1. Scope

This Policy applies to the tokenbox.cloud website, console, APIs, documentation, and related support services. Third-party model providers, payment processors, and other services connected through the API may have their own privacy policies.

2. Information we collect

• Account information: username, email, necessary authentication information, and account settings.
• Usage and billing information: API key identifiers, model and request metadata, usage, credits, orders, and payment status. We do not obtain your payment-account password through an API key.
• Technical and security information: IP address, browser and device information, timestamps, request IDs, error logs, and security logs for abuse prevention, troubleshooting, and service protection.
• Information you provide: emails, tickets, and attachments sent to support.
• API content: prompts, files, other inputs, and model outputs may be processed by services in the request path. Do not submit sensitive personal information unless necessary.

3. How we use information

We use the information above to provide and maintain the service, verify accounts, measure usage, process payments, answer support requests, detect and prevent fraud and abuse, protect security, improve reliability, and comply with legal obligations.

We do not sell your personal information or use your API content to train our own models. We process information only as needed to provide the service, perform a contract, with consent, to protect legitimate interests, or as required by law.

4. Third-party models and service providers

To complete your request, API content may be sent to the third-party model provider you select. That provider's policies govern its processing, retention, and cross-border practices. We may also use hosting, logging, payment, email, and security providers to process necessary information, subject to service-purpose restrictions.

5. Retention, security, and deletion

We retain information for as long as needed for the purposes in this Policy, support, dispute resolution, security auditing, and legal obligations. Account, usage, billing, and security logs may have different retention periods. When no longer needed, we delete, anonymize, or securely isolate the information.

We use reasonable measures such as access controls, transmission protection, separation of privileges, and monitoring. No internet transmission or storage method can be guaranteed absolutely secure.

6. Your choices and rights

You may update certain information in your account settings, unsubscribe from non-essential marketing communications, and contact support to request access, correction, deletion, or information about processing. Some information may need to be retained for billing, security, fraud prevention, or legal obligations.

We may update this Policy. Material changes will be announced through the website or console in a reasonable manner with a new effective date.