Data Collection

OpenDunes is built for the Algerian market and operates under Law 18-07 — Algeria's data protection law. This page describes exactly what the platform records, what it does not, and the protections in place.

What OpenDunes Logs#

For every API request, OpenDunes records:

• Request metadata: timestamp, model slug, API key identifier (hashed — not the raw key), HTTP status code, response time.
• Token counts: prompt_tokens, completion_tokens, total_tokens — used for billing.
• Cost: the DA amount charged for the request, stored in micro-DA (bigint).
• Request ID: a UUID-v7 trace identifier returned in the X-Request-Id response header.

This metadata powers your usage dashboard, billing ledger, and support tracing.

What OpenDunes Does NOT Log by Default#

• Prompt content: the text of your messages array is not stored in OpenDunes' database.
• Response content: the model's output text is not retained.
• Images or files: vision inputs passed via message content parts are forwarded to the upstream model and are not persisted.

The prompt and response pass through in memory during the request lifecycle and are then discarded.

PII Redaction Pipeline#

Before any request is forwarded upstream, it passes through an active PII redaction stage. The following patterns are detected and replaced with placeholders:

Redaction is applied before the payload reaches any external system, including the upstream AI provider. Downstream, the model sees [REDACTED] tokens in place of the original values.

Note. Redaction is best-effort pattern matching. Do not rely on it as your sole control for handling sensitive data — design your application to avoid sending PII in prompts where possible.

Audit Trails#

OpenDunes maintains an append-only audit log for:

• API key creation, rotation, and revocation.
• Deposit and credit transactions.
• Account settings changes.

These records are retained for the minimum period required by Law 18-07 and are available to account owners via the dashboard and, on request, via the API.

Data Residency#

All data — request metadata, billing records, audit logs — is stored and processed within infrastructure subject to Algerian jurisdiction. OpenDunes does not replicate your data to regions outside Algeria's legal framework without your explicit consent.

Law 18-07 Compliance#

Law 18-07 (relative to the protection of natural persons in the processing of personal data) governs how OpenDunes handles any data that could identify an individual. Key obligations honored:

• Minimisation: only metadata necessary for billing and support is retained.
• Purpose limitation: logged data is used only for billing, abuse prevention, and support — not for model training.
• Right of access: account holders can request an export of their metadata records.
• Retention limits: data is purged on a rolling schedule consistent with the law's requirements.

For data protection inquiries, contact us via your account dashboard.