Privacy Policy

• Account information — name, email address, and sign-in identifiers, handled by our authentication provider (Clerk). If you sign in with Google or GitHub, we receive basic profile information from that provider.
• Billing information — handled by Stripe. Your card details go directly to Stripe and never touch our servers; we store subscription identifiers, plan, and billing status.
• Things you create — watchlists, ensembles, saved searches, alert rules, exports, and report configurations.
• Usage and security data — API and feature usage counts for metering and billing, an audit trail of account actions, and server logs (including IP address and user agent) used for security, rate limiting, and abuse prevention.
• AI assistant messages — processed by our AI subprocessor (Anthropic) to generate replies, and counted for metering. Conversations you keep are stored as workspaces in your account until you delete them (which you can do in-app at any time); they are deleted with your account, and are not used to train AI models.
• Support email — whatever you send us at support@ensemblai.com.

The analytics data the product serves (package downloads, rankings, dependency structure) is derived from public software-registry sources and is not personal data about you as a customer. Where those sources include information about package maintainers, see “Public registry data” below.

We use only two kinds of cookies: authentication session cookies (set by Clerk; strictly necessary to keep you signed in) and small preference cookies (for example your selected ecosystem and theme). No advertising cookies, no third-party analytics, no cross-site tracking — which is why there is no cookie banner.

• To provide and operate the Service, including your saved configurations and alerts.
• To meter usage, bill subscriptions and overages, and show you your own usage.
• To secure the Service: authentication, rate limiting, abuse and fraud prevention, and audit trails.
• To communicate about the Service — transactional and account email only; no marketing email without your consent.
• To improve the Service using aggregate, de-identified usage patterns.
• We do not use your personal data or your content to train AI models.

We share personal information only with the service providers below, who process it on our instructions, and where required by law (in which case we’ll notify you unless legally barred). We never sell it.

• Account data and your content are kept while your account is active.
• Deleting your account deactivates it immediately. To have your personal data fully deleted, email support@ensemblai.com from your account address — we complete verified deletion requests within 30 days.
• We retain what the law requires after deletion: billing and tax records (kept up to 7 years, primarily within Stripe) and minimal records needed to handle disputes or enforce our terms.
• Server and security logs rotate on a short schedule; encrypted database backups expire on a rolling schedule measured in weeks. The customer-facing audit trail shows up to 90 days of account actions.

Wherever you are, you can ask us to access, export, correct, or delete your personal information by emailing support@ensemblai.com from your account email (that’s how we verify it’s you). We respond within 30 days and don’t discriminate for exercising rights. Residents of California, the EU/UK, and similar jurisdictions may have specific statutory rights (access, portability, correction, deletion, objection); we honor these requests regardless of jurisdiction. We do not sell or share personal information as those terms are defined in the California Consumer Privacy Act.

Traffic is encrypted in transit (TLS) and data is encrypted at rest. API keys are stored only as one-way hashes, never in plaintext. Customer data is isolated per account with database row-level security, and production secrets live in a managed secret store with access controls and rotation. No system is perfectly secure, but if a breach affects your personal information we will notify you as required by law.

The Service is hosted in the United States (Google Cloud, us-central1). If you use it from elsewhere, your information is transferred to and processed in the U.S.

The analytics we serve are built from publicly available software-registry and repository metadata (PyPI, the npm registry, GitHub), which can include information about package maintainers — such as usernames, public profile details, and organization affiliations — as published by those sources. We collect only what is publicly available without authentication or circumvention of access controls. If you are a maintainer and would like your information suppressed from our product, email support@ensemblai.com and we will action it within 30 days. Corrections to the source data itself belong with the registry that publishes it.

The Service is a business analytics tool, not directed to children under 16, and we don’t knowingly collect their data.

We’ll post updates to this policy here with a new effective date and will email account holders about material changes. Questions and requests: support@ensemblai.com.