Privacy Policy

The Service is operated by AI From U, of TNR Building, 180 Nguyen Cong Tru Street, District 1, Ho Chi Minh City, Vietnam, who is the data controller. This policy explains what we collect when you use the AI From U API and portal, and what we do with it.

1. What we collect

1. Account data — the name and email address you give at purchase.
2. Billing data — handled by PayPal, which processes our payments. We receive a payer reference, the subscription or order status, the billing period, the amount and the payment outcome. We never receive or store your card number, CVC or expiry.
3. Usage metadata — for each request: timestamp, model name, token counts by category (input, cached input, cache writes, output, reasoning), the credits charged, and a request identifier.
4. Technical data — server logs containing IP address, user agent and error diagnostics.
5. Access records — for each sign-in to the portal: the time, how you signed in, the IP address, the country Cloudflare derives from that address, and your browser’s user agent; for each API request: the time, the IP address and that country; and, after a failed sign-in, a count of failures for that email address and that IP address, used only to stop password guessing.

2. What we do not collect

We do not store the content of your prompts or the model’s completions. Our usage records contain counts and prices, not text. No table in our database holds request or response bodies, and our application logs do not write them.

Note the limit of that statement: your request content necessarily passes through our gateway in memory while in flight, and is transmitted to the upstream model provider, which processes it under its own terms and retention policy. If your content is confidential or regulated, review the upstream provider’s policy alongside ours.

3. Why we process it, and on what basis

To provide the Service and route your requests (performance of our contract with you); to meter quota and bill correctly (contract, and our legitimate interest in accurate accounting); to detect abuse, fraud and security incidents (legitimate interest); and to meet legal and tax obligations (legal obligation).

Access records have one purpose: to protect your account and your API key by showing when and from where they were used, so that a shared or leaked key, or a sign-in that was not you, can be found and stopped. The basis is our legitimate interest in the security of the Service and of your account, and the performance of our contract with you.

We send service emails about your account, such as pricing changes, maintenance and model availability. If we send product news, it comes separately, and every product-news email carries a link to stop it; stopping product news does not stop service emails.

We do not sell your personal data. We do not use it to train models. We do not run advertising on our site.

4. Who we share it with

1. PayPal (paypal.com) — payment processor: payments, automatic renewals and refunds. PayPal is also an independent controller of the details you give it.
2. The upstream model provider — receives your request content in order to produce a response.
3. Our email provider — delivers activation and account emails.
4. Authorities — where we are legally required to disclose, and only to the extent required.

5. Cookies

We set only functional cookies: a language preference, and for signed-in customers a session cookie and a CSRF token. There are no advertising, profiling or third-party analytics cookies, which is why the site shows no consent banner.

6. Retention

Account and billing records are kept while your account is active and afterwards for as long as tax and accounting law requires. Usage metadata is retained for reconciliation and dispute resolution. Server logs are kept for up to 200 days, so that a payment dispute, which can be opened up to 180 days after a payment, can be answered from the record, and are then deleted automatically. Because prompt and completion content is never written to storage, there is nothing of that kind to retain or delete.

Access records are deleted automatically after 90 days. They can be displayed only in our internal administration console, which is not reachable from the internet, and they are never sent in an email or placed in a link.

7. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict processing, and to complain to a supervisory authority. Write to support@aifromu.com and we will respond within 30 days. Deleting your account ends the Service and forfeits remaining credits, which have no cash value.

8. Security

API keys are stored as hashes, never in a form we can read back. Traffic is served over HTTPS. Access to production systems is restricted. No system is perfectly secure; if a breach affects your data we will notify you as required by law.

9. International transfers

We operate from Vietnam and use providers in several countries, so your data may be processed outside the country where you live, including in jurisdictions with different data-protection rules.

10. Children

The Service is not for anyone under 18. We do not knowingly collect data from children; if we learn we have, we will delete it.

11. Changes

We may update this policy. Material changes will be announced by email at least 30 days before they take effect, and the current version is always published here.

12. Contact

AI From U, TNR Building, 180 Nguyen Cong Tru Street, District 1, Ho Chi Minh City, Vietnam · support@aifromu.com