AIHubMix Privacy Policy

Last updated: September 8, 2026

This Privacy Policy (this “Policy”) describes how AIHubMix, LLC and its subsidiaries and affiliates (collectively, “AIHubMix,” “we”, “us”, or “our”) collect, use, disclose, retain, and otherwise process personal data in connection with the AIHubMix website, API, platform, and related products and services (collectively, the “Services”).

This Policy applies to individual users, business customers, and other authorized users of the Services (collectively, “you” or “your”).

We are committed to protecting your privacy and personal data. We process your personal data in strict compliance with applicable privacy laws globally. Jurisdiction-specific terms are provided in the Annex.

Third-Party Services Excluded: This Policy does not apply to third-party applications, products, or services integrated with or accessible through our Services—such as third-party Large Language Models (LLMs) including Claude, Gemini, DeepSeek, Qwen, and Llama. Your interactions with third-party providers are governed by their respective privacy policies.

Please read this Policy carefully. If you have any questions regarding our privacy practices or wish to exercise your rights, please contact us using the contact information provided in the “How to Contact Us” section.

1. Who Is Responsible for Processing Your Personal Data

For information about the entity responsible for your personal data in your jurisdiction, please refer to the applicable section of the Annex, "Jurisdiction-Specific Additional Terms."

2. Collection and Use of Personal Data

We process your personal data only as necessary to provide, maintain, secure, and improve the Services and to fulfill the purposes described in this Policy. You are required to provide only the personal data necessary for the applicable function. You may choose whether to provide additional information. We will indicate whether certain information is required or optional and explain the potential impact if you choose not to provide the required information. We collect personal data that you provide directly, personal data collected automatically by our systems, and personal data obtained from third parties. The specific circumstances are described in the relevant sections of this Policy.

2.1. Registration and Login

You may register to use certain features of the Services. During registration, you are required to provide the requested information, including your username, email address, and password. You may also choose to access the Services using a third-party platform account, such as a GitHub or Google account. In that case, we may receive certain information from the third-party provider, such as your account identifier and email address, depending on the permissions you grant. We use this information to create and manage your account and provide access to the Services.

We retain your account information for as long as your account remains active. If your account remains inactive for an extended period, we may classify the account as inactive in accordance with our account management practices. You may request deletion of your account at any time.

2.2. Account Settings

You may manage your account settings through the AIHubMix platform. During this process, we may collect information such as your email address. We use this information to maintain and manage your account.-

Account data is retained only while the account remains active, after which it will be deleted or anonymized.

2.3. Providing Products and Services

When you use AIHubMix, we collect your personal data as necessary to provide, maintain, and secure the Services.

To provide the AIHubMix API gateway service, we collect information such as your IP address, requested model name, request timestamp, token usage, and other usage-related information. We use this information to provide and maintain the API service, authenticate API requests, monitor usage, and manage service performance.

To provide API usage history, call record queries, usage statistics, and billing details, we may process API call metadata, such as request time, model name, token usage, response status, and fee-related information. Unless otherwise described in this Policy or enabled at your request, API call records do not include the content of your prompts or model outputs.

We use API usage and billing-related information to display usage statistics, calculate fees, provide billing records, reconcile account balances, process refunds or credits, and respond to customer service requests.

We retain the information described above for as long as necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements. After the applicable retention period expires, we will delete or anonymize the information.

For clarity, by default, AIHubMix does not retain the content of your API requests or responses, except in the limited circumstances described below.:

1. Account-specific debugging. We will enable debugging mode only when you request technical support and consent. Request data collected in this mode will be used solely for troubleshooting purposes and deleted or anonymized when no longer necessary.

2. Responses from third-party models involving policy violations. Third-party model providers, such as OpenAI and xAI, may apply their own content safety and compliance mechanisms. If a request triggers a policy violation response from a third-party model provider, our email notification system may send a notification to you. In such cases, the notification email may include limited information necessary to explain the reason for the notification. Such information may be processed and retained temporarily through email delivery systems and related logs for security, compliance, and service notification purposes.

