Privacy Policy

1. Scope

This Privacy Policy describes how Interoplayer (“Interoplayer,” “we,” “us,” or “our”) collects, uses, discloses, and retains information when you visit our website, create an account, use our dashboard, APIs, documentation, subscriptions, support, or related services (collectively, the “Service”). It does not govern a customer’s own privacy practices or third-party services that the customer connects to the Service.

For personal information contained in data a business customer submits for processing, the customer determines the purposes and means of the processing, and Interoplayer generally acts as its service provider or processor. The customer is responsible for its notices, permissions, instructions, and responses to individuals. A separate data processing addendum or BAA may govern where applicable.

2. Information we collect

Account and workspace information

We receive account identifiers, name, email address, authentication status, organization and workspace information, roles, and related profile details. Authentication providers such as Clerk, Google, or GitHub may process sign-in credentials and provide identity attributes according to your selected sign-in method. Interoplayer does not receive or store your password from those providers.

Billing information

Stripe processes payment-card and payment-method details. We receive billing contact details, customer and subscription identifiers, plan, transaction status, invoices, metered usage, and related billing records. We do not intentionally send translation content to Stripe.

Transaction content

The Service receives JSON, X12, and related transaction content that you submit for translation or parsing. This content may include personal information or health information depending on your use. Synchronous translations and inline response parsing process content in memory and are designed not to retain raw request or response bodies after the request completes.

Clearinghouse responses are parsed in memory and the normalized JSON is returned in the same HTTP response. The Service does not provide asynchronous response storage, polling, or customer response webhooks.

Usage, device, and security information

We collect request and correlation identifiers, tenant and environment identifiers, transaction type, mapping version, timestamps, duration, byte counts, status and error category, quota and billable usage, idempotency fingerprints, authentication events, browser and device information, and security signals. Network addresses may be processed for security and abuse prevention; where feasible, we use keyed or truncated representations rather than retaining a raw address.

Communications

We collect information you send in support, sales, security, legal, and other communications. Do not include transaction content, PHI, credentials, or secrets in support messages unless we expressly provide an approved secure channel.

3. How we use information

We use information to:

• provide, authenticate, operate, and maintain the Service;
• translate, validate, parse, and return customer transactions synchronously;
• create workspaces, administer accounts, and manage API keys and access;
• measure usage, enforce limits, process subscriptions, and prevent duplicate billing;
• detect fraud, abuse, vulnerabilities, and security incidents;
• debug failures and improve reliability without intentionally placing transaction content in logs or telemetry;
• provide support and communicate about the Service; and
• comply with law, enforce agreements, and protect rights and safety.

We do not sell personal information. We do not use transaction content for targeted advertising or to train general-purpose artificial intelligence models.

4. Healthcare information

Unless you and Interoplayer have executed a BAA expressly covering the Service, you must not submit PHI or use the Service in a manner subject to HIPAA. The Terms of Service explain this restriction. If a BAA is in effect, the BAA governs our handling of PHI and controls over any conflicting language in this Privacy Policy.

Interoplayer does not determine whether submitted content is PHI and does not use the absence of long-term storage as a substitute for applicable privacy, security, or contractual obligations.

5. How we disclose information

We may disclose information:

• to infrastructure, authentication, payment, communications, monitoring, security, and support providers acting for us;
• at your direction, including to integrations you configure;
• to personnel and professional advisers who need it and are subject to confidentiality duties;
• to comply with valid legal process or protect the Service, customers, rights, safety, and security;
• in connection with a financing, merger, acquisition, reorganization, or sale of assets, subject to appropriate protections; or
• with your consent or as otherwise disclosed when information is collected.

Current core providers include Clerk for identity and authentication, Stripe for billing and payments, and Railway for application and database infrastructure. Customer Data must not be routed to a provider that is not authorized for the applicable data and use case.

6. Cookies and similar technologies

We and our authentication and security providers use cookies and similar technologies necessary to maintain sessions, prevent abuse, remember security state, and operate the Service. Blocking essential cookies may prevent account access. If we add non-essential analytics or advertising technologies, we will update this notice and provide controls where required by law.

7. Retention

We retain information only for as long as reasonably necessary for the purposes described here, including providing the Service, maintaining security and audit records, resolving disputes, collecting fees, and meeting legal obligations. Retention depends on the category:

• raw synchronous translation bodies are not intentionally retained after request completion;
• idempotency, usage, audit, fraud, and security records remain for their operational or legally required periods;
• account and billing records remain while the account is active and afterward as required for legitimate business, tax, accounting, dispute, and legal purposes; and
• backup copies are removed through ordinary backup lifecycle processes.

8. Security

We use administrative, technical, and organizational safeguards reasonably designed to protect information, including access controls, credential separation, transport encryption, tenant isolation, rate limits, and payload-minimizing logs and telemetry. No service can guarantee absolute security. You are responsible for securing your credentials, systems, users, endpoints, and copies of output.

9. Your choices and rights

You may update certain account information through the Service, manage authentication connections through your account profile, manage subscriptions through the billing portal, and request account closure through the available support channel. Depending on your location, you may have rights to access, correct, delete, restrict, or obtain a copy of personal information, or object to certain processing.

If your information was submitted by an Interoplayer customer, direct your request to that customer first. We will assist the customer as required by applicable agreement and law. We may verify identity and retain information necessary to document and fulfill a request.

10. International processing

Information may be processed in countries other than where you live. Those countries may have different data-protection laws. Where required, we use contractual or other recognized safeguards for covered international transfers. Customers are responsible for determining whether their configuration and use satisfy applicable data-localization and transfer restrictions.

11. Children

The Service is a business product and is not directed to children. We do not knowingly permit anyone under 18 to create an account. Contact us if you believe a child has provided account information directly to us. This section does not prohibit an authorized healthcare customer from processing a minor patient’s information under an effective BAA and all required legal authority.

12. Changes to this policy

We may update this Privacy Policy as the Service or legal requirements change. We will post the updated version and its effective date and provide additional notice of material changes where required. Prior versions may be requested using the contact below.

13. Contact

Privacy questions and requests may be sent to privacy@interoplayer.dev. Please do not send PHI, credentials, or transaction content by ordinary email.