Privacy Policy

When you use Last Price we may collect the following categories of information:

• Account data: email address, name, and workspace settings you provide when you sign up or update your profile.
• API request metadata: tenant ID, function name, routing strategy, input / output unit counts, compute duration, and the HTTP response status of each inference call. Raw pricing payloads are not persistently stored beyond what is required for billing and audit.
• Usage and billing data: metered unit totals, credit balance movements, marketplace revenue records, and webhook delivery logs.
• Log and diagnostic data: server-side request logs, error traces, and performance telemetry used to operate and improve the platform.
• Access counts: daily counts of API and MCP requests by route or tool, response status, the public prefix of the API key used (never the full key), workspace and agent ID, the MCP client name and version your client reports, the MCP protocol version, a one-way hash of the MCP session ID, the User-Agent, and the country derived from the request. For failed API authentication we also record why it failed. For requests we cannot tie to a workspace we keep less: only the product name at the start of the User-Agent and, for MCP clients, a recognized client name without its version. We never store full API keys, tokens, request bodies, IP addresses, or email addresses in these counts.
• Analytics: we use Vercel Analytics (privacy-focused, cookie-free by default) to understand aggregate usage patterns. No advertising trackers are used.
• Product analytics and session replay: we use PostHog, hosted in the EU, to see which pages you open and what you click, and to record how pages look as you use them so we can find where the product is confusing or broken. It sets a first-party cookie and local storage identifier, for visitors and signed-in people alike. When you are signed in, this is linked to your account and email. Everything you type into a form, and API keys or secrets shown on screen, are masked in recordings. We also use it to turn new features on gradually.

Tenant API keys are encrypted at rest using AES-256-GCM. All data in transit is protected by HTTPS / TLS. Tenant- and workspace-scoped API routes verify the caller and check workspace membership on every request; a small number of intentionally public endpoints (e.g., the health check and the published OpenAPI specification) do not require authentication.

The commerce control-plane is in beta: connector account credentials are currently persisted as JSON without application-layer encryption, and adding envelope encryption for those records is tracked work prior to general availability. Do not connect production commerce credentials until that work lands.