Privacy Policy

Effective as of 31 October 2026

Spend Brake (“Spend Brake,” “I,” “me,” or “we”) is a proxy that enforces spend caps on paid APIs. It is operated by Kristiyan Ivanov, an individual (“the operator”). This Privacy Policy describes how I process personal information collected through the website at spendbrake.dev, the hosted service at app.spendbrake.dev and its proxy endpoints, the brake command-line tool when it talks to the hosted service, and emails I send (collectively, the “Service”).

The Service is intended for businesses and developers. When an organization (“org”) on the Service invites you as a team member, or routes its applications and agents through its account, that org decides what is sent through the proxy. If you have concerns about information an org processes through Spend Brake, please direct them to that org first.

Self-hosted installs. If you run Spend Brake on your own servers, the software stores everything described below on your infrastructure, not mine. It does not report usage, telemetry or account data to me; license files are verified offline. Only the following reach anything outside your install: price checks fetch public provider price pages; the optional signed catalog feed downloads price bundles from the feed URL you configure; and any alert, email, OpenTelemetry or webhook destinations you set up receive what you send them. This policy therefore applies to self-hosted installs only to the extent you contact me, buy a license, or use the website.

Personal Information I Collect

Information you provide

• Account data: the email address you sign up with, the name you give your org or project, your role in the org (owner, admin or viewer), and the email addresses of people you invite. Emails are stored lower-case so sign-in can find them. Sign-in uses one-time emailed links, so there is no password; instead the Service stores hashed sign-in and API tokens.
• Provider credentials: the API keys you store for providers such as Google Maps Platform, Twilio, Mapbox, HERE, Tavily, Exa, Brave or SerpApi. They are encrypted at rest with envelope encryption under a master key, decrypted in memory only to forward your requests, and never written to logs or traces.
• Configuration: your Spend Brake keys, caps, environments, agent and session labels, loop rules, IP allowlists you set on keys, alert thresholds, and the destinations you configure for alerts and telemetry (webhook URLs, Slack, Discord or Teams webhooks, alert email addresses, OpenTelemetry endpoints and headers). Webhook URLs and OpenTelemetry headers are stored encrypted.
• Payment data. If you buy a plan or a license, your payment information (card number, billing address and related details) is collected and processed directly by my payment processor, Stripe. I do not receive or store your full card number. I receive limited data from Stripe such as your Stripe customer id, plan, subscription and invoice status, and may see the card type and last four digits, billing name and address in Stripe's dashboard for support and accounting. See Stripe's Privacy Policy.
• Communications data from our exchanges, such as when you email me for support.

Information collected when requests go through the proxy

For every call made with one of your Spend Brake keys, the Service records a usage event containing:

• timestamp, org, key, environment, agent and session labels;
• provider, route and SKU(s) the request was priced as;
• worst-case and actual cost in micro-dollars, whether the route was underpriced, and the outcome (allowed, blocked, loop detected, upstream error);
• the provider's HTTP status and latency;
• the caller's trace context (traceparent), user agent, and request and response sizes in bytes;
• a one-way hash of the request used to detect identical repeated calls; it cannot be turned back into the request.

What is never stored: request bodies, response bodies, query strings, the places, addresses or messages your requests were about, and the provider's responses. Responses are streamed through to your application and not cached. The dashboard, the ledger, Prometheus metrics and OpenTelemetry spans are all built from the metadata above.

Automatic data collection

• Server logs. The proxy and admin API write request logs containing the HTTP method, the URL with secret query parameters redacted, the client IP address as seen by the proxy (behind the HTTPS front, the forwarded address), status code and timing. Credential headers are censored before anything is written. Logs are kept for 14 days.
• IP addresses are also used transiently to rate-limit sign-in and admin endpoints, and are compared against an IP allowlist if you set one on a key. They are not part of usage events.
• Audit log. Changes to caps, keys, credentials, team members and kill switches are recorded with who made them and when, so your org can see what happened.
• This website (spendbrake.dev) is static. It sets no cookies, loads no third-party scripts and runs no analytics. Vercel, which serves it, keeps its own request logs (including IP addresses) under Vercel's Privacy Policy.
• The dashboard (app.spendbrake.dev) keeps your sign-in token in your browser's local or session storage so you stay signed in. It uses no tracking cookies and no analytics.
• Email. Transactional emails (sign-in links, invitations, alerts, license files, receipts) are sent through Resend. I do not embed tracking pixels, and I do not use open or click tracking.

How I Use Personal Information

Service delivery and operations

• Provide, operate and maintain the Service, including pricing and forwarding your requests and enforcing your caps;
• Create and manage your account and team, and send sign-in links and invitations;
• Process payments through Stripe and send related information such as receipts and license files;
• Send the alerts you configure (thresholds, kills, loops, price changes, upstream key errors) to the destinations you choose;
• Enforce plan limits, detect loops and runaway spend, and keep the Service secure;
• Communicate with you about the Service: security notices, changes to these policies, support and administrative messages;
• Respond to your requests, questions and feedback.

Compliance and protection

• Comply with applicable laws, lawful requests and legal process;
• Protect my, your or others' rights, privacy, safety or property, including by making and defending legal claims;
• Enforce the Terms of Service;
• Prevent, identify, investigate and deter fraudulent, harmful, unauthorized or illegal activity, including abuse of the proxy or of the providers behind it.

I do not use your data to train models, to build advertising profiles, or for marketing to third parties.

