Privacy Policy

Effective October 30, 2026.

Meldport is operated by its owner as an individual. For privacy requests, contact privacy@meldport.com.

Data we collect

We process the details needed to run your account and the features you use. This can include your email address, name, Google account ID and profile image if you choose Google sign-in; project names and API-key labels, scopes and status; model and route IDs, request time, status, token or media usage, quoted and settled amounts, and provider cost; payment references and status; security and audit events; and messages you send to support. We do not store application diagnostic logs in the application database, and ordinary application logs do not store prompt or completion bodies. Saved chat and generation content is described below.

Cookies and local storage

Meldport uses essential browser storage for sign-in sessions, cross-site request protection, the temporary Google sign-in flow, and your theme choice. Access cookies last up to 15 minutes, refresh cookies up to 30 days, cross-site request tokens up to one hour, and Google sign-in state up to 10 minutes. The theme cookie lasts up to one year, and the browser also stores the theme choice locally. The application does not load third-party advertising or visitor analytics scripts.

How we use data

We use data to authenticate users, deliver requests, calculate charges, prevent abuse, reconcile payments, support customers, improve reliability, and meet legal obligations. The required signup agreement records your consent for email product updates, feature announcements, offers, and promotions. Account, security, billing, maintenance, and other service notices are sent to operate your account. Meldport does not sell account information or give your email address to another company for that company's marketing.

Service providers and international processing

Depending on the feature, we use Google for sign-in, Resend or SendPulse for email delivery, payment services for methods such as QRIS, Midtrans card, or OxaPay, Cloudflare R2 for private media storage, Runware for media generation, and model or routing providers such as InferHub for some chat requests. The selected provider receives the data needed for its part of the request. These providers may process data outside Indonesia. Their available regions and retention terms depend on the service and account configuration; we do not claim a specific processing region where it has not been verified.

Our email delivery provider receives the email address, delivery details, and message needed to send account notices and, where you have agreed, product announcements and promotions. It processes that data for Meldport to deliver the message. It does not receive your model prompts for this purpose.

When you send a model request, the selected model provider and any routing service needed to reach it receive the prompt, conversation context, and attachments required to provide the response. Some chat routes use InferHub. Its published Privacy Policy (last updated June 17, 2026) says it logs the model, token counts, calculated cost, HTTP status, request time, and caller region. After certain unexplained upstream security-policy errors, it may retain the system prompt, tool definitions, and request parameters for up to 7 days; it says messages, tool results, file contents, and attachments are not retained in those cases. If its safety screen flags a request, it says it keeps matching-rule metadata for 90 days and the messages and system prompt read by that screen for 14 days. Tool results, file contents, and attachments are excluded from that screening and retention. InferHub says retained text is restricted to review of the specific event and is not used to train models. These are InferHub's published practices and may change; they are separate from Meldport application logs.

Image, video, and audio generation requests are sent to Runware with the prompt, supplied input media, selected model, and options needed to complete the task. Runware's published retention guidance says generated media is normally stored on its servers for seven days. Its API also supports a task-details request that can return the original request and response for a task ID. The public documentation does not state how long those task details remain available. Meldport does not use that task-details request during normal generation, and we have not verified an account-specific retention setting for it. Runware describes Zero Data Retention as an enterprise organization option. We have not verified that it is enabled for Meldport, so do not assume that Runware discards request content immediately after a task. See Runware's task-details documentation and Zero Data Retention documentation.

Retention and security

Meldport keeps media-job prompts and options, input and generated assets, and the provider output reference for up to eight days after a result is ready. At expiry, the prompt and options are redacted and the stored assets are deleted. An upload that is not attached to a completed job expires after 15 minutes. Closing an account removes active access immediately and queues remaining media for deletion after any job or billing reconciliation is complete.

Saved Web Chat history is kept for up to 100 threads per project and 100 messages per thread. A thread expires after 30 days without activity. This saved history is separate from ordinary application logs, which do not store prompt or completion bodies.

For email announcements and promotions, we store whether you agreed, the consent version and time, and when you last changed the preference. We use this record to send email according to your choice and to show when consent was given or withdrawn. You can turn off promotional email in Account settings. We retain the minimum consent record needed to honor that choice and handle legal claims.

Usage, wallet, payment, provider-cost, dispute, and administrator audit records are kept for billing, reconciliation, security, dispute handling, and legal obligations. These records do not have an automatic deletion period in the current service. Operational application and access logs are kept outside the application database and rotated by the hosting environment. Backups may retain deleted records for up to 14 days on the host and 31 days off the host before the backup expires.

If a personal data incident occurs, we will notify affected people and the relevant authority where required by applicable law. We use access controls, protected credential storage, audit trails, and data minimization, but no system is risk-free.

Your choices

You can update account details, revoke API keys, request an export, or request closure from the dashboard. For access, correction, deletion, restriction, objection, withdrawal of consent, or other privacy requests, contact privacy@meldport.com. We will verify the request before acting.