3. Where you consent to disable the ZDR or similar functions, we will collect, store, and use your personal data strictly in accordance with the AIHubMix ZDR Terms or similar terms. Please refer to the AIHubMix ZDR Terms for details.

2.4. Payment Services

If you purchase membership plans, API call quotas, or other paid Services, your payment may be processed through third-party payment service providers. Our payment service providers may include Stripe and Alipay. We may collect payment-related information, such as payment amount, order number, and payment status, to verify transactions, process payments, and provide the purchased Services. Payment-related information may be shared with our third-party payment processors to process transactions and manage subscriptions, renewals, refunds, or other account-related changes.

For more information about how Stripe and Alipay process personal data and about your privacy rights and choices, please refer to https://www.alipay.com/ and https://stripe.com/privacy.

We retain payment-related information for as long as necessary to provide the Services, process transactions, maintain financial records, comply with legal obligations, resolve disputes, and enforce our agreements.

2.5. Customer Service

You may contact us through the email address provided in the Services. When you contact us by email, you are required to provide personal data, including contact name, contact number, contact email, company name, position, and products of interest. We use this information to respond to your inquiries and service requests, improve the Services, and achieve other related purposes.

Information collected to provide customer service is retained only while the account exists or for the minimum period necessary to perform the relevant functions, after which it will be deleted or anonymized.

2.6. Service Stability

We process operational data needed to authenticate users, provide and bill for API services, investigate errors, and protect the Services. Separately, with your consent, we use Google Analytics for optional website usage analysis to improve our website, not for advertising. Website analytics is not strictly necessary to use AIHubMix. Accepting this Privacy Policy or continuing to browse does not by itself constitute consent to optional analytics.

Necessary operational records and optional website analytics serve different purposes and are handled separately:

• Necessary operational records may include IP addresses, access times, authentication and security events, API key identifiers, requested models, token consumption, and billing records, to the extent needed to provide and protect the Services. Rejecting website analytics does not disable these necessary activities.

• Optional website analytics may include page visits, selected clicks and scrolling events, browser and device information, and pseudonymous cookie or account identifiers. Analytics is limited to website usage and service improvement; it is not permission to collect your prompts, model outputs, API key secrets, passwords, email addresses, payment details, or sensitive form contents through Google Analytics.

• Optional conversion analysis may include clicks on registration or payment links and selected steps in a purchase flow. It is separate from the transaction records required to process payments and provide billing information. Accepting analytics does not authorize payments or automatic recharge and does not change API access, pricing, or ZDR settings.

AIHubMix determines the purposes and configuration of its website analytics and remains responsible for its own data processing obligations. Google provides the Analytics service under the applicable data processing terms. Details of analytics Cookies and your choices are provided in our Cookie Policy.

2.7. API Keys and Access Management

To access the API service, you must create and manage API keys. An API key is the sole credential for accessing the AIHubMix service and should be treated like a password. You are responsible for keeping your API keys secure. You may generate, view, and delete API keys through the console. Please note that your key is displayed only once at the time of creation. You should copy and store it securely. Once the key creation pop-up is closed, you will not be able to view the key again. If you do not create an API key, you will not be able to call the AIHubMix API service.

When you use the API service, we collect and process only the following limited technical and usage data reasonably necessary to provide the API Services, and we do not intentionally collect information unrelated to these purposes:

• API request metadata

• Request parameters (e.g., model name, token limit, etc.)

• API response metadata (e.g., token consumption, response status code, etc.)

Key Management. You may generate and manage API keys through the AIHubMix console (https://console.aihubmix.com/).

Key Revocation. You may delete an API key at any time in the console. After deletion, API calls using that key will stop immediately.

3. Disclosure and Transfer of Personal Data

We may disclose or transfer your personal data to the following categories of recipients. We do not provide personal data to third parties for their own marketing purposes.

• Our Affiliates

  We may disclose or transfer your personal data to our affiliates that assist us in operating, developing, and optimizing the Services. Our affiliates will take organizational and technical measures to safeguard your personal data and will not use your personal data in violation of this Policy.

