Privacy PolicyPrivacy Policy

FullsendAI is operated by Molly AI Inc., a Delaware corporation doing business as FullsendAI (“FullsendAI,” “we,” “us”). This Privacy Policy explains what personal information we collect when you use our website, API, web chat, desktop app and command-line tool (together, the “Services”), how we use and share it, how long we keep it, and the choices and rights you have.

We are the controller of the personal information described here. It does not cover the third-party tools you connect to FullsendAI (such as coding agents and editors), which have their own privacy terms.

Information you give us.

• Account details: your name, email address and password (stored only as a secure hash), or, if you sign in with Google or GitHub, the name, email address and account identifier they share with us.
• Billing details: an optional company name, billing address and tax ID. Card payments are handled by Stripe; we keep only the card's brand and last four digits. Cryptocurrency payments are handled by NOWPayments; we keep the payment's identifier, amount and currency.
• Phone number, if you verify one. It is checked through Twilio. When you close your account we delete it and keep only a one-way hash, to stop the same number from claiming a sign-up offer twice.
• The email addresses of people you invite to your team, and anything you send us when you contact support.

Your content.

• API requests and responses are processed to deliver the response. We do not store their content unless you turn on body storage for a project; then each call's request and response are kept for 30 days so you can debug from the Logs page.
• Web chat conversations and the files you attach are saved to your account so you can return to them, until you delete them.
• Voice input uses your browser's own speech recognition. Your browser's maker (Google in Chrome, Apple in Safari) handles the audio under its own terms, and it never reaches us; only the text you choose to send does.
• When you use web search in the chat, your search query is sent to a search provider, and the pages it finds are fetched by our servers to answer you.
• A chat you share by link can be read by anyone who has the link, until you stop sharing it.

Information collected automatically.

• For each API or chat call: the time, model, token counts, cost, latency, status and any error, plus the calling app's user agent and IP address. Not the prompt or the reply.
• For each sign-in session: its IP address and browser user agent, so you can see and end your sessions.
• Security events, such as automated detection of attempts to misuse the Services or to extract how our models are configured. We record that the event happened, not your conversation.
• Cookies that keep you signed in. We do not use advertising or third-party analytics cookies (see section 8).

Desktop app and command-line tool. Both keep your API keys and settings on your own computer. They contact FullsendAI to work, the desktop app checks fullsendai.com for updates and the command-line tool checks the npm registry for new versions. A diagnostics report is only sent if you choose to send one, and it never contains your keys or prompts.

We use personal information to:

• provide, operate and maintain the Services, including routing requests to the models you choose and keeping them available;
• create and secure your account, including two-step sign-in, session management and API key controls;
• process payments, keep billing and tax records, and prevent fraud and abuse of offers;
• detect, investigate and stop security incidents, misuse and violations of our Terms;
• send service messages (receipts, security notices, balance and plan updates) and, if you keep them on, optional notifications, each of which you can turn off;
• answer support requests;
• understand and improve the Services using usage records, such as which features and models are used, never the content of your prompts or replies; and
• comply with law and enforce our agreements.

We do not use your prompts, replies or files to train or tune any model, ours or anyone else's. We do not sell your personal information, and we do not use it for targeted advertising.

Where data protection law requires a legal basis, we rely on: performing our contract with you (to provide the Services and process payments); our legitimate interests (security, fraud prevention, keeping the Services reliable and improving them), balanced against your rights; your consent (for optional notifications, which you can withdraw at any time); and legal obligations (such as keeping tax and payment records).

We share personal information only as follows:

• Service providers that process it on our behalf and under contract: cloud hosting and storage providers in the United States (including Cloudflare for file storage and network services); AI model infrastructure providers in the United States, which receive prompts only to generate the response; Stripe and NOWPayments for payments; Mailgun for email; Twilio for phone verification; and a web search provider, through RapidAPI, for chat searches.
• Sign-in providers, Google or GitHub, when you choose to sign in with them.
• Your team. If you belong to a team, its owner and admins can see the team's usage, keys and stored request bodies for the projects open to them.
• Legal and safety reasons: to comply with law, a court order or other legal process; to protect the rights, property or safety of FullsendAI, our users or the public; and to enforce our Terms.
• Business transfers: in a merger, acquisition, financing or sale of assets, under this Policy's protections.
• With your consent or at your direction.

FullsendAI is based in the United States, and the Services, including every model, run on infrastructure in the United States. If you use the Services from elsewhere, your information is transferred to and processed in the United States. Where the law of the European Economic Area, the United Kingdom or Switzerland applies, we rely on safeguards such as the European Commission's Standard Contractual Clauses.

• Stored API request and response bodies: 30 days, then deleted automatically. Turning body storage off stops new calls from being stored.
• Web chats: until you delete them. A deleted chat leaves your list at once and is erased, with its files, within a day. Files uploaded but never sent are deleted after a day.
• Account details: while your account is open.
• When you close your account: your chats, files, shared links, stored bodies, sign-in methods and sessions are deleted, and your name, email address, phone number and billing details are erased. Your API keys stop working at once. We keep payment and transaction records, and usage records without your name, email or any content, for as long as tax and accounting law requires.
• Security and abuse records: as long as needed to protect the Services and resolve disputes.
• Database backups roll over on a regular schedule, so deleted information leaves them within a limited period.

We use only the cookies the Services need: a session cookie that keeps you signed in, and a small marker that tells our pages you are signed in. Your display preferences, such as the theme, are kept in your browser's local storage. We do not use advertising cookies, third-party analytics or cross-site tracking. Because the cookies we use are necessary, blocking them will sign you out.

We protect information with encryption in transit (TLS), hashed passwords and API keys (we never store a key in a form that can be read back), encryption of sensitive credentials at rest, optional two-step sign-in, per-key limits and access controls on our systems. No system is perfectly secure; if a breach affects your personal information, we will notify you as the law requires.

• Access and portability: download everything we hold about you and your account as one file from your account settings.
• Correction: update your details in your account settings, or ask us.
• Deletion: delete chats at any time, and close your account from your account settings (section 7 describes what happens).
• Emails: turn optional notifications off in your notification settings or with the link at the bottom of each one. Service messages, such as receipts and security notices, can't be turned off while your account is open.

Depending on where you live, you may also have the right to object to or restrict our processing, to withdraw consent, and to lodge a complaint with your data protection authority. Residents of California and other US states with privacy laws have the right to know, access, correct and delete their personal information, and not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising, and we do not use sensitive personal information to infer characteristics about you.

To exercise a right, email [email protected] from the address on your account. We may need to verify your identity before acting, and we will respond within the time the law requires. You may use an authorized agent where the law allows.

The Services are only for people aged 18 or over. We do not knowingly collect personal information from anyone under 18. If you believe a minor has given us personal information, contact us and we will delete it.

We may update this Policy as the Services change. We will post the new version here with a new date, and for material changes we will also notify you by email or in the Services before they take effect.

Questions or requests about privacy: [email protected], or by mail:

Molly AI Inc.
8 The Green, Suite 100
Dover, DE 19901-3618
United States