Privacy Policy

Last updated 18 October 2026

Shotkiln is operated by SPONE FZCO, DSO-IFZA, IFZA Properties, Dubai Silicon Oasis, Dubai, United Arab Emirates ("we", "us"). For privacy questions or requests, email support@shotkiln.com.

What we process

• API keys: we store only a one-way hash of each key, a short prefix, its plan and creation time.
• Billing: payments are handled by Stripe. We receive and store your Stripe customer and subscription IDs and plan status. We never see your full card number. Stripe's privacy policy applies to the data you give Stripe.
• Render requests: URLs and HTML you submit are processed to produce the output. Outputs are cached for the time you choose (cache_ttl, default 1 hour, 7 days for OG images) and then deleted. We do not keep request logs with target URLs beyond short-lived operational logs at our infrastructure provider.
• Abuse prevention: we use a salted hash of your IP address (IPv6 grouped by /64) to enforce rate limits. The raw IP address is not stored. Counters expire after the month.
• Website analytics: cookieless, aggregate counts of page views and button clicks (path, referring site, country). No cookies, no identifiers, no IP addresses.

Processors

Cloudflare (hosting, browser rendering, storage) and Stripe (payments). Data may be processed outside your country under their safeguards.

Your rights

You can ask us to access, correct or delete your data, or object to its use, including under the UAE Personal Data Protection Law and, where it applies, the GDPR. Email support@shotkiln.com; we reply within 30 days. You can also complain to your data protection authority.

Retention

Key hashes and billing identifiers are kept while your account is active and up to 24 months after for accounting and abuse prevention, or longer where the law requires.