Data and privacy

Loresta separates operational records from raw conversation content and applies purpose-specific retention rules.

Agent API event minimization

Agent API event records contain operation, outcome, status, token totals, request hash, request ID, and workspace-scoped identifiers. The event schema does not store raw prompts, message bodies, response bodies, or provider tokens.

The reply decision itself is returned to the caller. Callers are responsible for avoiding sensitive bodies in their logs and telemetry.

Provider history

Creator-approved provider history import is optional. Imported message bodies are marked with a 30-day retention deadline and removed by retention maintenance unless an authorized investigation hold applies.

Live conversation records and other product data follow their own code-owned retention policies. Do not assume every data class shares the provider-history deadline.

Secrets

Agent API keys are stored as hashes and shown once.
Provider access and refresh material is encrypted at rest.
Public API responses omit provider tokens and OAuth client secrets.
Workspace privacy exports redact secret-bearing columns before delivery.

Workspace exports

Loresta creates workspace-scoped privacy exports with a versioned manifest and per-table counts. Export generation fails closed when a required table cannot be exported completely.

Provider history import, supporter communications, and public supporter identity choices are separate controls. Support cards keep names and amounts private by default. Marketing relationship messages require the recorded communication consent used by the product workflow.

Developer responsibilities

Collect only the fields required for the integration.
Never use persona data to infer private supporter attributes.
Do not place private message bodies in analytics or error trackers.
Honor creator key revocation immediately.
Use x-request-id, error codes, and request hashes for support instead of raw content.