Privacy Policy

Account details. Your email address. If you sign in with GitHub or Google, we also receive the name and profile picture that service shares with us. We never receive your GitHub or Google password.

Sign-in and security data. One-time sign-in codes (stored only as hashes and valid for 10 minutes), your active sessions, and the IP address and browser or client (user agent) you sign in from.

API usage records. For each API request: when it was made, which API key and model it used, token counts, cost, status, timing, a request ID, and the IP address and user agent it came from.

Billing records. The amounts you top up, payment status, refunds and disputes, and the identifiers Stripe gives them. You enter card details on Stripe’s payment page; they go straight to Stripe, and we never see or store your full card number.

Email delivery data. The emails we send you, such as sign-in codes and balance alerts, and delivery events such as bounces and spam complaints.

Cookies and local storage. A cookie that keeps you signed in, and your language and theme preferences. We don’t use advertising or third-party analytics cookies.

Your requests, including prompts, files, images and tool definitions, and the models’ responses pass through our servers on their way to and from the model provider. We do not store or log this content.

To make prompt caching work, we keep a one-way hash of the start of a conversation for up to one hour, so that follow-up requests go to the same provider. The hash can’t be turned back into your text.

Models are run by our upstream provider. Today every model is served through Amazon Bedrock. According to AWS, Bedrock doesn’t store your prompts and responses or use them to train models. If we add other providers, we’ll list them in this policy before any of your requests are sent to them.

• To provide the Service: signing you in, running your requests, applying your key limits and showing your usage.
• To bill you: deducting usage from your balance, processing top-ups, and handling refunds and disputes.
• To keep the Service secure: rate limiting, preventing fraud and abuse, and enforcing our Terms of Service.
• To contact you: sign-in codes, balance alerts, and important notices about the Service or this policy. We won’t send you marketing emails unless you agree to receive them.
• To meet legal obligations, such as tax and accounting rules or lawful requests from authorities.

We don’t sell your personal information, and we don’t use your data to train AI models.

We share personal information only with service providers that help us run the Service, under contracts that limit how they may use it:

• Amazon Web Services: hosting, databases, email delivery (Amazon SES) and model inference (Amazon Bedrock).
• Vercel: hosting for the dashboard, which forwards dashboard requests to our API.
• Stripe: payment processing.
• GitHub and Google: only if you choose to sign in with them.

We may also disclose information when the law requires it, to protect the rights and safety of our users or of EZAT, or as part of a merger, acquisition or sale of assets. In that case this policy continues to apply to your information.

Our servers and databases are in the United States (AWS region us-east-1). The dashboard is delivered through Vercel’s global network. If you use the Service from outside the United States, your information is transferred to and processed in the United States.

• Account details: for as long as your account is open.
• Usage and billing records: for as long as we need them for billing, tax and accounting, which is usually several years.
• Server logs: about 14 days.
• Sign-in codes: 10 minutes.

When you ask us to delete your account, we delete or anonymize your personal information, except records the law requires us to keep.

You can see your account details and usage in the dashboard at any time. You can also ask us to access, correct, export or delete your personal information, or object to how we use it, by emailing support@ezat.io. We may need to confirm your identity first.

Depending on where you live, local law may give you further rights, for example in the European Economic Area, the United Kingdom, California or mainland China, including the right to complain to a data protection authority. We respond to requests as the applicable law requires.

We encrypt data in transit with TLS and keep our database encrypted at rest. API keys are stored only as hashes, which is why we can show a key just once, when you create it. No system is perfectly secure, so keep your API keys private and revoke any key you think has been exposed.

The Service isn’t meant for anyone under 18, and we don’t knowingly collect information from children.

We’ll post any changes on this page and update the date at the top. If a change is significant, we’ll also tell you by email or in the dashboard before it takes effect.

Questions about this policy or your information: support@ezat.io. EZAT Router is operated by EZAT Technology Inc.