Privacy Policy
Effective date: September 25, 2026 · Version 1.2
1. Data we collect
| Type | What | Retention |
|---|---|---|
| Account | Email, display name, password (hashed) | Until account deletion |
| Usage metadata | Model, token counts (input/cached/output/reasoning), cost, latency, status, error code — NO content | Detailed: 6 months; aggregates: long-term |
| Billing | Top-up/charge history (ledger) | Long-term (accounting obligations) |
| Technical logs | IP address, user-agent at the edge/server layer (abuse prevention, security) | 7 days |
| Prompt/response content | NOT stored (processed in memory then discarded; temporary cache entries for the caching feature are scoped to your account and expire automatically) | Cache: up to 24 hours |
2. How we use data
- Operating the Service: authentication, request routing, billing per actual tokens used;
- Showing usage, cost and savings on your dashboard;
- Security and abuse prevention (detecting brute-force, fraud, abnormal key sharing);
- Service communications: top-up confirmations, low-balance alerts, notices of material changes.
We do NOT sell your data, do NOT use your content to train models, and do NOT run ads based on your data.
3. Third-party processors
| Party | Role | Data involved |
|---|---|---|
| Cloudflare | AI inference infrastructure (Workers AI), CDN, DDoS protection | Prompts/responses transit for processing under Cloudflare's Data Usage policy (not used for training); IP at the edge |
| Dodo Payments | Card payment processing (Merchant of Record) | Your payment details — we never see card numbers |
| payOS | Bank transfer confirmation (VN) | Transfer transaction details (amount, order code) |
| OpenAI (ChatGPT Ads) | Ad conversion measurement — only if you choose “Allow” in the ad-measurement banner | Ad-click reference (oppref), a browser reference cookie, pages viewed on our sites, sign-up and top-up events with their amount, IP address and browser user agent. Never prompts, responses or API traffic. |
4. Where data lives
Account data and metadata are stored on servers we operate in Southeast Asia, with encrypted backups. Inference requests are processed on Cloudflare's global network.
5. Security
- All connections over HTTPS/TLS; API keys stored only as hashes (unrecoverable);
- Sensitive system credentials are AES-256 encrypted at rest;
- Administrative access requires multi-factor authentication and is IP-restricted;
- If a breach affecting you occurs, we notify you by email within 72 hours of confirmation.
6. Cookies
The website and dashboard use login-session cookies, a language preference, and one cookie that remembers your ad-measurement choice.
Advertising measurement cookies are set only if you choose “Allow”: OpenAI's __oppref (ad-click reference, 30 days) and __obref (browser reference, up to 1 year), plus our own clf_attr (keeps the ad-click reference and campaign tags for up to 30 days so a sign-up can be matched to the ad). If you decline or never choose, none of these are set and nothing is sent to OpenAI.
The measurement events our servers queue for OpenAI are deleted automatically about 30 days after they are created.
You can change your choice at any time from “Cookie preferences” in the site footer or in the dashboard settings; declining removes these cookies.
7. Your rights
- View and export your usage/billing data directly on the dashboard (CSV);
- Correct your account information at any time;
- Delete your account yourself from Settings → Account, or ask us by email: API access stops immediately and the account is deleted after a 7-day waiting period, during which you can cancel or choose to delete it immediately. Personal data is then deleted or anonymized; transaction and payment records are kept for accounting obligations without your personal details, and backups roll over within 14 days — all within 30 days of your request. Any remaining credit is forfeited;
- Data complaints: contact the email below; we respond within 7 business days.
8. Changes & contact
Material changes to this policy are announced as described in the Terms of Service. Privacy questions: