Privacy Policy

We collect information in the following ways:

• Account information: When you create an account on Liberra, we collect your name, email address, and password (stored as a secure hash, never in plain text).
• Cloud connection: On AWS we store the ARN of your IAM Role, a non-secret identifier rather than a credential, and use it to request temporary access via AWS STS. Those tokens expire every hour and are never written to disk. On Azure we store your subscription ID and a reference to the Lighthouse delegation you approved. On Google Cloud we store your project ID. Azure and Google Cloud issue us no key at all: access happens inside your own tenant or project. On none of the three do we store access keys or secrets.
• Usage data: We collect information about how you interact with our services, including pages visited, features used, and conversation history with the AI assistant.
• Technical data: Browser type, device information, IP address, and similar technical data collected automatically when you visit our site.

• To provide and operate Liberra and its features
• To execute cloud management actions on your behalf
• To improve our services and develop new features. We do not train any AI model on your data, and we do not sell or share it for advertising.
• To communicate with you about your account or our services
• To ensure security and prevent abuse

No long-lived credential of yours is stored, on any cloud:

• AWS uses a cross-account IAM Role and STS. Azure uses a Lighthouse delegation. Google Cloud uses service account impersonation. Your long-term credentials never touch our servers
• On AWS, STS issues a temporary token that expires every hour. On Azure and Google Cloud no key is issued to us at all
• Never logged, displayed, or exposed in any output
• Used only to execute actions you explicitly request or approve
• Can be disconnected at any time from your settings

We do not sell your personal information. We may share data with:

• AI providers: Your messages and your cloud metadata are sent to Anthropic to generate responses. Anthropic deletes API inputs and outputs within 30 days, and states that retained data is never used for model training without express permission. We do not give that permission. Your cloud credentials are never sent.
• Infrastructure providers: We use third-party services for hosting (Railway) and database storage (MongoDB Atlas).
• Payments: Subscriptions are processed by Lemon Squeezy, our Merchant of Record. Your payment details go to them, not us.
• Email: We use Resend to send transactional and update emails to the address you provide.
• Sign-in: If you sign in with Google or GitHub, they share your basic profile (name, email) with us per their own policies.
• Feedback: If you submit in-app feedback, its content (including any screenshot you attach) is forwarded to our private team workspace (Discord) so we can act on it.
• Legal requirements: We may disclose information if required by law or to protect our rights.

These are every third party that receives any of your data, and what each one gets:

Your cloud credentials go to none of them, because none exist to send. Processing may take place outside India. We do not sell your personal information to anyone.

We retain your data for as long as your account is active. Deleting your account removes your conversation history, Cloud Index, connection references, audit records and settings, and any residual copies clear within 30 days. Disconnecting a cloud provider immediately removes that connection; your conversation history and Cloud Index remain until you delete your account or ask us to erase them. You can request deletion of any of your data at any time by contacting us.

Your data is stored in MongoDB Atlas in the Asia Pacific (Singapore) region, and our application runs on Railway. If either changes, this page changes with it.

Our database is encrypted at rest by our provider. On top of that we separately encrypt four things with a key of our own: your AWS External ID, any connected GitHub token, and your Terraform source and state. Your chat history and your Cloud Index are stored without that extra layer, and we would rather tell you than let you assume otherwise. Transport is TLS. No method of transmission over the internet is 100% secure.

Every database query for your data is scoped to your user ID by construction: omitting it raises an error before the query runs, and a check in our build pipeline fails if any code reaches those collections directly. One user's data cannot bleed into another user's session, queries, or AI context.

Authentication is JWT with token blacklisting on logout, plus rate limiting. Every write to your cloud is refused or paused by a guardrail layer before it executes. Our security page sets out exactly what that layer allows and refuses, with commands you can run yourself to check it.

In the event of a data breach that affects your personal information or cloud credentials, we will notify you promptly and without undue delay after becoming aware of it.

Our landing page (liberraai.com) does not use cookies or tracking. The Liberra platform uses essential cookies for authentication and session management. We do not use advertising or third-party tracking cookies.

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict processing of your data

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children.

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page with an updated date.

If you have questions about this Privacy Policy, contact us at contact@liberraai.com.

To report a security vulnerability, see our disclosure policy, which carries a safe harbour for good faith research.

Grievance contact (as required under Indian law): William, Founder: contact@liberraai.com. We acknowledge and resolve grievances within 30 days.