Privacy Policy

Last Updated: January 12, 2026

This Privacy Policy describes how FAR Oracle ("we", "us", or "our") collects, uses, and protects information when you use our Federal Acquisition Regulation semantic search API and related services.

1. Information We Collect

1.1 Usage Analytics (Anonymous)

When you use the FAR Clause Finder demo or API, we collect anonymous usage analytics:

Query Metadata: Query length, timestamp, response time
Technical Data: IP address (hashed), user agent, referrer
Geolocation: City and country (derived from IP, then IP is hashed)
NOT Collected: Full query text, search results, personal identifiers

            🔒 Privacy Protection: We do NOT store your full query text. Only metadata 
            (length, timestamp) is logged for analytics. Your IP address is immediately hashed using SHA-256 
            before storage, making it impossible to identify individual users.
        

1.2 Account Information (API Users)

If you register for API access, we collect:

Agent ID: Your chosen identifier for API authentication
Email Address: Optional, required only for billing/upgrades
Company Name: Optional, for billing purposes
API Keys: Cryptographically secure tokens for authentication
Usage Data: Query count, subscription tier, billing status

1.3 Payment Information

Payment processing is handled by Stripe. We do not store your credit card information. Stripe's privacy policy applies: https://stripe.com/privacy

2. How We Use Your Information

Purpose	Data Used	Legal Basis
Provide search service	Query metadata, API keys	Contract performance
Improve service quality	Anonymous usage analytics	Legitimate interest
Billing and payments	Email, usage data, Stripe customer ID	Contract performance
Fraud prevention	Hashed IP, rate limiting data	Legitimate interest
Customer support	Email, agent ID, usage history	Contract performance

3. Data Storage and Security

3.1 Storage Location

API Data: Hosted on Railway (US region)
Database: PostgreSQL with encrypted connections
Backups: Automated daily backups, encrypted at rest

3.2 Security Measures

API keys stored as SHA-256 hashes (irreversible)
IP addresses hashed before storage (anonymization)
TLS/SSL encryption for all API communications
Rate limiting to prevent abuse
Regular security audits and updates

3.3 Data Retention

Usage Analytics: Retained for 90 days, then aggregated
Account Data: Retained while account is active + 30 days after deletion
Billing Records: Retained for 7 years (legal requirement)

4. Your Rights (GDPR & CCPA)

If you are a user in the EU, UK, or California, you have the following rights:

4.1 Right to Access

Request a copy of your personal data. Use the GET /v1/account endpoint or contact us.

4.2 Right to Rectification

Update your email or company name via PATCH /v1/account endpoint.

4.3 Right to Erasure ("Right to be Forgotten")

Request deletion of your account and all associated data. Contact us at the email below.

4.4 Right to Data Portability

Receive your data in a machine-readable format (JSON). Available via API or on request.

4.5 Right to Opt-Out

Opt out of anonymous analytics by adding ?analytics=false to the demo URL, or contact us to disable analytics for your API key.

5. Cookies and Tracking

5.1 Session Storage (Not Cookies)

The FAR Clause Finder demo uses sessionStorage (not cookies) to temporarily store your API key. This data is automatically cleared when you close the browser tab.

5.2 No Third-Party Tracking

We do NOT use Google Analytics, Facebook Pixel, or any third-party tracking scripts. All analytics are first-party and anonymous.

6. Third-Party Services

We use the following third-party services:

Service	Purpose	Privacy Policy
Stripe	Payment processing	stripe.com/privacy
Railway	API hosting	railway.app/legal/privacy
GitHub Pages	Demo hosting	GitHub Privacy
ip-api.com	Geolocation (city/country only)	ip-api.com/docs/legal

7. Children's Privacy

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us immediately.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last Updated" date. Continued use of our services after changes constitutes acceptance of the updated policy.

9. Contact Us

Data Protection Inquiries

For questions about this Privacy Policy, data access requests, or to exercise your rights:

Email: privacy@far-oracle.com
API Documentation: API Docs
GitHub: Report Issues

We will respond to all requests within 30 days as required by GDPR.

10. Legal Disclaimer

FAR Oracle provides access to Federal Acquisition Regulations data sourced from acquisition.gov (Public Domain). The information provided is for informational purposes only and does not constitute legal advice. Always verify citations with official sources.