from inference credentials.
Practical consequence for you: normal key lists never contain plaintext secrets, but an authenticated browser session can explicitly request the current secret for a customer-owned inference key. Treat your account session as sensitive and sign out on shared devices. A compromised API key still cannot manage your account.
Your controls
- Revoke any API key at any time. Revocation is immediate and permanent.
- Scope keys to specific model aliases so each environment sees only what it needs.
- Review your own activity and orders in the dashboard.
- Sign out to end a browser session.
Retention and purge windows are configurable by the operator and have not been published as fixed periods. Account deletion, data export and the process for a formal data-subject request are also not published yet. Those are operator decisions, and this page will not invent a timescale it cannot guarantee.
Cookies and local storage
SP Cambo uses storage for things the site cannot work without: your session credential, your light/dark preference, and dashboard layout state such as sidebar width. There is no advertising or cross-site tracking, and no third-party analytics tag is loaded by this site.
Children
SP Cambo is a developer tool sold to adults and is not intended for children.
Not published yet
- The data controller's legal identity and address.
- Concrete retention periods per data category.
- The self-serve route for account deletion and data export.
- A privacy contact channel.
Related: terms of service and acceptable use .