Privacy Policy

Effective and last updated: August 14, 2026.

This Privacy Policy explains how Aivrae collects, uses, shares, stores, and protects personal information when you visit aivrae.com, create an account, purchase prepaid credits, use the Aivrae API gateway, contact support, or otherwise use the Service.

1. Data controller and contact

For personal information processed through the Aivrae Service, the data controller is Aivrae.

Aivrae has not appointed a separate Data Protection Officer. Privacy and data-rights requests are handled through the email address above.

Payment providers, Merchants of Record, and third-party AI model providers may act as separate controllers for information they process under their own terms and privacy notices.

2. Scope and roles

This Policy applies to information controlled by Aivrae. It does not replace the privacy notice of a payment provider, identity provider, model provider, or other third party.

If you use Aivrae on behalf of a business or submit personal information about another person, you are responsible for having a lawful basis and providing any notices required for that processing.

3. Information we collect

3.1 Account and profile information

We may collect usernames, display names, email addresses, password hashes, account preferences, language, referral information, account status, and identifiers associated with enabled OAuth, passkey, or other authentication methods.

3.2 Authentication and security information

We process login history, session and token identifiers, IP addresses where recorded, browser or user-agent information, device and security signals, password-reset events, verification records, API-key metadata, and suspected fraud or abuse indicators.

Passwords and secret credentials are stored or logged only in protected or hashed form where applicable. Users should never send full API keys, passwords, card data, or private keys to support.

3.3 API Content

"API Content" includes prompts, messages, instructions, files, images, audio, video, embeddings, tool data, task parameters, and model Outputs submitted to or returned through the Service.

API Content is processed to authenticate, route, transform, moderate, deliver, meter, and troubleshoot requests. It is transmitted to the third-party model provider selected or routed for the request. Aivrae does not use API Content to train its own general-purpose foundation models.

Regular consumption logs generally store usage metadata rather than complete prompt and Output content. For failed requests, sanitized diagnostic records may include limited request and response text so that errors can be investigated. Credentials and recognized secret fields are redacted. Asynchronous image or video tasks may retain prompts, task parameters, status information, and result references so that task history and delivery can function.

Third-party model providers may retain or use API Content according to their own terms, privacy notices, account type, and configuration. Review the provider information and avoid submitting data that the selected provider is not appropriate to process.

3.4 Usage and technical information

We collect request IDs, timestamps, model names, API paths, token or media usage, latency, streaming status, routing and conversion information, error codes, credit charges, group or pricing information, and other operational metrics needed to provide and bill the Service.

Depending on account settings and the type of event, logs may also include IP address, user agent, login method, upstream request ID, and diagnostic response information.

3.5 Payment and order information

We receive and store limited order information such as buyer email, internal user ID, order or checkout reference, selected payment provider, amount, currency, payment status, tax or refund status, timestamps, and fraud or dispute signals.

Aivrae does not receive or store full card numbers or card security codes. Those details are collected and processed by the provider shown at checkout.

3.6 Support and communications

We process messages sent to [email protected], attachments you choose to provide, account and transaction references, troubleshooting information, complaint or refund details, and records of our response.

3.7 Marketing information

If you subscribe to marketing communications, we may process your email address, consent record, message delivery and interaction information, and unsubscribe preference. Service, security, verification, billing, and policy notices are transactional and are not treated as optional marketing.

3.8 Cookies and local storage

The Service uses cookies, browser local storage, and session storage for functions such as authentication, security, theme, language, layout, cached status, notification state, and preventing duplicate view counts.

We may use disclosed analytics or measurement tools to understand Service performance and engagement. Where applicable law requires consent for non-essential analytics or marketing technologies, we will request consent before using them.

3.9 Information from third parties

We may receive information from authentication providers, payment providers, Merchants of Record, model providers, email providers, security services, referral partners, and persons who report abuse or payment problems.

4. How we use information

We use personal information to:

  • create, authenticate, secure, and administer accounts and API keys;
  • route API requests and deliver model Outputs and asynchronous tasks;
  • calculate usage, deduct credits, provide logs, and correct billing errors;
  • create checkouts, reconcile payments, deliver credits, and process refunds;
  • screen prompts and Outputs, investigate abuse, and enforce policies;
  • prevent fraud, unauthorized access, chargebacks, and security incidents;
  • provide technical, billing, privacy, and customer support;
  • maintain, debug, measure, and improve Service reliability and usability;
  • send transactional notices and, with an appropriate legal basis, marketing messages;
  • comply with law, sanctions, court orders, tax and accounting duties, and valid government requests; and
  • establish, exercise, or defend legal claims.

5. Legal bases

Depending on your location and the processing activity, we rely on one or more of the following legal bases:

  • performance of a contract or steps requested before entering a contract;
  • your consent, including consent to optional marketing where required;
  • compliance with legal obligations;
  • protection of vital interests or public interests where recognized by law;
  • prevention of fraud, abuse, and security threats; and
  • legitimate interests in operating, securing, supporting, and improving the Service where that basis is recognized and not overridden by your rights.

Where consent is the required basis, you may withdraw it prospectively. Withdrawal does not affect processing already lawfully completed.

