Legal
Privacy Policy
Last updated October 2026. This policy describes what Somnus stores and why.
Data we store about your account
Your email address, display name, a hashed password, your two-factor authentication secret, and a list of devices you have marked as trusted. We also store an encrypted copy of your Somnus API key (in Supabase Vault) plus its fingerprint and last four characters, so the desktop app can retrieve it when you sign in. We never store the key in plain text.
Payments
Payments are handled entirely by Stripe. We store the amount, date, status, and a reference for each top-up so we can show your billing history and send receipts — never your card number. Receipts and invoices are emailed to you after each top-up. When you agree to save a card, Stripe stores it for future top-ups you explicitly confirm. We store Stripe customer and payment-method references, card brand, last four digits, verification time, and a card fingerprint to prevent repeat free-credit claims. We never store your full card number or security code. Top-ups are charged only when you explicitly confirm them. Dreamcaster Enterprise plans are arranged and invoiced directly with us.
Usage data
Each request you make through the Somnus gateway is logged with the time, model, token counts, and cost, so we can show your usage history and deduct from your balance. Prompts and completions travel to the upstream model provider you selected; their own privacy policies apply to that content.
Support conversations
When you use the support chat, we store your messages and our replies so the conversation keeps its history, and the conversation is sent to an AI provider (Lovable AI Gateway) to generate answers. Please don't share passwords, API keys, or card details in chat.
Cookies and storage
We use necessary storage for sign-in and security. Campaign source, medium, name, search term and creative parameters may be saved in browser storage for up to 30 days and attached to your account at signup. When Google Ads measurement is enabled and permitted, its tag may use advertising cookies and receive page/device information, click identifiers, a signup reference and the amount and reference of a first paid top-up to measure ads and optimize campaigns. We do not send email addresses or other customer matching data to Google.
Advertising choices
Google Ads measurement and click-identifier capture are blocked in the EEA, UK, Switzerland and Canada, and when your location cannot be resolved, because Somnus currently has no advertising consent banner. Elsewhere you can refuse advertising measurement in the Advertising settings below. Refusal applies immediately and across open tabs. Blocked actions are not replayed later. Google's privacy information is available at https://business.safety.google/privacy/. If a consent banner is added later, it must record your choice, when it was made and the notice you accepted, and allow withdrawal.
Who processes your data
Supabase (authentication and database), Stripe (payments), the LiteLLM gateway host (request routing and logs), our hosting provider (the website), and the upstream AI model providers you choose to use. Data may be processed in the EU and the US depending on the provider.
How long we keep data
Account data is kept while your account is active. Usage and billing records are kept for accounting and legal requirements. You can ask us to delete your account at any time; we will remove personal data except records we must legally retain.
Your rights
You have the right to access, correct, export, or delete your personal data, and to object to or restrict processing. Email notify@somnus.world to exercise any of these. You also have the right to complain to your local data protection authority.
Security
Your API key is encrypted at rest, passwords are hashed, two-factor authentication is mandatory, and your key is only ever shown to you, never to anyone else. We never sell your data.
Contact
Data controller: Francisco Costa (Somnus), Rua Dom Lourenço de Almeida nº 5, 1º Esq, Lisbon, Portugal. Reach us at notify@somnus.world.