Privacy Policy隐私政策

This Privacy Policy explains how Telixus.Co collects, uses, discloses, stores, and protects personal data when you use our website, dashboard, API gateway, payment features, support channels, and related services.

This policy is designed to provide notice about our data practices. Depending on your location, additional privacy rights may apply under laws such as Singapore's Personal Data Protection Act 2012, the GDPR, the UK GDPR, the California Consumer Privacy Act, or other applicable laws.

1. Data Controller / Organisation

For purposes of this policy, Telixus.Co is the organisation responsible for personal data collected through the Platform, unless a separate agreement states otherwise.

Contact for privacy requests:

Email: support@telixus.co

If your organisation uses Telixus.Co to process data on behalf of its own users, your organisation may be responsible for providing its own privacy notice and obtaining any required consents.

2. Personal Data We Collect

We may collect the following categories of data.

Account Data

• email address
• username or display name
• password hash
• account status, role, user group, subscription status
• two-factor authentication configuration metadata
• authentication provider identifiers if you use OAuth or social login.

API and Usage Data

• API key metadata, such as key name, status, creation time, last used time, group binding, quota, and rate-limit settings
• request metadata, such as request ID, endpoint, method, model, status code, latency, token counts, cost, charge, and error category
• IP address, User-Agent, approximate network information, and security headers needed for abuse prevention and access control
• upstream provider, upstream model, routing decision, fallback status, and provider error metadata where needed for operations.

Prompt, Input, Output, and File Data

Your prompts, inputs, files, instructions, and model outputs may be transmitted to upstream AI providers as necessary to process your requests.

By default, Telixus.Co is designed not to store raw prompt and response content in normal logs unless a specific feature, diagnostic mode, abuse investigation, user request, or administrator-controlled configuration enables such storage. If content logging is enabled, it should be limited, access-controlled, encrypted where supported, and retained only as long as necessary.

You should not submit sensitive personal data, regulated data, confidential information, trade secrets, payment card data, health data, government identifiers, or third-party data unless you have the right to do so and have implemented appropriate safeguards.

Payment and Billing Data

• order ID, provider transaction ID, amount, currency, payment type, status, timestamps, refund status, and chargeback status
• billing balance, ledger entries, usage charges, top-ups, refunds, reversals, and manual adjustments
• limited payer information returned by payment providers where necessary for reconciliation, fraud prevention, or support.

We do not intentionally collect or store full card numbers or CVV codes. Card and wallet payment details are handled by payment providers.

Support and Communications

• messages you send to support
• attachments you provide
• contact details and communication history
• issue metadata such as order IDs, request IDs, or account IDs.

Device, Cookie, and Analytics Data

We may collect basic device and browser information, session data, language preferences, security cookies, and local storage data needed for login, user preferences, legal consent, fraud prevention, and site functionality.

3. How We Use Personal Data

We use personal data to:

• provide, operate, secure, and improve the Platform
• authenticate users and administer accounts
• issue, validate, disable, and audit API keys
• route API requests to appropriate upstream providers
• calculate usage, cost, charges, margin, balance, and billing records
• process payments, refunds, chargebacks, reconciliation, and taxes
• detect abuse, fraud, excessive usage, payment risk, account compromise, and policy violations
• provide customer support
• send service, security, billing, legal, and operational notices
• comply with legal, regulatory, payment-provider, sanctions, export-control, accounting, and tax obligations
• establish, exercise, or defend legal claims.

4. Legal Bases Where Applicable

Where a legal basis is required, we may process personal data based on:

• your consent
• performance of a contract with you
• our legitimate interests in operating, securing, improving, and preventing abuse of the Platform
• compliance with legal obligations
• protection of vital interests where applicable
• other lawful bases permitted by applicable law.

5. Disclosure of Personal Data

We may disclose personal data to the following categories of recipients where necessary.

Upstream AI Providers

API request content and related technical metadata may be sent to upstream AI providers to process model requests. We aim to avoid sending unnecessary internal identifiers such as your API key ID, account email, organisation name, or customer ID to upstream providers.

Upstream providers process data under their own terms and privacy policies.

Payment Providers

Payment information may be shared with payment processors such as Stripe, Airwallex, Alipay, WeChat Pay, EasyPay-compatible providers, banks, card networks, and fraud-prevention services.

Infrastructure and Operations Providers

We may use hosting, database, logging, monitoring, email, security, analytics, customer support, and storage providers.

Legal, Safety, and Compliance Recipients

We may disclose data where required by law, court order, regulator, law enforcement, sanctions screening, tax authority, payment provider, or to protect rights, safety, and security.

Business Transfers

If Telixus.Co is involved in a merger, acquisition, restructuring, financing, or sale of assets, personal data may be transferred as part of that transaction, subject to appropriate safeguards.

6. International Transfers

Data may be processed in Singapore and other countries where we, our infrastructure providers, payment providers, upstream AI providers, or support providers operate.

Where applicable law requires transfer safeguards, we will use appropriate measures such as contractual protections, comparable protection obligations, standard contractual clauses, or other lawful transfer mechanisms.

7. Retention

We retain personal data only as long as reasonably necessary for the purposes described in this policy, including service operation, billing, tax, accounting, dispute resolution, fraud prevention, abuse investigation, security, legal compliance, and backup retention.

Typical retention considerations include:

• account data: while your account remains active and for a reasonable period after closure
• billing, payment, ledger, and tax records: as required for accounting, tax, fraud prevention, and dispute handling
• API usage metadata: as needed for billing, analytics, security, and troubleshooting
• raw prompt or response content, if enabled: only for the configured retention period or as needed for security/legal purposes
• support messages: as needed to resolve issues and maintain records.

When data is no longer needed, we will delete, anonymize, or aggregate it where reasonably practicable, unless retention is legally required.

8. Security

We use administrative, technical, and organisational measures designed to protect personal data. These may include access controls, hashed downstream API keys, credential masking, encryption in transit, secret handling, audit logs, rate limits, risk controls, and monitoring.

No system is completely secure. You are responsible for protecting your password, devices, API keys, local environment variables, and downstream applications.

9. Your Rights

Depending on applicable law, you may have rights to:

• access personal data we hold about you
• correct inaccurate data
• delete personal data
• restrict or object to processing
• withdraw consent
• receive a portable copy of certain data
• complain to a data protection authority.

To exercise rights, contact support@telixus.co. We may need to verify your identity and may retain certain data where required for legal, security, billing, or fraud-prevention reasons.

10. Children's Privacy

The Platform is not intended for children under 13, or a higher minimum age where required by local law. If you believe a child has provided personal data, contact us so we can take appropriate action.

11. Cookies and Local Storage

We may use cookies, local storage, and similar technologies for authentication, preferences, language settings, security, legal consent, payment flow continuity, and basic site functionality.

You may control cookies through your browser, but disabling necessary cookies may prevent the Platform from functioning properly.

12. Third-Party Links and Services

The Platform may link to third-party services, upstream providers, payment providers, documentation, or support channels. Their privacy practices are governed by their own policies, not this Privacy Policy.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The effective date will be updated when changes are made. If changes are material, we may provide notice through the dashboard, login agreement, email, or other reasonable means.

14. Contact

For privacy questions, data requests, or complaints, contact:

Email: support@telixus.co