1. Introduction

Ohita ("we", "our", "us") provides a unified API that connects AI agents to multiple external services. This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data.

2. Data We Collect

Account information: When you sign up, we collect your email address and a hashed password. We do not store plaintext passwords.

API credentials (BYOK): If you bring your own provider keys (e.g., Reddit, X/Twitter, Slack, Brave), we encrypt them at rest using AES-256 and store them securely. These credentials are only used to authenticate requests on your behalf.

API usage data: We log API request metadata — endpoint called, timestamp, response status, and latency — to enforce rate limits, generate usage analytics on your dashboard, and improve service reliability. Request and response bodies are not logged.

Payment information: Payments are processed through third-party providers. We do not store credit card numbers or full payment details on our servers.

3. How We Use Your Data

• To authenticate and authorize your API requests
• To enforce rate limits and usage quotas for your plan
• To display usage statistics on your dashboard
• To send service-related communications (e.g., plan changes, outages)
• To improve and maintain the Ohita platform

We do not sell your personal data to third parties. We do not use your data for advertising purposes.

4. Data Sharing

We only share your data in the following circumstances:

• With external providers: When you make an API call through Ohita, we forward the necessary request data to the target provider (e.g., GitHub, Hacker News). Only the data required for the API call is transmitted.
• With payment processors: To process subscription payments.
• When required by law: If compelled by a valid legal process.

5. Data Retention

API logs are retained according to your plan tier: 7 days for Pro and 30 days for Scale plans. Free-tier accounts do not have persistent API logs. Account data is retained while your account is active. You may request deletion of your account and associated data at any time by contacting support.

6. Security

We take reasonable measures to protect your data, including:

• Encryption of stored credentials (AES-256)
• Hashed passwords (bcrypt)
• HTTPS for all API traffic
• Rate limiting and circuit breakers to prevent abuse

7. Cookies & Analytics

We use Google Analytics to understand how visitors interact with our website. Google Analytics uses cookies to collect anonymized usage data. You can opt out by disabling cookies in your browser or using a browser extension such as the Google Analytics Opt-out Add-on.

8. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and data
• Export your data in a portable format

To exercise any of these rights, contact us at support@ohita.tech.

9. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email or a notice on our website. Continued use of Ohita after changes constitutes acceptance of the updated policy.

10. Contact

If you have questions about this privacy policy or our data practices, reach out at support@ohita.tech.