• Our Business Partners

  We engage business partners to perform relevant functions on our behalf, such as model service providers, cloud service providers, data analytics service providers, and website monitoring service providers. These business partners may access personal data only to the extent necessary to perform their duties and may not use it for any other purpose. They must also process personal data in accordance with this Policy and all applicable data protection laws.

• Public Authorities

  We may disclose or transfer personal data where permitted or required by law, such as in response to court orders or subpoenas. To the extent permitted by applicable law, we may also disclose personal data: (i) in response to requests from law enforcement or public authorities; (ii) to prevent suspected crimes or assist public safety investigations; (iii) to protect the security, integrity, and operational continuity of our websites and systems and those of our service providers; or (iv) to mitigate potential legal liability.

We do not transfer your personal data to third parties without your explicit consent and, in particular, we do not use it for advertising or marketing purposes. Your data will be disclosed only when you have given explicit consent or when we are required or permitted to do so by law, official directive, or court order. This typically includes sharing with law enforcement agencies, preventing security risks, or enforcing intellectual property rights.

During transmission, we protect your data using technical measures such as HTTPS encryption.

We process your personal data only to provide the services you request. Where we engage external service providers, they are granted access solely for service delivery purposes. We implement technical and organizational safeguards to comply with data protection laws and require equivalent compliance from our external partners.

We do not sell your personal data, including any "sale" as defined under California law. We also do not "share" your personal data, as "sharing" is defined under California law.

4. Retention of Personal Data

The personal data we collect from you will be stored on servers located on Google Cloud in the United States. Such information and data may be transferred to, accessed from, stored in, or displayed in the countries, regions, or locations where we collect the information and data.

We delete your personal data promptly once the original purpose for collection has been fulfilled. If applicable law requires specific retention periods or record-keeping obligations, we will retain the data only until those statutory obligations expire, after which it will be securely deleted.

We are committed to protecting your privacy. We have established a dedicated technical team and built systems and processes designed to comply with data security technical standards. We also seek to prevent unauthorized access to, use of, or disclosure of your personal data through measures such as access controls and security incident response. However, given the inherent vulnerabilities of the Internet and the rapid evolution of malicious attacks, we cannot guarantee absolute or 100% security. Security issues beyond our control may still occur. If they do, we will use commercially reasonable efforts to address security incidents promptly.

As a preventive measure, we also remind you to strengthen the security of your account and information, including by using more complex passwords, changing them regularly, exercising caution when disclosing sensitive personal information, and paying attention to device permission settings when changing devices. We may also notify you from time to time of new security attack methods and preventive measures. Please pay close attention to such notices.

5. Cross-Border Transfer of Personal Data

To provide global AI API routing, your personal data may be accessed, transferred, or processed globally, particularly in the United States and other jurisdictions where our entities or cloud infrastructure partners operate. All cross-border transfers are conducted in compliance with applicable data transfer mechanisms

6. Data Subject Rights

Subject to limitations under applicable law, as a data subject, you may have the right to know, access, correct, amend, delete, restrict processing of, transfer, object to decisions made solely based on automated processing of, and not be discriminated against for exercising rights relating to your personal data. You may also withdraw your consent, object to our processing of your personal data based on legitimate interests, and lodge a complaint with a supervisory authority.

We will use reasonable efforts to enable you to exercise your rights in accordance with applicable laws and regulations. When you seek to exercise your rights, we may ask verification questions to protect your personal data. If you have questions about this Policy or encounter issues when exercising your rights, you may submit a written request to the email address provided in this Policy.

We reserve the right to charge a reasonable fee if a request for access to or correction of data is manifestly unfounded or excessive, particularly because of its repetitive nature.

Please note that personal data rights vary across jurisdictions because applicable laws and regulations differ. For detailed information about specific rights and applicable response times, please refer to the Annex, "Jurisdiction-Specific Additional Terms."

7. Electronic Communications

If you subscribe to updates, we may send newsletters or feature announcements. We utilize a double opt-in verification process. You may opt out marketing emails at any time by clicking the "Unsubscribe" link. Essential system notifications/Service communications (e.g., security alerts, maintenance updates) cannot be unsubscribed.

