Privacy & data handling

This page explains how the Caedral API handles your request data: how long prompts and responses are kept, how to disable content retention entirely, what happens on account deletion, and how language preferences are detected.

#Content retention

• By default, prompt/response content from API executions is retained for 30 days for debugging, abuse handling, and usage analytics
• Accounts can configure a shorter window between 7 and 90 days; values outside that range fall back to the 30-day default
• A scheduled cleanup job nulls expired content in batches; log rows themselves are hard-deleted later (never before 90 days), keeping billing metadata auditable
• Financial ledger records are not user content — they are anonymized rather than deleted when an account is removed

#Zero-retention mode

Zero-Retention (ZDR) mode stops content persistence at write time: once enabled for your account, new API requests record metadata only — prompt and response bodies are never written to execution logs. Content already stored before the flag was enabled is removed by the same scheduled cleanup job. Enable or adjust retention from Dashboard settings. The setting is per account: in a team, each member's own account setting governs how their requests are logged.

#Secret redaction on exports

Administrative exports of persisted content run through a redaction pass that replaces credentials and personal identifiers — Bearer tokens, API keys (including cd_live_ and sk- style keys), JWTs, AWS keys, private key blocks, database connection strings, emails, phone numbers, card numbers, and Brazilian CPF/CNPJ numbers — with [REDACTED]. The pattern set is shared with the capture-side scrubber so anything redacted at ingestion is also redacted in exports.

#Account deletion

• User content is purged outright: execution logs, usage logs, and API keys are deleted; bot system prompts are stripped while uptime rows remain
• Financial records (billing transactions and the append-only billing ledger) are retained for accounting evidence but anonymized — the customer reference is rewritten to deleted:<original-account-id>
• Deletion runs in a single transaction and fails closed: a partial purge is never left behind

#Locale detection

The caedral.com website detects your language in this order: an explicit NEXT_LOCALE cookie (set by the language switcher), then the Accept-Language header, then English as the default. IP-based geolocation is never consulted. The cookie lasts one year, is scoped to the whole site, and uses SameSite=Lax. English pages are served unprefixed (/pricing); other locales use a URL prefix (/pt-BR/pricing, /es/pricing, …).