Privacy policy

What we never keep

When you use the API, the text you send (your messages, including any documents or tool results) and the text the AI writes back (the replies, including the reasoning step and any tool calls) pass through our servers in memory only. We don't save them to a database, a file or a log. We don't read them, sell them, or use them to train any AI.

To write a reply, we send your request to dedicated GPUs (the chips that run the AI) that we rent in US data centers. Our provider's policy is not to store or log what we send them.

What we keep

• Your email address, to sign you in and send receipts and important notices. If you sign in with Google, we ask Google only for your email address.
• Scrambled copies of your keys (hashes), the name you gave each key, its first few characters, and when it was made and last used.
• Numbers about each request: when it ran, which key, how many tokens went in and out, what it cost, how long it took and whether it worked. Never the text. We delete these after 90 days.
• Scrambled internet addresses per key per day, to count how many places a key is used from. Deleted after 7 days.
• Credit and billing records: credit you bought, plan credit and auto top-up settings.
• Sign-up checks: a scrambled copy of the internet address an account was made from, so we can limit how many accounts one network makes.
• Sign-in links, stored only as scrambled copies, until they expire.
• Which ad brought you here, if one did: the ad's click code and campaign name from the link you arrived on, saved when you sign up.
• How the site gets used: which pages are opened, which buttons are pressed (like Copy or Add credit), which kind of app you pick, where a visit came from (a search engine, a link or a campaign name) and milestones such as your first reply. These are tied to a random code in a cookie and, once you sign up, to your account. Never your messages, replies, keys, email address or internet address. We collect them ourselves, with no outside tracking service, and delete them after 180 days.
• Your answers to our short questions, like what you use AI Provider for or why you're leaving, and any ideas you send us. Answering is always optional.
• Marketing email opt-outs: the email address of anyone who unsubscribed, so we never email them marketing again.

Cookies

We use two cookies that the site needs to work: one keeps you signed in, and one protects our forms from other websites. A third cookie holds a random code for your browser, for one year, so we can count visits and see which steps people take (see "How the site gets used" above). We remember your light or dark choice in your browser. If you arrive from one of our ads, another cookie remembers which ad for 30 days. Right after you sign up, a cookie that lasts 10 minutes lets the ad pixel count your sign-up once, and Reddit's pixel may set its own cookie.

Who else handles your data

• Stripe handles payments: your card, invoices and receipts. Card numbers go straight to Stripe; we never see them.
• Our database provider stores the records listed above, in the United States.
• Resend sends our emails, so it sees your address and the email we send you.
• Google, if you choose to sign in with Google.
• Our hosting provider runs our website and API in the United States.
• Our GPU provider runs the AI in the United States and receives the request text for as long as it takes to write the reply.

We don't sell your data. We use Reddit's ad measurement pixel on our web pages (not in the API) to see which ads bring people here; when you sign up or pay, we tell Reddit that it happened, with a scrambled (hashed) copy of your email, never your prompts or replies.

Safety checks

Every request and reply is checked for sexual content involving minors. The check runs in memory, as part of the same request. If something is blocked, we record only that a block happened, on which account and when. Never the text.

How long we keep things

Request numbers: 90 days. Scrambled key addresses: 7 days. Site usage events: 180 days. Account data: while your account is open. When you delete your account, we delete your keys and request history right away. Billing records are kept as long as tax and accounting law requires, without your email address.

Your choices and rights

You can delete your account yourself on the Settings page of your dashboard. You can also ask for a copy of your data or ask us to fix it: email hello@aiprovider.org from the address on your account. Depending on where you live (for example the EU, UK or California), you may have more rights, and we'll honor them.

Health records

We don't sign HIPAA business associate agreements. Don't send US patient health records (protected health information) through AI Provider.

Children

AI Provider is for adults. You must be 18 or older to create an account.

Changes

If we change this policy in a way that matters, we'll email you before it takes effect. The date at the side shows the latest version. See also privacy & security and our terms.