8. Protection of Personal Data

We have implemented appropriate technical and organizational measures to help prevent unauthorized access, maintain data accuracy, and ensure the proper use of the information we hold. If we become aware of a data breach, we will notify you and the regulatory authorities within the timeframe and scope required by applicable laws and regulations.

We have established a system access privilege control policy. System access privileges follow the principle of least privilege, meaning users may access only the functions and data within their authorized scope. User information is stored in the system database, and query permissions are managed by role level. We have established internal approval and authorization processes and record employee operation logs.

In addition, our corporate values, ethical standards, policies, and practices are designed to protect users' rights and interests. In general, our business practices limit the use and disclosure of information to authorized personnel, processes, and transactions. However, despite customary control measures, we cannot eliminate all risks.

While we implement robust technical controls, no internet transmission or electronic storage is completely secure. Therefore, although we use appropriate technical and organizational measures to protect the information we hold for you, we cannot guarantee the security of information you transmit over the Internet.

9. Personal Data of Minors

The Services are intended exclusively for adult users and businesses and are not directed to minors.. We do not collect or solicit personal data from minors (under 13 in the US, under 16 in the EU/UK, or as defined locally). If you believe a minor has submitted personal data without parental consent, please contact us for immediate deletion.

Definitions and rights relating to minors or children vary across jurisdictions because applicable laws and regulations differ. For detailed definitions of personal data of minors or children, please refer to the Annex, "Jurisdiction-Specific Additional Terms."

10. Cookies and Similar Technologies

We use Cookies to enhance your browsing experience, including by enabling you to navigate between pages efficiently and remembering your login information and preferences. Strictly necessary cookies placed on the website are essential for the website to function and cannot be switched off. For more information about cookies, please review our Cookie Policy.

11. Updates to this Policy

We may update this Policy from time to time to reflect changes in our practices, the Services, legal requirements, or other operational considerations.

When we update this Policy, we will provide notice as required by applicable law, such as by posting the updated Policy through the Services or by providing notice through other appropriate means. The “Last Updated” date at the top of this Policy indicates when it was most recently revised.

We encourage you to review this Policy periodically to stay informed about how we process personal data. Additional jurisdiction-specific requirements relating to updates to this Policy are described in the Annex, “Jurisdiction-Specific Additional Terms.”

12. How to Contact Us

If you have any questions, feedback, or legal inquiries regarding these Services, please reach out to us at:

• Email: feedback@aihubmix.com

We will respond to verified requests within the timeframes required by applicable law.

13. Dispute Resolution

DEPENDING ON YOUR JURISDICTION, YOU MAY ALSO HAVE THE RIGHT TO LODGE A COMPLAINT WITH A COMPETENT DATA PROTECTION AUTHORITY IF YOU BELIEVE THAT OUR PROCESSING OF YOUR PERSONAL DATA VIOLATES APPLICABLE LAW.

ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING OUT OF OR RELATING TO THIS PRIVACY POLICY SHALL BE REFERRED TO AND FINALLY RESOLVED BY ARBITRATION ADMINISTERED BY THE SINGAPORE INTERNATIONAL ARBITRATION CENTRE ("SIAC") IN ACCORDANCE WITH THE SIAC ARBITRATION RULES IN FORCE. THE SEAT OF ARBITRATION SHALL BE SINGAPORE. THE TRIBUNAL SHALL CONSIST OF ONE (1) ARBITRATOR, AND PROCEEDINGS SHALL BE CONDUCTED IN ENGLISH.

CLASS ACTION WAIVER: ALL CLAIMS MUST BE BROUGHT IN AN INDIVIDUAL CAPACITY AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS, CONSOLIDATED, OR REPRESENTATIVE PROCEEDING.

IF YOUR COUNTRY OR REGION OF RESIDENCE IS LISTED IN THE ANNEX TO THIS POLICY, NAMELY THE EUROPEAN UNION, THE UNITED STATES, SOUTH KOREA, SINGAPORE, OR INDONESIA, THIS POLICY WILL BE GOVERNED BY THE LAWS OF THAT JURISDICTION. FOR ALL OTHER COUNTRIES OR REGIONS, THIS POLICY WILL BE GOVERNED BY THE LAWS OF SINGAPORE.

