Privacy Policy

1. What we collect

• Account data: email address, hashed password or OAuth identifier, account status.
• Billing data: credit purchases, balances, refunds and usage ledger. Full card or bank details are collected by our Merchant of Record and never reach our servers.
• Usage data: timestamp, model, provider, token counts, request status, cost, IP address and API key identifier.
• Content: prompts you send and model outputs returned, processed transiently to deliver the response.

We do not require a phone number, government ID or real name to use the API. Identity verification, where required, is performed by the payment partner under its own privacy notice.

2. Why we process it

To create and secure your account, relay requests to model providers, meter usage and deduct credits, prevent abuse and fraud, comply with legal and tax obligations, and provide support. We rely on contract performance, legitimate interests in security and fraud prevention, and legal obligation as applicable.

3. What we do NOT do

• We do not use your prompts or outputs to train, fine-tune or evaluate models.
• We do not sell, rent or share your content with advertisers or data brokers.
• We do not build advertising profiles from your content.

4. Subprocessors

To deliver the service we use the following categories of subprocessors. A current list is available on request.

• Model providers — receive prompts solely to generate the response for the model you selected. Their own terms and retention policies apply to that processing.
• Cloud hosting and database — infrastructure hosting the gateway and its logs.
• Payment / Merchant of Record — collects payment, handles tax, invoicing, refunds and disputes.
• Email delivery — for account notices and abuse-report responses.

Data is stored in the region where the service is operated. If you are in the EEA or UK, transfers are made using appropriate safeguards such as Standard Contractual Clauses. You may request details of the transfer mechanism.

5. Retention

• Account data: for the life of the account, then deleted or anonymized within 30 days of closure.
• Usage and billing records: retained for up to 7 years where required for tax, accounting and dispute resolution.
• Prompt and output content: retained only as long as needed to deliver the response and investigate abuse or a reported incident, and in no case longer than 30 days unless required by law.
• Abuse-report and enforcement records: retained for up to 2 years to demonstrate consistent enforcement.

6. Your rights

Subject to applicable law, you may request access to, correction of, export of, or deletion of your personal data, object to or restrict certain processing, and withdraw consent where consent is the basis. You also have the right to lodge a complaint with your local supervisory authority.

To exercise a right, email support from the address associated with your account. We respond within 30 days. Some billing records must be retained for legal reasons even after an account is deleted.

7. Security

We use TLS in transit, encrypt provider API credentials at rest, apply least-privilege access to production systems, log administrative actions, and rate-limit and screen for abusive content. No system is perfectly secure; please keep your API keys confidential and notify us of suspected compromise.

8. Children

The service is not directed to children under 16 and we do not knowingly collect their personal data. If you believe a child has provided data, contact us and we will delete it.

9. Changes and contact

We will post material changes here with a new "Last updated" date. Questions and requests: support.