6. Payment providers and Merchants of Record

The provider applicable to a purchase is identified at checkout. Creem or Waffo Pancake may act as Merchant of Record and legal seller for its respective transaction. Other disclosed providers may act as payment processors or payment-method providers.

We share the information reasonably required to create and reconcile a checkout, which may include your email address, selected product or credit amount, currency, internal order reference, user ID or pseudonymous identifier, return URL, and fraud-prevention metadata.

The provider independently processes payment credentials, billing details, taxes, invoices, refunds, chargebacks, and compliance information under its own privacy notice. Aivrae receives confirmation and transaction metadata but not your full card number or card security code.

7. AI model and infrastructure providers

To provide the API gateway, we send API Content and required request metadata to the selected or routed third-party model provider. Providers may include OpenAI, Anthropic, Google, and other providers identified through the Service or public model and pricing pages.

We may also use hosting, database, storage, content-delivery, email, monitoring, security, and customer-support vendors. These providers receive only the information reasonably necessary for their service and are expected to protect it under contractual or legal obligations.

8. Other disclosures

We may disclose information:

  • at your direction or with your consent;
  • to professional advisers subject to confidentiality duties;
  • to investigate fraud, abuse, security incidents, policy violations, or payment disputes;
  • when required by law, court order, sanctions rule, or valid government process;
  • to protect the rights, safety, and property of Aivrae, users, providers, or the public; or
  • in connection with a genuine sale, merger, financing, reorganization, or transfer of the Service, subject to appropriate safeguards and notice where required.

We do not sell personal information for money. We do not disclose personal information for third-party behavioral advertising unless we first provide any notice and choice required by applicable law.

9. Data retention

We keep information only for as long as reasonably necessary for the purposes described in this Policy, subject to these general periods:

Category General retention period
Account and profile data While the account is active, and generally up to 2 years after closure for restoration, fraud prevention, disputes, and compliance, unless earlier deletion is appropriate or longer retention is legally required.
API Content in ordinary synchronous requests Normally processed transiently and not stored as complete content in regular consumption logs.
Sanitized failed-request diagnostic details Normally no more than 7 days, subject to configured storage limits and earlier deletion.
Asynchronous image and video task data While needed to deliver and display task history, until deletion or account closure, or longer when required for an active safety, payment, or legal investigation.
Usage, billing, order, refund, and accounting records Up to 7 years where needed for accounting, tax, fraud prevention, payment reconciliation, disputes, and legal compliance.
Login, security, moderation, and abuse records Generally up to 2 years, or longer for an active investigation, repeat-abuse prevention, or legal obligation.
Support communications Generally up to 3 years after the matter is closed.
Marketing records Until you unsubscribe or the purpose ends; minimal suppression and consent records may be kept as needed to honor your choice and demonstrate compliance.

Backups may retain deleted information for a limited additional period before normal rotation. Payment and model providers apply their own retention periods independently.

10. International data transfers

Aivrae is operated from the People's Republic of China, while users and service providers may be located worldwide. Personal information and API Content may therefore be processed in countries other than your own, including locations where payment, hosting, email, or AI model providers operate.

Where applicable law requires safeguards for a cross-border transfer, we will use an available lawful mechanism, such as consent, contractual protections, adequacy decisions, recognized certifications, or another legally permitted basis.

11. Security

We use reasonable technical and organizational safeguards appropriate to the nature of the Service, which may include access controls, credential hashing, encrypted transport, secret redaction, restricted administrative access, logging, monitoring, backups, and fraud or abuse detection.

No system is completely secure. You are responsible for protecting your password, API keys, devices, applications, and networks. Notify [email protected] promptly if you believe your account or personal information has been compromised.

12. Your rights and choices

Depending on applicable law, you may have rights to:

  • access or obtain a copy of personal information;
  • correct inaccurate or incomplete information;
  • delete personal information or close your account;
  • restrict or object to certain processing;
  • withdraw consent;
  • receive portable data where required;
  • opt out of marketing communications; and
  • complain to a competent data-protection or consumer authority.

Account controls may allow you to update information, export certain usage data, revoke API keys, and delete your account. You may also submit a request to [email protected]. We may verify your identity and account ownership before acting. We aim to respond within 30 calendar days, or within another period required by applicable law.

Some information cannot be deleted immediately when it is needed to complete a transaction, maintain security, prevent fraud, comply with accounting or legal duties, resolve disputes, or establish legal claims. We will explain a material refusal where the law requires it.

13. Marketing communications

You may unsubscribe from marketing emails using the link in the message or by emailing [email protected]. Opting out of marketing does not stop necessary account, security, verification, billing, refund, or legal notices.

14. Children

The Service is intended only for persons aged 18 or older. We do not knowingly permit accounts for children. If you believe a person under 18 has provided personal information, contact [email protected] so that we can investigate and take appropriate action.

15. Changes to this Policy

We may update this Policy to reflect changes in the Service, providers, technology, law, or data practices. The current version will show its effective date. We will provide additional notice of material changes through the website, account interface, or email where required.

16. Contact

Privacy questions and data-rights requests may be sent to [email protected].