Annex: Jurisdiction-Specific Additional Terms

1. European Union

1.1. Identity

In the context of providing the Services in Europe, we are subject to the General Data Protection Regulation (GDPR). Under the GDPR, AIHubMix, LLC acts as a "data controller."

1.2. Categories, Purposes, and Legal Basis for Processing Personal Data

Under the GDPR, there are six legal bases for processing personal data.

The categories, purposes, and legal bases for our processing of personal data are as follows.

1.3. Data Subject Rights

1. Right of Access. You have the right to obtain confirmation from us as to whether your personal data is being processed and to request a copy of that data.

2. Right to Rectification. You have the right to request that we rectify inaccurate or incomplete personal data without undue delay.

3. Right to Erasure ("Right to be Forgotten"). You have the right to request that we erase your personal data in the following circumstances:

   • The personal data is no longer necessary for the purposes for which it was collected or otherwise processed.

   • You withdraw your consent and no other legal basis applies to the processing.

   • You object to the processing and there are no overriding legitimate grounds for the processing.

   • The personal data has been unlawfully processed.

   • The personal data must be erased to comply with a legal obligation under Union or Member State law to which the data controller is subject.

   • The personal data was collected in relation to the offer of information society services to a child under 16.

4. Right to Restriction of Processing. You have the right to restrict our processing of your personal data in any of the following circumstances.

   • You contest the accuracy of the personal data, for a period that enables us to verify its accuracy.

   • The processing is unlawful, and you oppose erasure of the personal data and request restriction of its use instead.

   • We no longer need the personal data for processing purposes, but you require it for the establishment, exercise, or defense of legal claims.

   • You object to processing, pending verification of whether our legitimate grounds override yours.

5. Right to Data Portability. You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller, provided that: (a) the processing is based on consent; and (b) the processing is carried out by automated means.

6. Right to Object. You have the right to object to data processing on specific grounds, including: (a) processing based on legitimate interests; (b) processing based on public interest or official authority; (c) processing for direct marketing purposes, to which you may object at any time; and (d) processing for scientific or historical research purposes or statistical purposes, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

7. Right Not to Be Subject to Automated Decision-Making (including profiling). You have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you.

8. Right to Lodge a Complaint. If you believe that our processing of your personal data does not comply with this Policy or applicable data protection regulations, you have the right to lodge a complaint with a supervisory authority. For complaint procedures, please visit: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en

We will respond to your request within one month, or within two months if the request is complex or you have made multiple requests.

1.4. Children's Personal Data

Children are not our target audience, and we do not intentionally collect or maintain any data from children under 16. If you believe that we may hold any data provided by or relating to a child under 16, please contact us using the contact methods in "12. How to Contact Us."

2. United States

2.1. Definitions

The term "personal information" refers to "personal data," "personal information," or other similar terms, and "sensitive personal information" refers to "sensitive personal information," "sensitive data," or other similar terms, in each case as defined under state privacy laws, excluding exempted information.

2.2. Identity

This section informs California consumers of their rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). Because we provide the Services in a uniform format, this section also applies to customers in other regions of the United States. Under the CCPA and CPRA, AIHubMix, LLC acts as a "business."

2.3. Processing of Personal Information over the Past 12 Months

2.4. Data Subject Rights

Under the CCPA and CPRA, California consumers have the right to know, access, correct, and delete their personal data. They also have the right to opt out of the sale or sharing of their personal data by a business and the right not to be discriminated against for exercising their California privacy rights. These rights are described below.

1. Right to Know and Access. You have the right to know the details of the personal information we collect, use, disclose, sell, or share and to request a specific copy of that information.

2. Right to Correct. If the personal information we hold about you is inaccurate, you have the right to request its correction.

3. Right to Delete. Subject to certain exceptions prescribed by law, you have the right to request that we delete your personal information.

4. Right to Opt Out. You have the right to direct us to stop "selling" or "sharing" your personal information with third parties for cross-context behavioral advertising.

5. Right to Limit Use. You have the right to direct us to limit our use of sensitive personal information to uses necessary to perform the Services.

6. Right to Non-Discrimination. We will not deny you services or provide a different level or quality of services because you exercise any of the rights described above.

