Privacy Policy

CacheVerifier is operated by Hong Kong Chongde Industrial Limited, Flat/Rm C, 12/F, Hua Chiao Commercial Centre, 678 Nathan Road, Mong Kok, Kowloon, Hong Kong ("we", "us"). This policy explains what personal data we handle when you visit cacheverifier.com, create an account, or use the API, and the choices you have.

For the account and billing data described below, we are the data controller. For the content you send us through the API (queries, answers and labels), you are the controller and we process it on your behalf as your processor — that relationship is governed by our Data Processing Addendum.

• Account data: your email address, your workspace name, a bcrypt hash of your password (we never store the password itself), and the date and version of the terms you accepted.
• Customer content: the gray-zone samples you submit — query text, candidate answer text, an optional cached query, your correctness label or feedback signals — via POST /v1/feedback, the Health Check tool, or the fine-tuning flow, and any verifier model fine-tuned from them. Text sent to POST /v1/verify is scored in memory and not stored; we keep only the verdict (score, threshold, decision), never the text.
• Billing data: your plan, payment amounts, dates and status, and the reference numbers our payment processor gives us. Card and bank details go directly to the processor; we never receive them.
• Technical data: IP address, user agent, requested URL and timestamps in our reverse-proxy logs; and, when something breaks, error reports (stack traces and request metadata — not request bodies or your query/answer text).
• Data stored in your browser: the dashboard keeps your session token, API key, a copy of your account summary, onboarding progress and dismissed notices in your browser's local storage. We set no advertising or analytics cookies and use no third-party trackers, so there is no cookie banner.

• To provide the service you signed up for — your account, the API, fine-tuning, billing and service emails such as password resets (performance of our contract with you).
• To keep the service secure and working — rate limiting, abuse prevention, fixing errors, and aggregate traffic statistics from our logs (our legitimate interest in running a reliable, secure service).
• To keep billing and accounting records the law requires (legal obligation).

Your customer content trains and evaluates only your own workspace's verifier. Every table in our database is scoped by workspace, every API request is authenticated to a single workspace, and we never use one customer's data to train or evaluate another customer's model, or pool customer data for any other purpose. We don't sell personal data, use it for advertising, or send it to third-party LLM or analytics APIs.

We use a small number of service providers (sub-processors) to run the service. Each receives only what it needs for its function and is bound by its own data processing terms:

• Alibaba Cloud — server hosting — runs our application, database and backups (United States (Virginia)).
• Cloudflare — content delivery and network security — terminates TLS and forwards requests to our servers (global edge network).
• Sentry — error tracking — technical details when something breaks; configured not to send request bodies (Germany (EU)).
• Resend — transactional email such as password resets (United States).
• Antom (Ant International) — payment processing for paid plans and top-ups (Singapore).
• OpenAI — generates synthetic adversarial training examples — only for fine-tune jobs that turn on adversarial hardening (United States).

We may also disclose data where the law requires it, or to protect our rights or users' safety. We'll update this list before adding a new sub-processor that handles customer content.

Our company is in Hong Kong; the servers that store your account and customer content are in the United States (Virginia); error reports go to Germany; and Cloudflare serves traffic from the location nearest the visitor. Using the service therefore involves transferring personal data outside your country, including outside the EU/UK. Where data-protection law requires a transfer mechanism, we rely on the Standard Contractual Clauses (and the UK Addendum) incorporated in our providers' data processing terms and in our DPA.

• Account data and customer content: while your account is open. Older inactive model versions are removed automatically.
• Verify verdict records (no text): 90 days.
• Reverse-proxy logs: up to about 60 days.
• Database backups: rolling 14 days — so after you delete your account, your data disappears from backups within 14 days.
• Billing records: when you delete your account we keep a minimal record of each completed payment and subscription (amounts, dates, processor references — no email or content) for 7 years, as Hong Kong record-keeping law requires, then delete it.

• All traffic to the API and dashboard is encrypted in transit (HTTPS/TLS), and our servers accept web traffic only from Cloudflare.
• Passwords are hashed with bcrypt; API keys are stored as one-way hashes — we can revoke a lost key, not retrieve it.
• Dashboard sessions are signed tokens that expire after 24 hours; logging out removes the token from your browser.

No system is perfectly secure. If a breach affects your personal data, we'll notify you and, where required, the relevant regulator.

Found a security issue? Email support@cacheverifier.com with "Security" in the subject. We'll acknowledge it within 3 business days; please give us a chance to fix it before you disclose it publicly. Our contact is also published at /.well-known/security.txt.

Depending on where you live (for example under the EU/UK GDPR or Hong Kong's Personal Data (Privacy) Ordinance), you can ask us to give you access to your personal data, correct it, delete it, export it in a portable format, or restrict or object to how we use it. You can delete your account and all its data yourself from the dashboard's Billing page; for anything else, email support@cacheverifier.com and we'll respond within 30 days. You also have the right to complain to your local data-protection authority, or in Hong Kong to the Office of the Privacy Commissioner for Personal Data.

If your request concerns personal data inside a customer's content (for example, you're an end user of an app that uses CacheVerifier), please contact that customer — we'll help them respond.

The service is for business and professional use and is not directed at anyone under 18. We don't knowingly collect personal data from children.

We'll post any change here and update the date above. If a change is material, we'll also email account holders before it takes effect.

Questions about this policy or a data request: support@cacheverifier.com