1. Overview
Selora is a unified API gateway to Claude, GPT, and Kimi models, operated by Orbital Systems. This policy explains what we collect on selora.lol, in the console, and across the API; why we collect it; who we share it with; how long we keep it; and the controls you have. We do not sell your data, and we do not use your prompts or completions to train models.
2. What we collect
Account data — your email address, display name, and a hash of your password, used to operate your account and contact you about it. If you sign in with Google, we also receive the identity Google shares for that sign-in (name, email, and account identifier).
Verification data — if you activate the Nova free trial, the Telegram handle you verify and the verification's status; if you link a Discord account, its identifier. These exist to grant the once-per-person trial and to reach you on the channel you chose.
Usage telemetry — per-request model, token counts (in/out/cache), latency, cost, status, error code, and the API key used. This powers the usage charts, the cost calculator, and the verifiable ledger. It does not include the content of your requests: we do not store the body of your prompts or completions. A request body lives in memory only long enough to route the request and stream the response back to you, then it is discarded.
Billing data — your wallet balance, ledger entries, and purchase records. When you pay by card or regional wallet (for example through Wayl), the processor handles the charge and we receive only the transaction reference and amount; full card numbers never reach us. When you pay in cryptocurrency, we record the payment identifier, the rail and network, the amount, and the on-chain transaction hash — not your wallet's private keys.
Security & abuse data — IP addresses and request headers in server logs and rate limiting, and the outcome of the registration check that refuses disposable email domains. These exist to keep the service reachable for everyone and to stop automated abuse.
Local preferences — in-console preferences such as theme and reduced-motion are stored locally on your device, not on our servers.
3. How we use it
- To route, meter, and bill your API requests.
- To enforce rolling-window budgets, rate limits, and key scoping.
- To publish the gateway status and verifiable ledger entries.
- To prevent fraud and abuse, and to keep the service available.
- To show you service, billing, and security notices about your account in the console.
We process this data to perform our contract with you, and, for security and abuse prevention, on our legitimate interest in running a service that is not defrauded or knocked offline. We do not use your content to train, fine-tune, or evaluate models — ours or any upstream provider's.
4. Cookies & sessions
We use an httpOnly session cookie to keep you signed in to the console. We do not use third-party advertising or cross-site tracking cookies, and we run no third-party analytics trackers. Our CDN and TLS edge (Cloudflare) sits in front of the site and may set its own strictly necessary security cookies. Functional preferences (reduced-motion, theme) are stored locally on your device.
5. Sharing & subprocessors
We share data only as needed to operate the service, with: the upstream model providers you choose to call (your prompts and completions are forwarded to fulfill your requests, subject to each provider's own terms); our payment processors — Wayl for card and regional wallet payments, and NOWPayments for cryptocurrency payments; the cloud and edge infrastructure that hosts and accelerates the gateway, including our CDN and TLS edge; and Telegram or Discord, only to the extent you use the verification or community features that involve them. A current list of subprocessors is available on request through the contact page. We do not sell your data to anyone, and we do not share it for advertising.
6. International transfers
The gateway and its upstream model providers operate across regions, so fulfilling a request may process its content in the region the chosen provider serves. Where personal data crosses borders, we rely on the contractual safeguards our processors and providers put in place for those transfers.
7. Data retention
Account data, usage telemetry, and the ledger are kept for the life of your account. Account deletion is self-service and cascades: your wallet, ledger, and usage rows are deleted with the account. What survives deletion is deliberately narrow — a financial audit record (the account email, its plan, the balances forfeited at deletion, and a transaction count) kept so forfeited money can be accounted for and, if you re-register, restored; verification records kept to enforce the once-per-person trial; and aggregated, de-identified statistics. Security and abuse logs are kept only as long as they serve their purpose.
8. Your rights
Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data, to restrict or object to certain processing, and to withdraw consent where processing rests on it. To exercise any of these, email [email protected] or send a message through the contact page from the email on your account; we respond within the timeframe applicable law requires, and within 30 days in any case. If you are in a jurisdiction with a data-protection authority, you also have the right to complain to it.
9. Security
API keys are stored only as a SHA-256 hash and shown to you once, at creation; passwords are hashed; sessions use httpOnly cookies over TLS, and the site redirects plain HTTP to HTTPS. Every request leaves a verifiable ledger entry so you can audit usage independently. No security measure is absolute, but we design for least-privilege and defense in depth. If a breach ever affects your personal data, we will notify affected users and, where the law requires, the relevant authority.
10. Children
Selora is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has created an account, tell us through the contact page and we will delete it.
11. Changes
We will notify you of material changes by notice in the console before they take effect, and the “Last updated” date above reflects the current version. Continued use after the effective date constitutes acceptance.
12. Contact
Privacy questions and data requests: email [email protected] or send a message through the contact page, or reach us on the community channels linked there.