We do not sell or share the personal data of California consumers, as those terms are defined under California law, and we do not discriminate against consumers for submitting privacy rights requests. We also do not use or disclose sensitive personal data in a manner that would require users to exercise the right to limit use under California law.

We will respond to a consumer's request within 45 days.

2.5. Do Not Track (DNT)

We do not track our customers over time and across third-party websites to provide targeted advertising and therefore do not respond to DNT signals.

2.6. Children under 13

Children are not our target audience, and we do not intentionally collect or maintain any data from children under 13 years of age. If you believe that we may hold any data provided by or relating to a child under 13, please contact us using the contact methods in "12. How to Contact Us."

3. South Korea

3.1. Identity Determination

In the context of providing the Services in South Korea, we are subject to the Personal Information Protection Act (PIPA). Under the PIPA, AIHubMix, LLC acts as a "data controller."

3.2. Rights of Data Subjects

1. Right to Know. You have the right to obtain detailed information concerning the processing of your personal data.

2. Right of Access. You may request access to your personal data.

3. Right to Data Portability. You may request a copy of your personal data from us and request its transfer. You may request that the information be transferred to you or to an institution specialized in managing personal data. The transfer request may be withdrawn.

4. Right to Rectification and Erasure. You may request that we rectify or delete your personal data. However, if the personal data is required to be collected by laws and regulations, deletion is not permitted.

5. Right to Suspend Processing. You have the right to request that we suspend the processing of your personal data, and you also have the right to withdraw your consent.

6. Right to Object to Automated Decision-Making. If processing of your personal data through fully automated systems, including artificial intelligence, significantly affects your rights or obligations, you have the right to object to the relevant decisions. You may also request an explanation of automated decisions that have been made.

7. Right to Compensation. You have the right to claim compensation from us for any damages you suffer as a result of our violation of this Act.

4. Singapore

4.1. Identity Determination

In the context of providing the Services in Singapore, we are subject to the Personal Data Protection Act 2012 (PDPA). Under the PDPA, AIHubMix, LLC acts as an "organization."

4.2. Measures Taken to Ensure Accuracy

To ensure the accuracy of the personal data we collect and hold, you agree not to submit inaccurate or misleading information to us and agree to notify us of any inaccuracies or changes in that information. We reserve the right, in our sole discretion, to require further documentation to verify any information you provide.

4.3. Data Subject Rights

1. Right of Access. You have the right to know about your personal data in our possession or under our control, and information about the ways in which that personal data has been or may have been used or disclosed within one year before the date of your access request. We will respond to your access request as soon as reasonably possible.

2. Right to Correction. You have the right to correct an error or omission in your personal data and to supplement incomplete personal data. We will respond to your correction request as soon as practicable.

5. Indonesia

5.1. Identity Determination

In the context of providing the Services in Indonesia, we are subject to Indonesia's Personal Data Protection Law No. 27 of 2022 (PDPL). Under the PDPL, AIHubMix, LLC acts as a "data controller."

5.2. Data Subject Rights

1. Right to Know. You have the right to request information about the purposes of processing and our responsibilities.

2. Right to Supplement and Rectify. You have the right to request completion of incomplete personal data or correction of errors.

3. Right to Access and Obtain a Copy. You have the right to access and obtain a copy of your personal data.

4. Right to Erasure. You have the right to request termination of processing, deletion, and/or destruction of your personal data.

5. Right to Withdraw Consent. You have the right to withdraw your consent to our processing of your personal data.

6. Right to Object to Automated Decision-Making. You have the right to object to decisions made solely on the basis of automated processing.

7. Right to Delay or Restrict Processing. You have the right to delay or restrict the processing of your personal data in proportion to the purposes of personal data processing.

8. Right to Complain and Claim Compensation. You have the right to lodge a complaint with a supervisory authority and to claim compensation for damages caused by our violation of applicable data protection laws.

9. Right to Data Portability. You have the right to obtain and use your personal data from us in a structured, commonly used, and machine-readable format. You also have the right to transmit your personal data to other data controllers, provided that the systems used are capable of securely communicating with each other.