Privacy Policy

1.1 Information You Provide

• Account Information: Name, email address, and authentication credentials (password hash or OAuth tokens).
• Payment Information: Payment is processed by third-party providers (Stripe, PayPal). We store transaction records but do not store full credit card numbers.
• API Requests: We log metadata (model used, token counts, timestamps, costs) for billing and analytics. We do not log prompt or completion content by default.
• Support Communications: Correspondence you send us.

1.2 Information Collected Automatically

• Device & Browser Data: IP address, browser type, operating system, device type, and referring URL.
• Usage Data: Pages visited, features used, and interaction patterns.

1.3 Tracking Technologies

• Strictly Necessary Cookies: Required for authentication and session management. Cannot be disabled.
• Analytics Cookies: Privacy-focused analytics to understand usage. You can opt out in your browser settings.

We do not use third-party advertising cookies or trackers. We do not sell your browsing data to advertisers.

• Provide, operate, and maintain the Service
• Process transactions and manage billing
• Authenticate users and prevent fraud
• Send transactional communications (billing receipts, security alerts)
• Analyze usage to improve performance and reliability
• Enforce our Terms of Service and protect against abuse
• Comply with legal obligations

We do not sell your personal data. We do not use your API request content to train AI models.

• AI Providers: Your API requests are forwarded to upstream AI providers to fulfill your requests. Each provider's own privacy policy governs their handling of your data.
• Payment Processors: Stripe and PayPal process payments under their respective privacy policies.
• Service Providers: Hosting, analytics, and infrastructure partners under contractual data processing agreements.
• Legal Requirements: When required by law, regulation, or legal process.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with notice to affected users.

We implement industry-standard security measures including:

• Encryption of sensitive credentials (AES-256-GCM) at rest
• TLS 1.2+ encryption for all data in transit
• Argon2id password hashing
• Role-based access control and multi-tenant data isolation
• Regular security audits and vulnerability scanning

• Account data: Retained while active; deleted 30 days after deletion request.
• Request logs: Retained up to 90 days for billing and analytics.
• Payment records: Retained as required by tax regulations (typically 7 years).

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict certain processing
• Data portability
• Withdraw consent where processing is based on consent

To exercise these rights, contact us at [email protected].

Your data may be processed in countries other than your own. We use appropriate safeguards including standard contractual clauses where applicable.

If you are in the EEA, UK, or Switzerland, our legal bases include:

• Contract: Providing the Service and billing.
• Legitimate Interests: Fraud prevention, security, and analytics.
• Consent: Optional analytics cookies and marketing.
• Legal Obligation: Compliance with applicable laws.

We do not sell or share your personal information as defined under CCPA or similar state laws.

To exercise your rights, contact [email protected].

The Service is not intended for users under 13. We do not knowingly collect personal data from children under 13.

We may update this Privacy Policy from time to time. Material changes will be notified via email or a notice on our website at least 30 days before taking effect.

If you have questions about this Privacy Policy, contact us at [email protected].