FourIA Privacy Policy

Effective Date: 2026-05-24
Last Updated: 2026-05-24

Overview

FourIA is a multi-tenant OpenClaw gateway management platform running on Cloudflare Workers. This policy describes what data we collect, how we use it, and what we do not collect.

Data We Collect

Operational Metrics (via OpenTelemetry diagnostics-otel plugin)

We collect the following aggregated metrics only from each tenant’s OpenClaw gateway instance:

Metric	Purpose	Retention
openclaw.cost.usd	AI provider cost tracking per workflow	90 days (D1)
openclaw.tokens.input	Input token counts per request	90 days (D1)
openclaw.tokens.output	Output token counts per request	90 days (D1)
openclaw.exec.duration_ms	Container execution time	90 days (D1)
openclaw.memory.rss_bytes	Peak memory usage per workflow	90 days (D1)
openclaw.message.received	Inbound message events (channel, no content)	90 days (D1)
openclaw.message.processed	Outbound message events (channel, no content)	90 days (D1)
container-active	Container heartbeat (instance type only)	90 days (Analytics Engine)
r2-operation	R2 storage operations (op type, byte count)	90 days (Analytics Engine)
cron-trigger	Scheduled job triggers	90 days (Analytics Engine)
ws-session	WebSocket session duration and message count	90 days (Analytics Engine)

Metadata Collected Per Metric

• Channel type (e.g., telegram, discord, webhook) — used for cost allocation
• Customer identifier — the WORKER_NAME or customer_id for per-tenant billing
• Model name (e.g., claude-sonnet-4-5-20250929) — used for model cost tracking
• Provider name (e.g., anthropic, openai) — used for provider cost tracking
• Timestamps — for time-based queries and aggregation

Data We Do NOT Collect

The following are never collected, stored, or transmitted:

• Message content — no prompts, responses, or tool outputs
• Conversation transcripts — no chat logs or session history
• API keys or secrets — keys stay in the Worker environment
• Authentication tokens — only JWT email addresses for access control
• Personal conversations — metadata only (channel type, timestamp)
• Analytics content — diagnostics.otel.captureContent.enabled is set to false
• Browser history — CDP access is auth-gated and audit-logged
• File contents — knowledge base and skill files remain local to the container

Data Storage

Storage	Data	Encryption
Cloudflare D1	Aggregated workflow costs, raw metrics	At-rest encryption (Cloudflare managed)
Cloudflare Analytics Engine	Real-time metric data points	Cloudflare managed
Cloudflare R2	Container snapshots (state persistence)	Client-side AES-256-GCM (F4E1, per-tenant key) + server-side encryption
Cloudflare Workers Secrets	API keys, tokens	Encrypted at rest, never logged

Backup Encryption at Rest

R2 backup snapshots (backups/*/data.sqsh) and config versions (configs/*.json) are encrypted client-side by the Worker before upload, using chunked AES-256-GCM (F4E1 format) with per-object keys derived via HKDF from the BACKUP_ENCRYPTION_KEY Worker secret. The key is never written to R2, never passed to the container, and never logged. As a result, anyone with read access to the R2 bucket (including Cloudflare account administrators) sees only ciphertext.

Transient plaintext windows: the Sandbox SDK uploads/restores snapshots via presigned URLs, so plaintext exists briefly (a) between snapshot upload and post-encryption (seconds per backup cycle) and (b) during a restore, after which the transient plaintext is deleted. Set BACKUP_ENCRYPTION_REQUIRED=true to make backups fail closed when no key is configured.

Backups created before encryption was enabled remain plaintext and stay restorable (legacy mode).

Data Retention

• D1 tables: 90-day default retention; older records are purged via scheduled cleanup
• Analytics Engine: 90-day rolling window
• R2 snapshots: Retained until manually deleted

Third-Party Services

FourIA routes AI requests through Cloudflare AI Gateway, which adds its own privacy and caching layer. Refer to Cloudflare’s Privacy Policy for details on AI Gateway data handling.

Data Access

• Tenant administrators can view their own cost data via the /api/admin/costs/v2/* endpoints
• Platform administrators (ROOT role) can view all tenant data
• No external API access to metrics data is provided

Changes to This Policy

Changes will be tracked in this repository with commit history. Material changes will be communicated to affected tenants via their OpenClaw agent’s fouria-privacy-policy skill.

Contact

For privacy-related questions, contact: privacy@paso4.io