ApiLux

Privacy Policy

Last updated: draft — not yet in force

1. What we collect

  • Your email and a one-way hash of your password. The password is never stored in readable form.
  • Wallet balance, the history of credit added and deducted, and the reason for any adjustment.
  • Usage records: which model you called, the volume (tokens, images, seconds), the charge, and the timestamp.
  • API key metadata: the name you gave it, the key prefix, when it was created and revoked, and the limits you configured. The original key is not stored.
  • The display language you chose, stored in a cookie.

2. Your request content is NOT stored

Prompts, images you upload, and AI-generated results are forwarded to the upstream AI infrastructure provider for processing and returned to you. ApiLux does not persist them — there is no conversation history, no image library, and no video library on the ApiLux side. Only the usage records in section 1 are retained, and those contain no request content.

OWNER DECISION REQUIRED — not yet in forceHow long the upstream AI provider retains request content and what they use it for. That is their policy, not ApiLux's, and must be confirmed with them before being published here.

3. Why we use it

  • To authenticate your account and protect access.
  • To process requests and charge for actual usage.
  • To show you your own usage statistics and wallet history.
  • To detect abuse and protect shared infrastructure.
  • To provide support and resolve disputes.

4. Sharing with third parties

  • We do not sell or rent your personal information.
  • Request content is forwarded to the upstream AI infrastructure provider for technical processing, not for advertising.
  • The sign-up and sign-in pages use Cloudflare Turnstile to block automated access; that service receives technical information about the browser you use.
  • Once a payment gateway is connected, the payment provider will receive the information needed to process the transaction.
OWNER DECISION REQUIRED — not yet in forceThe complete list of data processors (hosting, payments, transactional email) with the country each stores data in. Needs to be finished before going on sale.

5. Cookies

ApiLux uses a session cookie (httpOnly, required to stay signed in) and a cookie storing your display language. We do not use advertising cookies and do not track you across other websites.

6. Data security

Passwords are hashed one-way. API keys are stored only as a keyed hash, so the original no longer exists in the system after being shown to you once. Connections are encrypted over HTTPS. Every administrative action touching an account or a balance is written to an append-only audit log.

7. Retention

OWNER DECISION REQUIRED — not yet in forceHow long email, wallet history, usage records, and audit logs are kept. Note: transaction records may be subject to a statutory minimum retention period for accounting or tax purposes — check before committing to a figure. Deliberately no period is stated.

8. Your rights

You may request access to, correction of, or deletion of your personal information. You can change your password and revoke API keys yourself under Settings. For anything else, get in touch via the Contact page.

OWNER DECISION REQUIRED — not yet in forceThe committed response time for a personal-data request, and the process for verifying the requester's identity.

9. Changes to this policy

This policy may be updated. Changes will be published on this page.

10. Contact

OWNER DECISION REQUIRED — not yet in forceThe entity or individual responsible for data, a privacy contact email, and an address. Nothing has been confirmed, so this is deliberately left blank.