Last updated: June 26, 2026
Nasca ("we", "us", "our") provides a per-user AI cost tracking and rate limiting service for software developers. Our service is accessible at nasca.dev. Questions about this policy can be directed to hello@nasca.dev.
Account information. When you sign up, we collect your email address. We use this to identify your account and send service-related communications.
Usage data. We store AI usage events submitted through the SDK on your behalf — specifically: model name, token counts, and computed cost in USD. This data is associated with your account and with anonymised end-user IDs you supply.
Monetisation data. If you configure credit packs or subscription plans, Nasca stores credit balances and subscription plan assignments for your end-users (linked to the opaque external user IDs you supply). We also record the transaction amount of credit purchases and first-month subscriptions processed through Nasca-hosted checkout to compute the 2% platform fee and update credit balances.
Stripe Connect data. When you connect your Stripe account, we store your Stripe Connect account ID and onboarding status. We use this to create checkout sessions and receive webhooks on your behalf. We do not store your bank account details or Stripe dashboard credentials.
Billing information. Your Nasca subscription is processed by Stripe. We store only your Stripe customer ID and subscription status. We never see or store raw card numbers.
Automatically collected data. Our infrastructure may log standard HTTP request metadata (IP address, user agent, timestamp) for security and debugging. These logs are retained for a maximum of 30 days.
We do not sell your personal data. We do not use your data for advertising.
We use the following sub-processors to operate our service:
Each processor handles data under their own privacy and security terms. We select processors that maintain appropriate data protection standards.
Developer-hosted payments. When your end-users purchase credit packs or subscription plans through a Nasca-hosted checkout, the payment is processed by Stripe on your connected Stripe account. You are the merchant on record. Nasca passes a 2% application fee to cover platform costs. End-user payment card details are handled solely by Stripe and are not accessible to Nasca.
We retain your account data and usage events for the duration of your account. When you delete your account — either through the dashboard Settings page or by contacting us — we immediately and permanently delete your data across all systems:
Deletion is irreversible and takes effect immediately. Financial records that applicable law requires us to retain (such as records of completed transactions) may be retained for the legally required period, but personal identifiers are removed where possible. Anonymised aggregate statistics may be retained indefinitely.
You supply Nasca with external user IDs to track spend per user. These IDs are opaque strings — Nasca does not know who your end-users are and does not collect any personal information about them such as names, email addresses, or device identifiers.
If you configure credit packs or subscription plans, your end-users may interact with a Nasca-hosted upgrade prompt page (nasca.dev/upgrade/...) displayed inside an iframe in your application. This page shows the user their current AI usage and the upgrade options you have configured. Nasca records the transaction amount of successful purchases to update the user's credit balance and compute the platform fee; it does not collect the end-user's name, email, or payment details.
You are responsible for handling your end-users' data in accordance with your own privacy policy and applicable law, including disclosing to your end-users that their AI usage is tracked and that payments are processed by Stripe.
Depending on your jurisdiction, you may have rights to access, correct, or delete personal data we hold about you, or to object to or restrict certain processing. To exercise any of these rights, email hello@nasca.dev. We will respond within 30 days.
We use industry-standard measures including encryption in transit (TLS), encrypted storage, and access controls. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security but take reasonable precautions to protect your data.
We may update this policy from time to time. We will notify you by email or via the dashboard if we make material changes. Continued use of the service after changes take effect constitutes acceptance of the updated policy.
For any privacy-related questions, please contact us at hello@nasca.dev.