Privacy Policy

We collect the minimum data needed to operate an API gateway: your email address and password hash for authentication, organisation name for billing, API key metadata (alias, model access, budget ceiling), and request-level usage records (model, token counts, cost) so spend ceilings can be enforced in real time.

We do not store the prompts or completions that pass through the gateway. Request bodies are forwarded to the upstream provider and discarded; only the metadata above is retained.

• Authenticate you and scope keys to your organisation.
• Enforce spend ceilings at the gateway before requests reach the upstream.
• Generate usage reports and invoices for D17 and card payments.
• Send transactional email (verification, password reset, payment receipt).

All data is stored in a self-hosted PostgreSQL database on our VPS. We do not use third-party analytics, tracking pixels, or advertising networks. Resend delivers transactional email under their own privacy policy; no marketing email is sent without explicit consent.

We share data only when required to deliver the service: upstream providers receive the API requests you make (under their own policies), and Resend receives the transactional emails we send on your behalf. We do not sell, rent, or share personal data for advertising or profiling. Disclosure to authorities occurs only when required by law and with notice where legally permitted.

Account data is retained while the account is active. Usage records are kept for 90 days for billing reconciliation and then aggregated; individual request logs are deleted after 30 days. On account deletion, all personal data is removed within 30 days except where retention is required by law or for unresolved billing disputes.

You may request a copy of your data, correction of inaccuracies, or deletion of your account at any time by emailing privacy@zaino.ai. We respond within 30 days. Tunisian users have the same rights under local data protection law.

Passwords are hashed with bcrypt. API keys are stored as salted hashes; the raw key is shown only once at creation. All traffic is encrypted in transit via TLS. The VPS is hardened per CIS benchmarks and patched weekly. Breach notification follows applicable law.

Material changes to this policy will be announced via email or a banner on the portal. Continued use after the effective date constitutes acceptance.

Questions about this policy: privacy@zaino.ai. For general support, use the dashboard or email support@zaino.ai.