How I Share Personal Information

I do not sell personal information. I share it only as follows:

• API providers. Every request you send through the proxy is forwarded to the provider you addressed (for example Google Maps Platform) with your own provider key, exactly as your application sent it. The provider's processing is governed by your agreement with them, not by this policy.
• Service providers that work on my behalf and may process personal information only to provide their service to me:

  Provider	Purpose	What they see
  Stripe	Payments, subscriptions, invoices	Billing details, email, plan
  Resend	Transactional email	Recipient email, message content (sign-in links, alerts, invitations, licenses)
  DigitalOcean	Hosting the hosted service, its database and cache	All data stored by the Service, on their infrastructure
  Vercel	Hosting this website	Web request logs for spendbrake.dev

• Destinations you configure. Alerts, webhooks, emails and OpenTelemetry spans go to the Slack, Discord, Teams, webhook, email or OTLP endpoints you set up. What those recipients do with the data is up to them and you.
• Your org. Owners and admins of an org can see the org's team members, keys, configuration, usage events and audit log.
• Professional advisors, such as an accountant or lawyer, where necessary in the course of their services to me.
• Authorities and others, where I believe in good faith it is necessary to comply with applicable law or to protect the rights, privacy, safety or property of myself or others.
• A successor operator. If I transfer Spend Brake to a company I form or to another operator, or if the Service is otherwise sold or merged, personal information may be transferred to the successor, who will be bound by this policy until it is changed with notice to you.

Data Retention

• Usage events are deleted automatically after your plan's retention period: 7 days on Free and Indie, 30 days on Team, 365 days on Agents. The cleanup job runs every six hours.
• Account, team, keys and configuration are kept while your account exists. Removed team members are marked removed and can no longer sign in, but their entry is kept so the audit log still names who did what.
• Provider credentials are deleted when you remove them or delete the org.
• Payment records at Stripe and in my accounting are kept as long as tax and accounting law requires.
• Server logs: 14 days. Database backups: 14 days; deleted data may persist in backups until they rotate.

When I no longer need personal information, I delete or anonymize it. To delete your account and its data, email me (see below).

Security

Provider keys, webhook URLs and telemetry headers are encrypted at rest; the real provider key is decrypted only in the proxy's memory and never logged. Secrets are stripped from log lines and traces. Traffic to and from the Service uses HTTPS. The database and cache are reachable only from the Service's own containers. Still, security risk is inherent in all internet and information technologies, and I cannot guarantee the security of your personal information.

International Data Transfers

I am based in Bulgaria. The hosted service runs in DigitalOcean's Frankfurt, Germany (FRA1) region. Stripe, Resend and Vercel are United States companies and may process data in the United States and elsewhere. Your personal information may therefore be transferred to countries whose privacy laws are not as protective as those where you live.

If you are located in the European Economic Area, the United Kingdom or Switzerland, I will ensure that any transfer of your personal information is carried out in accordance with applicable data protection law, including by relying on standard contractual clauses approved by the European Commission or other appropriate safeguards offered by the service providers above.

Information for European Users (GDPR)

If you are located in the EEA, the United Kingdom or Switzerland, the following additional provisions apply.

Data controller. Kristiyan Ivanov, a self-employed individual registered in Bulgaria (BULSTAT 180490275), is the controller for account, billing and website data. For data an org sends through the proxy on behalf of its own users, the org is the controller and I act as its processor under the Terms of Service.

Legal bases for processing.

• Performance of a contract: processing needed to provide the Service to you under the Terms of Service, including usage events, caps and billing.
• Legitimate interests: operating, securing and improving the Service, preventing abuse, and communicating with you, where those interests are not overridden by your rights.
• Compliance with legal obligations: for example keeping payment records.
• Consent: where you have given it for a specific purpose. You may withdraw consent at any time by contacting me.

Your rights under GDPR. In addition to the rights below, you may lodge a complaint with your local data protection supervisory authority if you believe my processing of your personal information violates applicable law.

Your Rights and Choices

Regardless of where you are located, you may:

• Access the personal information I hold about you;
• Update or correct inaccurate personal information;
• Delete your personal information, including your account;
• Export your personal information in a portable format;
• Object to or restrict certain processing of your personal information.

Much of this you can do yourself in the dashboard: see and delete keys, credentials and team members, and export usage events through the admin API. For anything else, email kristiyan@spendbrake.dev. I will respond in accordance with applicable law and within a reasonable time.

Emails. I send service emails only: sign-in links, invitations, the alerts you configured, receipts and notices about the Service or these policies. You can change or remove alert destinations in the dashboard. I do not currently run a marketing list; if I start one, it will be opt-in with an unsubscribe link in every message.

Cookies and tracking. This website sets no cookies. The dashboard uses your browser's local or session storage only to keep you signed in; clearing it signs you out. There are no third-party trackers, so there is nothing to opt out of, and “Do Not Track” signals change nothing because nothing is tracked.

Declining to provide information. I need certain information, such as an email address and a provider key, to provide the Service. If you do not provide it, I may not be able to provide the Service to you.

Other Sites and Services

The Service links to and forwards requests to services operated by third parties, including the API providers whose keys you store, Stripe, and the alert destinations you configure. These links and integrations are not an endorsement of, or a representation that I am affiliated with, any third party. I do not control those services and am not responsible for their actions. Please read their privacy policies.

Children

The Service is not intended for anyone under 16 years of age, and I do not knowingly collect personal information from children under 16. If you believe a child has provided me with personal information, please contact me and I will delete it as the law requires.

Changes to This Privacy Policy

I may modify this Privacy Policy at any time. If I make material changes, I will notify you by updating the date at the top, posting the new version on the website and, where the change affects account holders, emailing the address on your account. Changes take effect when posted unless stated otherwise. Your use of the Service after the effective date of a modified policy means you accept it.

How to Contact Me

• Email: kristiyan@spendbrake.dev
• Operator: Kristiyan Ivanov, zh.k. Hadzhi Dimitar 16, entrance B, floor 1, apt. 13, Poduyane district, 1510 Sofia, Bulgaria