1. Introduction & Who We Are
ProjectSPG ("we", "us", "our") provides enterprise-grade AI security, data de-identification, and sovereign regulatory proxy services accessible via our dashboard (projectspg.info), drop-in wire-compatible APIs (api.projectspg.info), and associated SDKs.
This Privacy Policy explains how information is processed when you access our platform, use our API keys, and route LLM prompts through our sovereign gateway. For the purposes of the General Data Protection Regulation (GDPR) and international privacy laws, ProjectSPG acts primarily as a Data Processor when proxying user prompts, and as an independent Data Controller solely for basic account management data.
2. Data We Process & How It Is Handled
A. Ephemeral Inference Data (Prompts, Completions, Embeddings)
When routing traffic through /v1/chat/completions or /v1/embeddings, our engine inspects text for personally identifiable information (PII), protected health information (PHI), payment card data, and regional identifiers across 109 sovereign jurisdictions.
- Volatile Edge RAM Only: Processing occurs in isolated Cloudflare V8 worker memory.
- Zero Persistent Storage: Raw prompts and rehydration maps are purged the microsecond the HTTP streaming response terminates.
- No Model Training: Neither ProjectSPG nor our underlying upstream proxies ever use your prompts to train AI models.
B. Account & Authentication Information
When registering or logging in via Google Firebase Authentication, we store strictly necessary profile attributes in our Cloudflare D1 database:
- Firebase User ID (UID), Email Address, and Display Name.
- Organization Name and Primary Website (provided during onboarding).
- Account Tier (Free, Pro, Custom) and Subscription Expiration Timestamp.
- API Keys: Stored solely as cryptographic SHA-256 salted hashes. We cannot decrypt or read your secret keys once generated.
C. Bring Your Own Key (BYOK) Credentials
When configuring third-party credentials (Google AI Studio, Mistral AI, Groq Cloud) for unmetered BYOK inference, your keys are stored exclusively in your browser's encrypted localStorage or transmitted securely via HTTPS authorization headers. ProjectSPG never stores your provider API keys in persistent backend databases.
D. SIEM Audit Logs & Operational Telemetry
For security auditing and compliance verification, our gateway records anonymized telemetry in a short-lived circular ring buffer:
- Timestamp, Model Identifier, Token Usage, and Gateway Latency (microseconds).
- Rule IDs triggered (e.g.
RULE_EMAIL,RULE_IBAN) and one-way SHA-256 entity hashes for audit verification. - Zero Plaintext: Audit logs contain strictly mathematical proofs and never contain plaintext personal data.
3. Global Sovereign Compliance Matrix
ProjectSPG is engineered to satisfy the strictest international data residency and privacy mandates across 109 nations, including:
4. Legal Bases for Processing (GDPR Article 6)
We process data under the following recognized legal grounds:
- Performance of a Contract: Providing edge proxying, de-identification, and authentication services requested by you.
- Legitimate Interests: Protecting the security, uptime, and cryptographic integrity of our edge infrastructure against malicious injection, brute-force attacks, and abusive usage.
- Compliance with Legal Obligations: Satisfying mandatory legal and tax accounting requirements for subscription transactions.
- Consent: Where explicitly provided (e.g., customized telemetry settings via Consent Preferences).
5. Third-Party Sub-Processors & Infrastructure
To deliver zero-latency edge security, we partner with verified, enterprise-tier infrastructure providers bound by strict Data Processing Agreements (DPAs):
| Sub-Processor | Role / Function | Data Residency / Security |
|---|---|---|
| Cloudflare, Inc. | Edge Compute (Workers), D1 SQL, and CDN | ISO 27001, SOC 2 Type II, Global Anycast |
| Google Cloud / Firebase | Identity Authentication Service | OAuth 2.0, FIPS 140-2 Level 3 KMS |
| Upstream LLMs (Mistral / Google / Groq) | Inference Providers (Sanitized Prompts Only) | Receives strictly tokenized/pseudonymized payloads |
6. Your Rights & Control (GDPR / CCPA / DPDP)
Regardless of your geographic location, ProjectSPG affords you full sovereign control over your information:
- Right to Know & Access: You can review your account profile and inspect generated API keys at any time via the dashboard.
- Right to Rectification: Update organization or contact information instantly through your User Settings modal.
- Right to Erasure ("Right to be Forgotten"): Request immediate and complete purging of your account and hashed API keys by emailing priyanujboruah@outlook.com.
- Right to Restrict or Object: Configure your telemetry settings at any time via our Consent Preferences panel.
7. Data Security Measures
We employ state-of-the-art cryptographic safeguards including TLS 1.3 in transit, AES-256-GCM envelope encryption, automated KMS hardware rotation, strict CORS isolation, zero-knowledge token masking, and continuous SIEM monitoring. Our edge workers maintain no disk persistence, completely eliminating lingering data vectors.
8. Contact & Data Protection Officer
If you have questions, regulatory audit inquiries, or wish to exercise your data subject rights under GDPR, HIPAA, or DPDP, please reach out to our dedicated privacy security team: