Privacy Policy

This policy covers XiuAI websites, sign-in services, the store, model APIs, testing and comparison features, documentation, and support conversations. XiuLab Inc operates these XiuAI services.

Payment processors, sign-in providers, model providers, and other third parties process information they directly control under their own privacy policies. This policy explains what XiuAI handles and what information must be passed to those providers to deliver the service.

When you register or sign in, we process your email address, verification-code delivery and validation records, account status, and information needed to authenticate you. If you use Google, Apple, or another sign-in provider, we receive the account identifier, email, name, or avatar that provider returns under your authorization.

Passwords and verification codes are used to authenticate you. Do not send passwords, verification codes, or API keys through public support, social media, or unofficial channels.

When you use XiuStore or another transaction feature, we process product, order, amount, currency, payment channel, payment status, refund status, delivery, and support records. Payment-card details, wallet credentials, and similar information are generally handled directly by the payment provider; we receive the result and transaction identifiers needed to complete and reconcile the payment.

Some products require account identifiers, region, UID, authorization information, session information, or other details specifically requested on the page for activation or delivery. We use those details only for the relevant order, verification, delivery, support, and fraud prevention. Do not submit passwords, recovery codes, or payment details that the page does not request.

XiuRouter retains necessary request statistics and model performance data long term, including API key identifiers, models, timestamps, token usage, charges, status codes, latency, and routing results. These records support billing reconciliation, historical usage queries, performance analysis, and service security. Account, payment, and other service records are handled under the relevant sections of this policy.

XiuRouter does not store model conversation content, including prompts, message history, files, images, other inputs submitted through the API or Playground, and model responses. This content is processed and transmitted solely to complete user requests and is not used for model training. XiuRouter does not sell any user data. Support messages and attachments submitted by users are handled under Section 7.

XiuRouter's upstream access policy permits only services operated by model developers themselves, excluding third-party resale, relay, and aggregation sources. Model developers process request content under the data policies of their respective services.

XiuRouter follows the principles of data minimization and purpose limitation. Where applicable, we comply with the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).

Model API features outside XiuRouter process the requests, responses, and operational records needed to provide the service. We may temporarily process relevant request or response content when necessary to diagnose a problem, answer a support request, prevent abuse, or meet legal obligations. More specific notices on a product screen apply to those features.

When you use XiuBench testing or comparison features, we may process the model, service site, API address, test parameters, response results, and performance metrics you select so we can run the test and produce a report.

XiuBench also collects publicly accessible prices, products, models, and service status. Public-source data is not always personal information; if it identifies a person, we still handle it under applicable law and this policy.

Websites, apps, and infrastructure may record IP address, browser and device type, operating system, system language, referring page, pages visited, timestamps, crashes, performance, interaction events, and logs needed to prevent fraud and protect service security.

Some public pages use website analytics and session replay to find confusing or broken interfaces. Privacy masking is enabled and recording scope is limited. These tools are not used to intentionally collect passwords, payment details, complete API content, or sensitive information you did not choose to submit.

We may use cookies, local storage, or similar technologies to maintain sign-in, save language and theme, restore a workflow, measure visits, and protect services. You can limit non-essential technologies through your browser, but some functions may stop working correctly.

When you email us, start a support conversation, submit a ticket, or contact another official channel, we process contact details, account or order identifiers, messages, attachments, and operational records needed to resolve the issue.

To protect accounts and transactions, we may ask for enough information to verify that a request belongs to you. Support will not ask for your full password, verification code, recovery code, or complete payment credentials.

We use information to create and protect accounts, provide products and APIs, complete payments and delivery, calculate usage and charges, generate test results, answer support requests, diagnose failures, prevent abuse, improve products, and meet tax, accounting, compliance, and other legal obligations.

We do not sell any user data.

To provide the service, we may give necessary information to cloud hosting and delivery providers, model upstreams, payment and reconciliation providers, identity providers, email providers, analytics and error-diagnosis tools, support systems, and security vendors. They may process information only for the relevant task and under their contractual and security obligations.

We may also disclose information when required by law or reasonably necessary to investigate fraud or attacks, protect users and services, enforce agreements, or preserve legal rights. If the business is involved in a merger, financing, reorganization, or asset transfer, information may transfer with the business subject to applicable confidentiality and legal requirements.

Retention depends on the purpose. Account, order, payment, usage, security, and support records are kept as long as needed to provide services, reconcile accounts, resolve disputes, audit activity, prevent fraud, or meet legal obligations. Aggregated or de-identified data may be kept longer.

XiuRouter request statistics and model performance data are retained long term for billing reconciliation, historical usage queries, performance analysis, and service security. Personal information rights requests are handled under Section 11 and applicable law.

We use access controls, transmission protections, permission boundaries, logging, and other technical and organizational measures appropriate to the risk. No internet transmission, third-party platform, or storage system can be guaranteed completely secure.

You can update some account information, stop using services, limit non-essential analytics through browser controls, and avoid submitting sensitive information that is not needed to provide the service.

Where applicable law gives you these rights, you may request access to, correction of, deletion of, or export of information about you, restrict or object to certain processing, or withdraw consent-based processing. We may verify your identity to protect accounts, orders, and API assets, and may retain information required by law or needed to resolve disputes.

XiuLab Inc serves multiple regions and uses distributed infrastructure and global providers. Information may be processed outside your region, with contractual, access-control, or other safeguards applied as required by applicable law.

XiuAI services are not directed to minors who cannot provide valid consent on their own. Minors should use services only with a guardian's permission and guidance and should not independently purchase products, create API access, or submit sensitive personal information.

We may update this policy when product features, data practices, or legal requirements change. The new update date will appear on this page. Material changes will be explained through a page notice, account notice, or another appropriate channel.