Privacy Policy

Last updated: 9 August 2026

This Privacy Policy explains how Tapeout (“we”, “us”) collects, uses, and shares your information when you use the Tapeout plugin, website, hosted services, and MCP server (the “Service”).

Tapeout is the data controller for this processing. You can reach us at support@tapeout.dev.

1. Information we collect

• Account data. When you sign in through an identity provider (e.g. GitHub or Google), we receive your email address and a provider account identifier.
• Design content. To generate results, the plugin and MCP server send the prompts, board files, netlists, and related design data you choose to process to our servers and, in turn, to the model providers needed to fulfil your request.
• Usage data. We record usage events (such as the model used, token/usage counts, timestamps, and quota state) to operate plans, enforce limits, and bill correctly. No dollar amounts are exposed to the client.
• Technical data. IP address, request metadata, and diagnostic logs needed to run and secure the Service.
• What we do NOT store. If you use Bring-Your-Own-Key (BYOK), your provider API key stays on your machine; we do not persist it on our servers beyond forwarding a single request. Payment card details are handled entirely by our merchant of record and never reach us.

2. How we use your information

To provide and operate the Service; to generate design results; to authenticate you; to enforce plan limits and prevent abuse; to bill and support you; to secure, debug, and improve the Service; and to comply with law.

3. Who we share it with

• Model providers. To produce a result, your prompts and the relevant design content are sent to the large-language-model provider your request uses — for example OpenAI, Anthropic, or Google. Their handling of that data is governed by their own terms and privacy policies. If you use BYOK, the request is sent under your own provider account.
• Merchant of record. Payments and subscriptions are processed by Lemon Squeezy (Lemon Squeezy, LLC), which acts as merchant of record and receives the billing and contact data needed to sell to you and handle taxes.
• Infrastructure & identity providers. Hosting, database, and the identity provider you log in with, acting as our processors or independent controllers as applicable.
• Legal. Where required by law or to protect rights, safety, and the Service.

We do not sell your personal data or your design content, and we do not use your design content to train our own models.

4. Legal bases (GDPR)

Where the GDPR applies, we rely on: performance of our contract with you (to provide the Service and billing); our legitimate interests (to secure, debug, and improve the Service and prevent abuse); your consent where required; and compliance with legal obligations.

5. Retention

We keep account and usage data for as long as your account is active and as needed for the purposes above, then delete or anonymise it, subject to legal retention requirements. Diagnostic logs are kept for a limited period.

6. Security

API keys are stored hashed at rest; sessions are signed; and access is limited to what is needed to run the Service. No method of transmission or storage is perfectly secure, but we take reasonable measures to protect your data.

7. Your rights

Depending on your location, you may have rights to access, correct, delete, export, or restrict the processing of your personal data, and to object or withdraw consent. To exercise them, contact us at support@tapeout.dev. You may also have the right to lodge a complaint with your local data-protection authority.

8. Cookies

We use a small number of strictly-necessary cookies, chiefly a signed session cookie to keep you logged in. See our Cookie Policy for details.

9. International transfers

Your data may be processed in countries other than your own (including by the model providers and infrastructure we use). Where required, we rely on appropriate safeguards for such transfers.

10. Children

The Service is not directed to children and is intended for users aged 16 and over (or the age of digital consent in your country).

11. Changes

We may update this Policy; material changes will be posted here with a new “last updated” date.

12. Contact

Privacy questions or requests: support@tapeout.dev.