Privacy Policy
This policy explains what information AIFans API (“we”, “us”) collects when you use AIFans API (the “Service”), why, who we share it with, how long we keep it and what your rights are. We are the controller of the account and billing information described here.
1. What we collect and why
| Information | Why | Notes |
|---|---|---|
| Username and password | Creating your account and signing you in | Passwords are stored only as salted one-way hashes; we cannot see them |
| Email address | Verification, sign-in, password resets, alerts (such as a low balance) and service notices | Required and verified with a code |
| API usage records | Billing, usage statistics, troubleshooting, security | Time, model, token counts, cost, latency, status and which of your keys was used. We do not store the content of your prompts or the model's answers. |
| Payment and balance records | Crediting top-ups, statements, refunds, accounting | Amounts, times, balance changes and PayPal order and transaction IDs. We never receive your card number or PayPal password |
| IP address and browser information | Security, rate limits, preventing abuse (for example of the welcome credit) | Including the IP address you signed up from |
Legal bases: performing our contract with you (account, API, billing), our legitimate interests (security, fraud prevention, improving the Service) and legal obligations (accounting and tax records).
2. What happens to the content you send to a model
- To answer a request, your input (prompts, context, files) passes through our servers to the provider that runs the model you chose, which returns the result. Our servers are in Singapore and connect to the model providers' Singapore endpoints.
- We do not keep that content after the request is done, and we do not use it to train models. The model provider processes it under its agreement with us and the law that applies to it.
- Please do not send personal data you are not allowed to share, or sensitive data the Service is not meant for.
3. Cookies
When you sign in we set one session cookie (HttpOnly, valid for 7 days by default) to keep you signed in. We do not use advertising cookies or cross-site tracking.
To learn which pages people visit, the website uses Cloudflare Web Analytics. It sets no cookies and does not follow you across websites: it counts page views and records the page, the referring page, the browser type and an approximate country, without keeping your IP address.
4. Who we share information with
We do not sell personal information. We share it only as needed with:
- Model providers, to process your requests (section 2).
- PayPal, which processes your payments under its own privacy statement.
- Our email delivery provider, to send verification codes and alerts to your address.
- Our hosting and network providers, which run our servers in Singapore and protect the website against attacks (Cloudflare also gives us the cookie-free visit statistics described in section 3).
- Authorities, where the law requires it.
5. Where information is kept, and for how long
- Our servers and database are in Singapore. Our team works from the People's Republic of China and accesses account, usage and payment records from there to run the Service, support you and keep our accounts. Where the law requires safeguards for such transfers, we rely on contractual safeguards.
- Account information is kept while your account is open and deleted or anonymised within 90 days after it is closed. Usage, payment and balance records are kept as long as accounting and tax laws require (usually up to 5 years). Verification codes are kept only as hashes and expire after 10 minutes.
6. Security
We use HTTPS, salted password hashes, store API keys only as hashes, restrict access, and rate-limit sign-in and verification codes. No system is perfectly secure; if a breach affects your information, we will tell you and the authorities as the law requires.
7. Your rights
You can see and change some of your information on the Account page of the console. You can also ask us for access to, a copy of, correction or deletion of your personal information, object to or restrict its use, or close your account, by writing to the contact below. We answer within 30 days after confirming your identity. You may also complain to your local data protection authority.
8. Children
The Service is for adults and businesses. It is not meant for anyone under 18; if you believe a child has given us information, contact us and we will delete it.
9. Changes
We may update this policy and will tell you in the console or by email; significant changes are announced in advance.
10. Contact
Privacy questions and requests: AIFans API, email [email protected]