Privacy Policy

This policy covers XiuAI websites, sign-in services, model APIs, product features, documentation, and support conversations. XiuLab Inc operates these XiuAI services.

Payment processors, sign-in providers, model providers, and other third parties process information they directly control under their own privacy policies. This policy explains what XiuAI handles and what information must be passed to those providers to deliver the service.

When you register or sign in, we process your email address, verification-code delivery and validation records, account status, and information needed to authenticate you. If you use Google, Apple, or another sign-in provider, we receive the account identifier, email, name, or avatar that provider returns under your authorization.

Passwords and verification codes are used to authenticate you. Do not send passwords, verification codes, or API keys through public support, social media, or unofficial channels.

When you use top-ups, invoicing, or another transaction feature, we process order, amount, currency, payment channel, payment status, refund status, and related service records. Payment-card details, wallet credentials, and similar information are generally handled directly by the payment provider; we receive the result and transaction identifiers needed to complete and reconcile the payment.

The model API service retains necessary request statistics and model performance data long term, including API key identifiers, models, timestamps, token usage, charges, status codes, latency, and routing results. These records support billing reconciliation, historical usage queries, performance analysis, and service security. Account, payment, and other service records are handled under the relevant sections of this policy.

The model API service does not store model conversation content, including prompts, message history, files, images, other inputs submitted through the API or Playground, and model responses. This content is processed and transmitted solely to complete user requests and is not used for model training. The model API service does not sell any user data. Support messages and attachments submitted by users are handled under Section 7.

The model API service may access model services directly or through third-party supply channels. To complete a request, request content is transmitted to the relevant upstream processors based on the selected model and service configuration. Each processor handles request content under its applicable data policies and service terms.

The model API service follows the principles of data minimization and purpose limitation. Where applicable, we comply with the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).

Features outside the model API service described in this section process the requests, responses, and operational records needed to provide the service. We may temporarily process relevant request or response content when necessary to diagnose a problem, answer a support request, prevent abuse, or meet legal obligations. More specific notices on a product screen apply to those features.

Websites, apps, and infrastructure may record IP address, browser and device type, operating system, system language, referring page, pages visited, timestamps, crashes, performance, interaction events, and logs needed to prevent fraud and protect service security.

Some public pages use website analytics and session replay to find confusing or broken interfaces. Privacy masking is enabled and recording scope is limited. These tools are not used to intentionally collect passwords, payment details, complete API content, or sensitive information you did not choose to submit.

We may use cookies, local storage, or similar technologies to maintain sign-in, save language and theme, restore a workflow, measure visits, and protect services. You can limit non-essential technologies through your browser, but some functions may stop working correctly.

When you email us, start a support conversation, submit a ticket, or contact another official channel, we process contact details, account or order identifiers, messages, attachments, and operational records needed to resolve the issue.

To protect accounts and transactions, we may ask for enough information to verify that a request belongs to you. Support will not ask for your full password, verification code, recovery code, or complete payment credentials.

We use information to create and protect accounts, provide products and APIs, complete payments and delivery, calculate usage and charges, generate test results, answer support requests, diagnose failures, prevent abuse, improve products, and meet tax, accounting, compliance, and other legal obligations.

We do not sell any user data.

To provide the service, we may give necessary information to cloud hosting and delivery providers, model upstreams, payment and reconciliation providers, identity providers, email providers, analytics and error-diagnosis tools, support systems, and security vendors. They may process information only for the relevant task and under their contractual and security obligations.

We may also disclose information when required by law or reasonably necessary to investigate fraud or attacks, protect users and services, enforce agreements, or preserve legal rights. If the business is involved in a merger, financing, reorganization, or asset transfer, information may transfer with the business subject to applicable confidentiality and legal requirements.

Retention depends on the purpose. Account, order, payment, usage, security, and support records are kept as long as needed to provide services, reconcile accounts, resolve disputes, audit activity, prevent fraud, or meet legal obligations. Aggregated or de-identified data may be kept longer.

Request statistics for the model API service and model performance data are retained long term for billing reconciliation, historical usage queries, performance analysis, and service security. Personal information rights requests are handled under Section 11 and applicable law.

We use access controls, transmission protections, permission boundaries, logging, and other technical and organizational measures appropriate to the risk. No internet transmission, third-party platform, or storage system can be guaranteed completely secure.

You can update some account information, stop using services, limit non-essential analytics through browser controls, and avoid submitting sensitive information that is not needed to provide the service.

Where applicable law gives you these rights, you may request access to, correction of, deletion of, or export of information about you, restrict or object to certain processing, or withdraw consent-based processing. We may verify your identity to protect accounts, orders, and API assets, and may retain information required by law or needed to resolve disputes.

XiuLab Inc serves multiple regions and uses distributed infrastructure and global providers. Information may be processed outside your region, with contractual, access-control, or other safeguards applied as required by applicable law.

XiuAI services are not directed to minors who cannot provide valid consent on their own. Minors should use services only with a guardian's permission and guidance and should not independently purchase products, create API access, or submit sensitive personal information.

We may update this policy when product features, data practices, or legal requirements change. The new update date will appear on this page. Material changes will be explained through a page notice, account notice, or another appropriate channel.