Legal
Privacy
Last updated: October 7, 2026
What this policy covers
This policy explains how Zencode Consulting Inc. (“Zencode,” “we,” “us”) handles personal information when you use Hydracept, including hydracept.com, the Hydracept API, documentation, Studio, and related services (the “Service”).
Information we collect
We collect information you provide when you create or use an account, such as your name, email address, organization and project details, and support messages. We also process API requests, prompts and files you submit, generated output, job metadata, usage and billing records, diagnostic logs, and configuration data needed to operate the Service.
If you connect a provider credential through BYOK, we store that credential encrypted so Hydracept can use it for the project and environment you authorize. We do not expose the plaintext credential in public discovery or receipts.
How we use information
We use information to provide and secure the Service, execute and support requested capabilities, maintain accounts and plan limits, quote and reconcile charges, prevent abuse, troubleshoot problems, communicate about the Service, and comply with legal obligations.
The public website offers optional Google Analytics 4 measurement for visits, referrers, and popular pages. Analytics does not load unless you explicitly accept it. If you decline, Hydracept does not load the Google Analytics script for that page visit.
If you accept analytics on the public website, Hydracept also records first-party signup attribution to understand how people find us. That can include the referrer host, the landing page path, standard utm_* campaign values, an optional Hydracept src tag on our links, and whether common ad click identifiers were present in the landing URL (for example gclid, fbclid, msclkid, twclid, li_fat_id, ttclid, wbraid, or gbraid). We store presence flags only, not the click-id values themselves.
When you follow a link to Studio or the API from the marketing site after accepting analytics, Hydracept may set an HttpOnly cookie named hydracept_signup_attribution on app.hydracept.com (30-day lifetime) so the attribution handoff can complete if you sign up. This cookie is separate from the consent-mirror cookie on .hydracept.com.
When you sign up or connect a project from the Hydracept CLI, SDK, MCP server, or Cursor plugin, we record only the client type and version (for example cli or plugin with a semver), regardless of your public-site analytics choice. We also record how you signed in (for example GitHub or Google browser OAuth, or an agent identity flow). Client and sign-in signals are separate from consent-gated web attribution.
Signup attribution is used to notify Hydracept operators about new signups (including a per-signup source line in email) and to show aggregated signup summaries to authorized Hydracept admins. It is not used for ads. It is kept for as long as your account exists. To object to web attribution, withdraw analytics consent in analytics preferences, or email support@hydracept.com to request deletion.
Your analytics preference is stored locally in your browser where local storage is available under the key hydracept_analytics_consent, and mirrored in a first-party cookie on .hydracept.com so Studio can honor the same choice. After you accept analytics, first-party signup attribution may also be written to local storage keys hydracept_first_touch_v1 and hydracept_last_touch_v1 in that browser.
AI providers and other service providers
We share information with service providers that help us host, operate, secure, and support Hydracept, including Stripe for billing when you purchase a paid plan or managed credit. When a capability uses an external AI or infrastructure provider, Hydracept sends that provider the Inputs and execution information required to perform the requested work. For BYOK, the connected provider also processes information under your direct provider relationship. For managed inference, the provider used for the accepted job or quote may process the submitted material under its applicable service terms and privacy commitments.
We may also disclose information when required by law or when reasonably necessary to protect the Service, our users, or others. We do not sell personal information to advertisers.
Children
The Service is intended for adults and organizations whose authorized users are adults. It is not directed to children under 13, and you should not knowingly submit personal information about a child under 13 through the Service unless you have a lawful basis and the Service has expressly been configured for that use.
Retention and security
We retain information for as long as needed to provide the Service, meet legal obligations, resolve disputes, and enforce our agreements. Job-history and artifact retention can vary by plan, capability, and project configuration. You should retain your own copies of important outputs. We use reasonable administrative, technical, and organizational measures to protect information, but no internet service can guarantee absolute security.
Your choices
You can update account information, remove provider credentials, manage project configuration, and choose whether the public website loads optional analytics where those controls are available. You can revisit the analytics choice for this browser at any time using analytics preferences. To request access, correction, deletion, or information about your personal information, contact us at support@hydracept.com. We may need to verify your request and may retain information where the law permits or requires it.
Changes and contact
We may update this policy as the Service changes. We will post the updated version here and revise the date above. Questions about this policy can be sent to support@hydracept.com.