Privacy Policy

1. Information we process

Account and authentication information includes your name, email, password hash, verification status, and session information. If you enable two-factor authentication, we also process the relevant verification credentials. Passwords are stored as hashes.

Service and transaction information includes API key information, model and region selections, request times, token usage, duration, status, errors, balances, orders, and financial records. This supports model calls, billing, reporting, and troubleshooting.

Request content includes prompts, messages, files, other inputs, and model outputs processed to fulfill your requests. When you contact support, we also process the contact details and issue descriptions you provide.

Product analytics information: we use PostHog to analyze page views, referrers, clicks, and key actions such as registration, API key creation, credited top-ups, and the first observed successful API call for both anonymous visitors and registered users. After login, an internal user ID and email link analytics records. Browser, device, and access-time information is also processed.

2. Purposes of processing

We use necessary information to manage accounts, verify identity, fulfill model requests, calculate charges, send verification and security emails, handle inquiries, maintain service security, and meet applicable legal requirements. We process personal information only with an appropriate legal basis and request consent where required by law.

3. Cookies and local storage

Necessary cookies maintain login and verification state. Cookies or browser local storage also save preferences such as language and theme. You can clear or restrict this data in your browser settings. Restricting necessary cookies may prevent login or affect some features.

Product analytics and session replay are enabled by default. PostHog uses cookies or local storage to distinguish visitors and sessions and connect visits before and after login. Masked page layouts and interactions help improve usability and investigate problems. Input values, page text, keys, conversations, attachments, and payment credentials are masked or blocked. Admin pages, network request bodies, and browser console logs are not recorded.

4. Model providers and third parties

Model requests require sending input content and necessary parameters to the provider serving the selected model. Providers may have different data practices; review their applicable policies before submitting content. Payment and email providers may also process the information necessary to deliver their services.

PostHog provides product analytics and session replay and receives and processes the analytics data described above in its US region, including internal user IDs, email addresses, and masked interaction records. Model prompts and outputs, API keys, and payment credentials are not sent to PostHog as product analytics content. Contact us below for processing details or to exercise your rights.

We do not sell your personal information. We provide it to third parties only as necessary to deliver services, with your authorization, or as required by law. For cross-border transfers, we will fulfill applicable legal obligations and provide separate notice and obtain consent where required.

5. Content storage and retention

Usage and financial records are handled separately from request content. Diagnostic logging of request and response content is disabled by default. When enabled for troubleshooting, its default retention is seven days, subject to site configuration. Do not assume that all model calls are processed without content storage.

In Codeflare-managed Responses mode, requests with content storage enabled are retained for thirty days by default, subject to service configuration. Setting store=false in that mode disables persistent conversation storage and diagnostic content collection for that request, while necessary usage and financial records remain. Third-party retention is governed by the provider's policies and configuration.

Other personal information is retained only as long as necessary for its purpose, unless continued retention is required by law. After account closure, we will lawfully delete or anonymize information no longer needed. Transaction and security records required by law are retained only for the relevant purposes.

6. Information security

We use authentication, access controls, credential protection, and other measures to reduce the risk of unauthorized access, disclosure, or loss. Protect your account and API keys and avoid submitting unnecessary sensitive information. We will handle personal information security incidents and provide notifications as required by law.

7. Your rights and protection of minors

You can view or update supported information in account settings. You may also email us to request access, a copy, correction, deletion, withdrawal of consent, or account closure. We will verify your identity and handle requests under applicable law. Withdrawal does not affect prior processing based on consent and may prevent us from continuing some necessary services.

Children under fourteen should not register or submit personal information on their own. Guardians who discover information submitted without their consent may contact us for review and lawful handling.

8. Policy updates and contact

Updates are dated on this page. We will appropriately communicate material changes to processing purposes, information types, or recipients and seek renewed consent where required by law. For privacy questions, complaints, or rights requests, use the contact email below.