Privacy Policy — Stipend

Stipend, Inc. ("Stipend," "we," "us") operates the Stipend platform for AI compute allocation. This Privacy Policy describes how we collect, use, and protect information when you use our services.

Information We Collect

We collect information necessary to provide the Stipend service:

Account information: name, email address, organization, and role as provided during onboarding or synced from your organization's HRIS
Usage metadata: timestamps, model identifiers, token counts, and computed costs for each API request routed through the Stipend gateway
Organization data: team structures, budget allocations, and provider configurations set by your admin

Information We Do Not Collect

Stipend does not store, log, or inspect the content of prompts or completions that pass through our gateway. Request payloads are forwarded to your configured AI providers in real time and are not persisted by Stipend.

How We Use Information

To enforce budget and policy controls configured by your organization
To generate usage reports and cost attribution for your admin and finance teams
To provision and deprovision employee access based on HRIS events
To operate, maintain, and improve the Stipend platform
To communicate with account administrators about service updates

Data Sharing

We do not sell personal information. We share data only as follows:

With your configured AI providers as necessary to route API requests
With infrastructure providers who process data on our behalf under data processing agreements
When required by law, subpoena, or legal process

Data Retention

Usage metadata is retained for the duration of your organization's subscription plus 90 days. Account information is deleted within 30 days of account closure. Your organization's admin can configure shorter retention periods.

Security

We encrypt all data at rest (AES-256) and in transit (TLS 1.3). API credentials are encrypted with per-tenant keys. See our Security page for full details on our security practices.

Your Rights

Depending on your jurisdiction, you may have the right to access, correct, delete, or export your personal data. To exercise these rights, contact your organization's Stipend administrator or email us at privacy@stipend.dev.

International Transfers

Stipend processes data in the United States. For organizations subject to GDPR, we offer Data Processing Agreements and Standard Contractual Clauses. Contact us to request these documents.

Changes to This Policy

We may update this policy from time to time. We will notify account administrators of material changes via email at least 30 days before they take effect.

Contact

For privacy-related inquiries: privacy@stipend.dev