Scope and processing roles
This policy covers the Quota Monitor website, dashboard, API, MCP, and background monitoring. Erdeni, an individual trading as QuotaMonitor Studio, operates the service worldwide. Contact details appear in Section 9.
We are responsible for personal information in our account administration, security, and operational activities as applicable. An organization may determine the purposes of processing in its managed workspace; we act under its authorization, with responsibilities determined by law and relevant data-processing agreements.
Connected providers, authorized clients, and transaction services such as Waffo may independently process information under their own policies. We cannot control all their independent processing.
Information we process
- Accounts and authentication
- Name or display name, email, verification status, account timestamps, and code or password verification information for your chosen authentication method, used for registration, login, verification, and access protection.
- Sessions and security
- Sessions, IP addresses, browser request information, timestamps, and necessary error, rate-limit, and security records. Some rate-limit identifiers are hashed; this does not mean all session IP addresses are anonymized.
- Workspaces and projects
- Names, member permissions, descriptions, environment or owner labels, provider project/key identifiers, budgets, and thresholds to organize monitoring and enforce your configuration and permissions.
- Connections and credentials
- Provider types, connection names, encrypted API keys or AK/SK, necessary account/team identifiers, credential suffixes, and verification status for authentication, signing, deduplication, verification, and rotation.
- Monitoring results
- Amounts, costs, remaining budgets, currency, observation times, connection status, alerts, eligible services, and validity details for monitoring, history, and failure reporting.
- API and MCP authorization
- Clients, workspaces, scopes, token-verification information, expiry, and authorization records to grant and revoke access and investigate anomalies.
- Subscriptions and transactions
- Plans, billing periods, entitlement periods and sources, plus order/subscription identifiers and transaction status needed for delivery, billing support, and refunds when you transact.
- Contact and requests
- Emails, descriptions, attachments, privacy requests, and handling records that you submit, used to answer and resolve them.
- Product usage analytics
- When analytics is enabled, we record registration, connection creation, sync outcomes, quota and pricing views, checkout, and verified payment events to understand activation, purchasing, and feature failures. Events use internal account identifiers, necessary workspace or project identifiers, event times, provider type, plan, billing interval, language, and broad error categories. Emails, names, credentials, quota amounts, page addresses, and form contents are not sent to the analytics service.
Balance monitoring does not read prompts or generated model content and does not invoke model inference. Information you send to support or enter in descriptions may be received. Never include complete credentials, verification codes, payment card numbers, or unrelated personal information in names, descriptions, screenshots, or attachments.
Purposes and grounds
Information is used for requested account, monitoring, and integration features; security; troubleshooting; support, subscription, and transaction handling; and applicable legal duties such as record retention. Using monitoring does not automatically authorize unrelated processing.
Where permitted by applicable law, processing necessary for accounts and monitoring is based on entering into or performing the service relationship. Required retention and disclosures rely on the relevant legal obligation. Optional processing requiring consent is explained and consent obtained separately, including any separately required consent rather than general terms acceptance.
If your organization determines workspace processing purposes, also review its privacy notice. Data received by an AI or MCP client you authorize is subject to that client's policies, your settings, and applicable law.
How credentials are handled
Google or Apple sign-in provides a verified account identifier, email and any name you authorize. Apple authorization codes are exchanged and verified on the server. Refresh tokens are separately encrypted for revocation after account deletion and removed when revocation succeeds. Older authorizations without a usable token can be renewed or revoked in Apple settings as instructed in the app; this does not prevent an account-deletion request.
When you submit credentials through the secure form, the browser and receiving service briefly process plaintext. Credentials are stored on the server with AES-256-GCM encryption. Sync services decrypt them when needed to authenticate or sign selected-provider requests. Some signing integrations use the secret only to compute signatures on the server.
Saved complete credentials are not returned through ordinary read APIs to browsers, API clients, or MCP clients and are not needed by payment or email services. We use workspace access controls, encryption, and sensitive-field redaction. The hosting service can decrypt credentials for synchronization; this is not end-to-end encryption that prevents the operator from decrypting them.
