Privacy Policy
Privacy Policy
Last updated: 25 October 2026
ZEROAI Establishment (commercial registration unified number 7016675386), Al Khobar, Saudi Arabia (“TOKEN”, “we”) provides an API that gives access to AI models hosted by third-party providers. This policy explains what we collect, why, and for how long.
What we do not store
We do not store the content of your API requests or responses (prompts, messages, files, images, completions or embeddings). They pass through our servers to the provider that serves the model and back to you. Only the metadata below is recorded.
What we collect
| Data | Why | Kept for |
|---|---|---|
| Account data: email, display name, hashed password, OAuth account IDs, 2FA and passkey settings | To run your account and secure it | Until you delete your account, plus 30 days |
| Email fingerprint: a keyed one-way hash of your email, not the address | To give the starter credit once per mailbox | Kept after account deletion |
| Usage records for each request: time, model, token counts (input, cached, output), cost, API key name, the provider that served it, latency, status | Billing, usage history, abuse prevention, failover monitoring | 400 days (needed for invoices, refunds and tax) |
| IP address in your usage records | Security and abuse prevention | Only if you turn on “Record IP address” in Security settings; 90 days |
| Our hosting provider’s request logs: time, URL path, status, IP address, user agent (never request or response bodies) | Security, abuse prevention and operations | 30 days |
| Error records for failed requests: time, model, provider, the provider’s error code and message (truncated) | Reliability monitoring | 30 days |
| Payment records: amount in USD and SAR, credit, fee, Moyasar invoice and payment IDs | Payments, refunds, chargebacks, accounting | As required by law (typically 7–10 years) |
| Security events: sign-ins, factor changes, admin actions | Security investigations | 1 year |
We do not sell personal data, and we do not use your API content to train models.
Who processes data for us
AI model providers (only the provider that serves your request receives
its content): DeepInfra, Novita AI and Fireworks AI (United States) and Z.ai
(Singapore). The provider for each model is listed on the Models page, and we
update this list when we add a provider. Their own terms govern their
handling of request content. If you want requests kept on US and EU hosts
only, use the us-eu-hosted group.
Infrastructure and services:
- Google Cloud (hosting, United States, us-east4)
- Postmark (transactional email)
- Moyasar (payments, Saudi Arabia)
- Better Stack (status page)
- Cloudflare (bot protection on sign-up and sign-in, Turnstile)
- Namecheap (domain and DNS)
Your rights
You can access, export, correct or delete your data from the console, or by emailing support@thetoken.dev. Depending on where you live, you may have rights under the GDPR, UK GDPR or CCPA, including to object to or restrict processing, and to complain to a supervisory authority.
Security
Measures include:
- TLS everywhere
- hashed passwords
- optional two-factor authentication and passkeys (mandatory for our staff)
- upstream credentials stored as secrets, never in code
- least-privilege access
Changes
We will post changes here and notify you by email for material changes.
Contact: support@thetoken.dev. ZEROAI Establishment, CR 7016675386, Al Khobar, Saudi Arabia.