Substructure · Privacy & Data
Substructure privacy & data
Read from Substructure's own page on 2026-11-10. 19 statements quoted word for word; anything the page does not say is shown as unstated, never guessed. APIs.io verifies none of it.
Role
The page states nothing on this.
Data categories
category: identifying
Your email address, and the name and avatar your identity provider returns if you sign in with Google or GitHub.Read from Substructure's own page on 2026-11-10
category: financial
We store the Stripe customer and checkout identifiers, how many credits an organization has bought, and when they lapse.Read from Substructure's own page on 2026-11-10
category: behavioral
A durable event log for every session: the messages in and out, tool calls and their results, subagent runs, approval steps, and per-turn token counts.Read from Substructure's own page on 2026-11-10
category: communication
If you connect Slack, that includes messages in the channels an agent is present in, and the mentions and direct messages sent to it.Read from Substructure's own page on 2026-11-10
category: device
Ordinary server logs (request paths, timings, status codes, IP addresses), kept for debugging and abuse investigation.Read from Substructure's own page on 2026-11-10
category: other
Your model provider API keys, Slack bot tokens, and MCP OAuth tokens. These are encrypted with AES-256-GCM before they are writtenRead from Substructure's own page on 2026-11-10
Purposes
purpose: Run the service
To run the service you asked for: executing agent turns, keeping sessions durable across restarts, delivering webhooks, counting the credits you spend, and billing you.Read from Substructure's own page on 2026-11-10
purpose: Security and abuse
To keep accounts secure and investigate abuse.Read from Substructure's own page on 2026-11-10
purpose: Analytics
To understand which parts of the site lead to signups.Read from Substructure's own page on 2026-11-10
Retention
scope: Sessions and event logsperiod: 90 days
Sessions and their event logs are retained for 90 days , then removed.Read from Substructure's own page on 2026-11-10
scope: Account, organization, and billing records
Account, organization, and billing records are kept while the account is open, and afterwards only as long as we need them for tax and accounting.Read from Substructure's own page on 2026-11-10
scope: Encrypted database backups
Encrypted database backups are retained on a rolling basis, so deleted data can persist in a backup for a short period after it is gone from the live system.Read from Substructure's own page on 2026-11-10
Residency
region: United States
Data is stored in the United States.Read from Substructure's own page on 2026-11-10
International transfers
The page states nothing on this.
Subprocessors
We use a small number of providers to run the service. Each receives only what its job needs.Read from Substructure's own page on 2026-11-10
Data processing agreement
Deletion
route: Email support@substructure.ai
To have the data itself erased rather than archived, write to support@substructure.ai .Read from Substructure's own page on 2026-11-10
Data subject rights
right: Access
Write to support@substructure.ai to get a copy of what we hold about you, correct it, or have your account and its data deleted.Read from Substructure's own page on 2026-11-10
right: Deletion
Write to support@substructure.ai to get a copy of what we hold about you, correct it, or have your account and its data deleted.Read from Substructure's own page on 2026-11-10
Sale or sharing
stance: prohibited
We do not sell personal information, and we do not use the content of your agent sessions to train models.Read from Substructure's own page on 2026-11-10
Document
Download YAML · schema: API Commons Privacy & Data 0.1.0 · transcribed by claude-haiku-5-5, checked verbatim against the fetched page