Use dedicated, minimally privileged credentials as described in the guides. Some integrations require privileged management tokens; our query-only use does not change their actual permissions. Rotate or delete connections as needed, but deletion here does not revoke provider-side credentials. Revoke them at the provider if exposure is suspected.
Retention, deletion, and international processing
Information is retained for the shortest period necessary to provide services, maintain security, meet legal duties, and resolve disputes. Factors include purpose, active accounts and connections, request status, statutory retention, and dispute periods. Canceling a subscription is not a request to delete all data.
- Accounts, projects, and monitoring
- Support configuration, authorization, and history during service. Archiving projects or removing project connections retains configuration and history. Verified deletion or closure requests are handled with explanations of any legally required retention.
- Provider credentials
- Stored encrypted while a connection exists. After removing project references and deleting the connection, credential fields are cleared from the business database. Necessary non-credential information remains for history.
- Sessions, codes, and temporary tokens
- Managed according to validity periods and security requirements. Expiry does not necessarily mean immediate record deletion.
- Security, request, and transaction records
- Retained as needed for investigation, request handling, law, and disputes. Legally retained records have restricted use and access and are addressed when the retention reason ends.
- Processing after account deletion
- The account, private monitoring data and access credentials are removed from the active business database when deletion completes. Shared workspaces remain with other members; the successor is shown before confirmation. Necessary payment references, amounts and dates remain for accounting. Apple revocation and PostHog event erasure retry in the background; analytics cleanup can take several days. Only the minimum information needed for those jobs remains until completion is confirmed.
- Backups and recovery
- Business-database deletion does not immediately physically erase every older backup. Backup and legal-retention limits are explained for individual requests; instant removal of every copy cannot be promised.
Cloud infrastructure, third-party services, selected providers, and clients may process data outside your country or region. International transfers and access may occur; we do not promise storage exclusively in one country. Required notices, consent, or other safeguards follow applicable law. Contact the operator for recipients, processing locations, and retention relevant to your features.
Choices and rights requests
In the app, open Account → Delete account to verify your identity, review the impact and confirm permanent deletion without first contacting support. Deletion ends account access through the web, app, API and MCP. We first confirm cancellation of QuotaMonitor renewal and pending plan changes. Unused paid access ends on deletion; refund rights remain governed by the terms. This does not close AI-provider accounts or cancel their charges.
You can adjust monitoring, rotate or delete connections, and manage client authorizations. Contact us to request access, correction, copying/export, deletion, account closure, or withdrawal of authorization.
Requests are verified and handled under applicable law with proportionate identity and authority checks. We explain results and information legally retained. Never submit complete provider keys, codes, or payment card numbers. Organization requests must respect other members and the organization's lawful interests; ordinary members cannot request deletion of the entire organization's data.
Consent-based processing can be withdrawn under applicable law. Dependent features may stop, but earlier lawful processing remains unaffected. Ending future access does not mean third parties have deleted received data.
Cancellation and account closure are separate. Tell us about active subscriptions or unresolved transactions; see Terms Section 7. If dissatisfied, you may contact us further or complain lawfully to competent data-protection, consumer-protection, or other authorities.
Minors, security incidents, and updates
The service is intended for users legally able to manage provider accounts and authorize processing, not directed at children. Minors may use it where law permits and necessary guardian consent is obtained. Contact us about suspected processing without required authorization. This statement does not itself cause collection of identity documents or birth dates.
For security incidents affecting personal information, we investigate, take reasonable remedial measures, and notify relevant individuals or authorities as required by law.
The version and effective date appear here. Material changes are communicated through appropriate channels, with new consent obtained where required. Contact us about processing, rights requests, or this policy:
- Effective date
- Version
- 2026-10-20
- Operator
- Erdeni (individual)
- Operating name
- QuotaMonitor Studio
- Service area
- Worldwide
- Support and privacy contact
- support@quotamonitor.com