APIONE Privacy Policy

1. Scope and Data Controller

This Policy applies to the processing of information by NICECLOUD LLC ("APIONE", "we" or "us") when you visit the website, register an account, use web chat, generate images or video, create an API Key, call the API, configure a client, top up, subscribe, view bills or contact support. APIONE is the controller of this information.

Where an enterprise customer submits data to us on behalf of its end users, the enterprise customer is the controller of that data, and APIONE processes it on the customer's instructions and under the data processing agreement.

Third-party models, payment institutions, sign-in platforms and clients may act as independent controllers subject to their own privacy policies.

2. Information We Collect

We do not collect sensitive personal information unrelated to the Service. Please do not send full API Keys, sign-in credentials, bank card details, verification codes or sensitive information unrelated to your request to support.

3. API Content, Web Sessions and Clients

3.1 API Content

By default, APIONE processes API inputs and outputs only for as long as needed to complete the request and does not keep the full bodies afterwards; only the call metadata listed in Section 2 is kept. We keep the necessary content in the following cases:

On routes labeled ZDR in the product, the third case applies only to call metadata, and we will not keep full bodies because of it.

3.2 Web Chat

Web chat is kept in your session history so you can return to it, until you delete it; chats in private mode are not saved to history. After you delete a session, we remove it from active systems within 30 days, and copies in backups are cleared within 90 days as backups rotate.

3.3 Clients

Local client sessions and configuration are stored on your device and managed by you. Third-party tools may store keys in plain text, so protect your devices, file permissions and backups. The client uploads necessary diagnostics only with your consent.

Before using one-click configuration, confirm which applications and configuration files will be changed and back up important data.

4. How We Use Information and Legal Bases

We use information to provide accounts, the API, web chat and creation, model routing, client configuration, billing, refunds and support; to protect system and account security; to handle disputes and unlawful conduct; to meet legal obligations; and to improve performance and the product using de-identified or aggregated data.

Our legal bases include performing our contract with you; our legitimate interests in security, fraud prevention and improving the Service; complying with legal obligations; and your consent where applicable law requires it. Marketing emails and non-essential website analytics are used only with your consent, which you can withdraw at any time.

5. Upstream Providers and Sharing

APIONE does not sell personal information and does not share it for cross-context behavioral advertising. We bind the service providers that process information on our behalf through contracts, least-privilege access and audits. In a merger, acquisition or asset transfer, we will notify you and require the recipient to continue protecting your information under this Policy; if the purpose of processing changes, we will notify you again and obtain consent where required.

6. Team Workspaces and Referrals

1. Once you join a team workspace, its Owners and Admins can see your usage, call logs, the keys you create and your administrative activity within that workspace. This does not make the content of your chats visible to them.
2. After you leave a workspace, the records above remain with that workspace.
3. When you take part in the referral program, the referrer can see the referred user's masked email, sign-up date and order amounts on the points page, and nothing else about them.

7. Where Data Is Stored and Cross-Border Transfers

APIONE's operating entity is located in the United States. Account, billing, support and call metadata is stored mainly on servers in the United States. When you call a model, inputs, files and necessary technical information are sent to that model's upstream provider and may be processed in the United States or other countries and regions; we disclose upstream providers and their main processing regions on the model pages.

If you are located outside the United States, your information will be transferred to the United States and to the locations of upstream providers for processing. For regions whose laws require a specific transfer mechanism, we use the appropriate mechanism, such as standard contractual clauses, or obtain your consent as required.

Where the product offers the relevant features, you can choose routes limited to specific regions, ZDR or no training. If no route meets your conditions, we will reject the request or ask you to adjust your settings.

8. Cookies and Similar Technologies

Declining analytics and marketing cookies does not affect the basic functions of your account, the API or web chat.

9. Data Security

APIONE uses measures such as HTTPS encryption in transit, password and key hashing, least privilege, access approval, operation auditing, environment isolation, vulnerability management, backups, disaster recovery and security incident response.

A full API Key is shown only once, when it is created, and is not displayed to staff in the everyday back office. Staff may access related content only to the minimum extent necessary, with authorization and an audit trail, when you request support, in a serious security incident, in a dispute or as required by law.

If a security incident may affect your rights, we will take remedial action and notify you and the relevant authorities within the period required by applicable law.

10. Retention and Deletion

1. Retention periods for each type of information are set out in Sections 2 and 3. When they expire, we delete or anonymize the information.
2. When you close your account, its API Keys stop working immediately. We delete or anonymize your account data and user content from active systems within 30 days, and copies in backups are cleared within 90 days; financial, tax, security and dispute records that must be kept by law are deleted when the relevant period ends.
3. Unused top-up balances are handled under the refund rules of the APIONE Terms of Service.

11. Your Rights

Send privacy requests to support@apione.ai with "Privacy" in the subject line. We will respond within 45 days of receipt; for complex requests we may extend this by another 45 days and will tell you why. You may make a request through an authorized agent, and we will verify the agent's authorization and your identity.

We will carry out reasonable identity verification. If we refuse a request, you may appeal, and we will respond in writing within 45 days of receiving the appeal with the outcome and our reasons; if you are not satisfied, you may complain to your state attorney general or data protection authority. We will not deny you service, charge you a different price or provide a lower quality of service because you exercise these rights.

12. Minors

The Service is not directed at individuals under 18 or under the age of majority where they live, and we do not knowingly collect their personal information. If we discover that we have collected it by mistake, we will stop processing and delete it promptly. Parents and guardians can contact us at support@apione.ai.

13. Additional Information for Specific Regions

1. European Economic Area, United Kingdom and Switzerland: you have the rights provided by the General Data Protection Regulation and local law, including the rights listed in Section 11 and the right to lodge a complaint with your local data protection authority. Our legal bases are set out in Section 4, and cross-border transfers rely on lawful mechanisms such as standard contractual clauses.
2. California, Colorado and other U.S. states with consumer privacy laws: you have the rights listed in Section 11. We do not sell personal information, do not share it for cross-context behavioral advertising, and do not use it for automated decisions that produce legal or similarly significant effects.
3. Users in mainland China: when you call models outside mainland China, your information is transferred to the United States and the locations of upstream providers. To the extent required by law, we will inform you of the overseas recipient's name and the purpose and method of processing, and obtain your separate consent.

14. Updates and Contact

We may update this Policy and will update the version number and effective date on this page. For material changes involving the types of information collected, purposes, sharing, cross-border transfers, training, retention or your rights, we will notify you by email or in-product message at least 30 days in advance; where the law requires renewed consent, we will obtain it again. Previous versions are available on request at support@apione.ai.