The terms, inplain language.

Terms of service

Effective August 2026

The service

actionlake provides a governed endpoint through which your authorized agents and applications can act across systems you connect. We make calls to those systems on your instruction, cache results, join answers, and record what happened. You remain responsible for what you instruct, and for holding the necessary rights to the systems you connect.

Fees

Fees follow the published price book at https://api.actionlake.com/v1/price-book, which is the single source of every commercial number. Cached answers, catalogue searches, control operations and calls that fail through no fault of yours are free. Plan changes take effect at the next billing period; overage is billed at the plan's published rate.

Your data

Your credentials and your business data remain yours. We act as a processor on your instructions, we do not browse or mine your content, and we do not use your traffic to train anything. On termination, credentials are destroyed and the audit record remains exportable for sixty days.

Acceptable use

Connect only systems you are entitled to connect; do not use the service to break the law or another party's terms; do not probe other tenants - we test our own walls and will notice.

Availability and liability

A public status page is not yet published; the trust page records that. Team, Business and Enterprise plans carry a 99.9% availability target; a contractual commitment with service credits is not yet in force, and the trust page says so. Our liability is capped at the fees you paid in the preceding twelve months; nothing in these terms excludes liability that cannot lawfully be excluded.

Governing law

These terms are governed by the law of New Zealand, and disputes belong to its courts. We will always try a conversation first: [email protected].

Privacy policy

Effective August 2026

What we hold

Account details you give us (name, work email, billing), the configuration you create (tenants, keys, connections, caps), and operational metadata about calls - identifiers, costs, timings, outcomes. The audit record carries receipts: it shows that a call happened and what it cost. Beside it, two stores hold contents for a while. Each run's request and response are kept, encrypted under your tenant's key, for your plan's trace window, from 24 hours on Free to 30 days on Business and Enterprise, and then deleted. Cached answers are kept for the action's cache TTL.

What we do not do

We do not sell personal information, we do not run advertising, we do not train models on your traffic, and we do not browse your business records. No product screen shows them to us; production access is limited to named engineers, for operations.

Where it lives

Infrastructure runs in a single DigitalOcean region, Sydney (syd1), so your data is stored in Australia; backups are encrypted, stay in that region, and allow seven days of point-in-time recovery. In transit it passes through Cloudflare's edge, which terminates TLS for every actionlake hostname. Credential encryption is envelope encryption per tenant under a master key held in the API service's environment - not a customer-held key. Bring-your-own-key is not offered today; the trust page records that and what would close it.

Deleting a connection deletes its stored credential. A database backup keeps a copy until it ages out, seven days later, because the key that seals it is your tenant's. Erasing a tenant destroys that key, and every credential and trace sealed under it becomes unreadable.

Who else handles it

• DigitalOcean (Sydney, Australia) - compute, the database, the cache, object storage for traces and seals, and this site.
• Cloudflare (global; United States) - DNS, TLS termination, CDN and WAF for actionlake.com and the api, mcp, connect and auth hosts. It sees traffic in transit, including keys and credentials sent to the API.
• SendGrid, a Twilio company (United States) - approval mail: the approver's address, the request summary, and the action's input with credential-named keys masked.

Stripe joins the list, with notice, before the first card is charged; no card is charged today, so no data reaches it from us.

The same list, machine-readable, is in actionlake-trust.json.

Your rights

Ask us what we hold about you, correct it, or have it deleted: [email protected]. We answer within twenty working days, usually much faster.