Legal
Privacy Policy
Xisu AI privacy policy: no real-name requirement, no collection of unrelated personal data, request and reply content not stored by default, never used for training or sold. What call and sign-in records contain, how long they are kept, who receives them, and your rights.
Our principle is simple: we handle only the minimum information needed to run the service, we do not collect personal data unrelated to it, we never use any of your data to train models, and we never sell it to anyone.
1. What we do not collect
- No real-name verification: we do not collect ID documents, phone numbers, addresses, contacts or similar identity data;
- By default we do not store the content of your requests or of the model's replies;
- No third-party advertising or behavioural analytics trackers, no cross-site tracking, no user profiling;
- No plaintext API keys: a key is shown once when you create it, and we keep only a hash that cannot be reversed.
2. Information the service needs
What you give us
- Your sign-up email, and your password stored as a hash (we never see the original);
- Two-factor authentication details (if you turn it on);
- What you write in support tickets, and any files you attach.
What is generated as you use the service
- Call records: time, model, input and output token counts, cost,
request_id, result status and source IP. These are the basis for billing, reconciliation and troubleshooting, and do not include the content of requests or replies; - Sign-in records: time, IP address and browser identifier, used to spot unusual sign-ins and protect your account;
- Billing records: orders, payment results and balance changes.
3. How request content is handled
- Your request has to be forwarded to the upstream model provider to get a reply, which is passed back to you unchanged. That leg is handled by the upstream provider under its own data policy.
- To block illegal content, request text goes through automated content safety checks (part of which is done by a third-party moderation API). The check returns only "pass" or "block"; we record which rule (and keyword) was matched and do not store the request text.
- Only when you ask us in a ticket to investigate a specific problem, and agree to it, do we temporarily turn on content sampling for the key concerned. Sampling lasts at most 24 hours, the content is stored encrypted and deleted automatically after 3 days, and every activation and every view is recorded in an audit log.
4. How we use this information
Only to: run the service, bill and reconcile, troubleshoot, detect abuse and fraud, and answer your tickets.
We never use any of your data to train models, never sell or rent it to third parties, and never use it for advertising.
5. Who receives it
- Upstream model providers: only the request content needed to complete the request;
- Payment providers: only the order details needed to complete a payment;
- Network and security providers: the site is served through a CDN that speeds it up and protects it from attacks, so requests pass through its network;
- When the law requires it: under valid legal process.
Beyond that, we do not give your information to any third party.
6. How long we keep it
| Information | Kept for |
|---|---|
| Per-call details | 40 days, after which only daily totals of usage and cost remain |
| Sign-in records | 30 days |
| Tickets and attachments | Deleted automatically 30 days after the last reply |
| Temporary content sampling (only with your agreement) | 3 days |
| Account details | While the account exists; deleted when you close it |
| Orders and payment records | Kept as needed for reconciliation, refunds and fraud prevention, and used for nothing else |
7. Cookies
The site uses only the cookies or local storage needed for sign-in, form security checks and interface preferences (such as language). We use no advertising or tracking cookies. Our CDN provider may set a necessary security cookie to tell malicious traffic apart.
8. Your rights
- View your call details and billing records in the console;
- Correct your account details, change your password and manage two-factor authentication;
- Ask for your account to be deleted through a ticket. Once it is deleted we remove your account details, except billing records the law requires us to keep or that are still being processed.
9. Security
The whole site is served over HTTPS; passwords and API keys are stored only as hashes; sensitive data such as content samples is encrypted at rest; back-office access requires two-factor authentication and is audit-logged.
No system can be perfectly secure. If an incident could affect the security of your data, we will tell you as soon as possible through an on-site notice or by email.
10. Minors
The service is not intended for anyone under 18, and we do not knowingly collect information about minors.
11. Changes to this policy
Revisions are published on this page, and material changes are announced on the site.
12. Contact
For privacy questions, reach us through a support ticket or on Telegram at @xisuai_support.