# FourIA Privacy Policy

**Effective Date:** 2026-05-24  
**Last Updated:** 2026-05-24

## Overview

FourIA is a multi-tenant OpenClaw gateway management platform running on Cloudflare Workers. This policy describes what data we collect, how we use it, and what we do **not** collect.

## Data We Collect

### Operational Metrics (via OpenTelemetry diagnostics-otel plugin)

We collect the following **aggregated metrics only** from each tenant's OpenClaw gateway instance:

| Metric                       | Purpose                                       | Retention                  |
| ---------------------------- | --------------------------------------------- | -------------------------- |
| `openclaw.cost.usd`          | AI provider cost tracking per workflow        | 90 days (D1)               |
| `openclaw.tokens.input`      | Input token counts per request                | 90 days (D1)               |
| `openclaw.tokens.output`     | Output token counts per request               | 90 days (D1)               |
| `openclaw.exec.duration_ms`  | Container execution time                      | 90 days (D1)               |
| `openclaw.memory.rss_bytes`  | Peak memory usage per workflow                | 90 days (D1)               |
| `openclaw.message.received`  | Inbound message events (channel, no content)  | 90 days (D1)               |
| `openclaw.message.processed` | Outbound message events (channel, no content) | 90 days (D1)               |
| `container-active`           | Container heartbeat (instance type only)      | 90 days (Analytics Engine) |
| `r2-operation`               | R2 storage operations (op type, byte count)   | 90 days (Analytics Engine) |
| `cron-trigger`               | Scheduled job triggers                        | 90 days (Analytics Engine) |
| `ws-session`                 | WebSocket session duration and message count  | 90 days (Analytics Engine) |

### Metadata Collected Per Metric

- **Channel type** (e.g., `telegram`, `discord`, `webhook`) — used for cost allocation
- **Customer identifier** — the `WORKER_NAME` or `customer_id` for per-tenant billing
- **Model name** (e.g., `claude-sonnet-4-5-20250929`) — used for model cost tracking
- **Provider name** (e.g., `anthropic`, `openai`) — used for provider cost tracking
- **Timestamps** — for time-based queries and aggregation

## Data We Do NOT Collect

The following are **never** collected, stored, or transmitted:

- **Message content** — no prompts, responses, or tool outputs
- **Conversation transcripts** — no chat logs or session history
- **API keys or secrets** — keys stay in the Worker environment
- **Authentication tokens** — only JWT email addresses for access control
- **Personal conversations** — metadata only (channel type, timestamp)
- **Analytics content** — `diagnostics.otel.captureContent.enabled` is set to `false`
- **Browser history** — CDP access is auth-gated and audit-logged
- **File contents** — knowledge base and skill files remain local to the container

## Data Storage

| Storage                     | Data                                    | Encryption                                                                  |
| --------------------------- | --------------------------------------- | --------------------------------------------------------------------------- |
| Cloudflare D1               | Aggregated workflow costs, raw metrics  | At-rest encryption (Cloudflare managed)                                     |
| Cloudflare Analytics Engine | Real-time metric data points            | Cloudflare managed                                                          |
| Cloudflare R2               | Container snapshots (state persistence) | **Client-side AES-256-GCM** (F4E1, per-tenant key) + server-side encryption |
| Cloudflare Workers Secrets  | API keys, tokens                        | Encrypted at rest, never logged                                             |

## Backup Encryption at Rest

R2 backup snapshots (`backups/*/data.sqsh`) and config versions (`configs/*.json`) are encrypted **client-side by the Worker** before upload, using chunked AES-256-GCM (F4E1 format) with per-object keys derived via HKDF from the `BACKUP_ENCRYPTION_KEY` Worker secret. The key is never written to R2, never passed to the container, and never logged. As a result, anyone with read access to the R2 bucket (including Cloudflare account administrators) sees only ciphertext.

**Transient plaintext windows:** the Sandbox SDK uploads/restores snapshots via presigned URLs, so plaintext exists briefly (a) between snapshot upload and post-encryption (seconds per backup cycle) and (b) during a restore, after which the transient plaintext is deleted. Set `BACKUP_ENCRYPTION_REQUIRED=true` to make backups fail closed when no key is configured.

Backups created before encryption was enabled remain plaintext and stay restorable (legacy mode).

## Data Retention

- **D1 tables**: 90-day default retention; older records are purged via scheduled cleanup
- **Analytics Engine**: 90-day rolling window
- **R2 snapshots**: Retained until manually deleted

## Third-Party Services

FourIA routes AI requests through **Cloudflare AI Gateway**, which adds its own privacy and caching layer. Refer to [Cloudflare's Privacy Policy](https://www.cloudflare.com/privacypolicy/) for details on AI Gateway data handling.

## Data Access

- Tenant administrators can view their own cost data via the `/api/admin/costs/v2/*` endpoints
- Platform administrators (ROOT role) can view all tenant data
- No external API access to metrics data is provided

## Changes to This Policy

Changes will be tracked in this repository with commit history. Material changes will be communicated to affected tenants via their OpenClaw agent's `fouria-privacy-policy` skill.

## Contact

For privacy-related questions, contact: privacy@paso4.io