Privacy Policy

This policy applies to the SU8 Codes public website, console, API gateway, documentation, accounts, plans, top-ups, orders, and support services. Information submitted to model providers, payment services, email services, or other external websites may also be governed by their own privacy policies.

Account and identity information may include the email address used for sign-in, display name, avatar, language preference, verification status, and an account identifier provided by an enabled third-party sign-in service. We also process information needed for sessions, verification, password resets, and account invitations.

Workspace and access information may include personal or team workspace names and identifiers, members and roles, invitations, and API key names, status, expiry, model scope, and usage permissions. API keys are used for authentication and management and are protected with hashes, encryption, or limited display fragments; full keys are not sent as anonymous analytics fields.

Service, usage, and billing information may include request time, requested model and provider, status, input and output token counts, image counts, latency, cost, usage source, workspace and key associations, as well as plan, subscription, balance, top-up, order, refund, and invoice records.

For sign-in protection, abuse prevention, security auditing, and troubleshooting, we may process IP addresses, browser or device information, request identifiers, error summaries, and information you voluntarily send to support.

To complete a model call that you initiate, request content is sent to the model provider you select and processed by the SU8 gateway for authentication, protocol conversion, usage measurement, and response delivery. Normal usage records contain the metadata and token measurements needed for usage and billing, not complete request or response content as anonymous analytics data.

To handle a security incident or technical fault, authorized operators may enable limited request or response troubleshooting records with a defined scope, reason, and duration. These records are managed separately from anonymous analytics, and complete content is not stored by default. Do not submit API keys, passwords, or other unnecessary sensitive information in a request.

We use information to provide and maintain accounts, the console, the API gateway, model routing, plans, balances, billing, orders, invoices, and support; verify sign-in, process verification challenges, and send account or service notices; calculate usage and enforce access and quota controls; and detect abuse, protect the service, troubleshoot faults, and meet applicable legal obligations.

Unless you separately agree, we do not use personal information for marketing unrelated to SU8 Codes services. Optional anonymous usage analytics is enabled only after you explicitly allow it or close the informed Cookie notice, which counts as allowing it.

To provide requested features, we may send necessary request data to the model provider you select, checkout and payment information to payment processors, recipient addresses and notification content to email providers, and relevant metadata to verification or abuse-prevention services when enabled. These services should process information only as needed to provide their services; their own privacy policies apply.

We may also share necessary information when required by law, to protect users and service security, investigate fraud or disputes, or complete a business transfer. We do not sell personal information and do not send raw account email addresses, names, phone numbers, or workspace identifiers to the analytics service as analytics fields.

Necessary cookies maintain sign-in sessions, remember language and theme preferences, and save your Cookie choice. Without a valid consent record, we do not load optional analytics scripts, create an analytics identity, or send analytics events. Choosing “Essential cookies only” does not enable optional analytics.

You can withdraw anonymous analytics consent at any time through Cookie settings in the footer. Withdrawal stops future optional analytics but does not affect sign-in, billing, or completed business records. Closing the browser, refreshing, navigating, timing out, signing in, or purchasing does not by itself imply consent.

After you allow anonymous analytics, or close the informed Cookie notice, we collect masked page visits and engagement time, referrer host, approved campaign markers, coarse device and browser environment, language and theme preferences, and an anonymous session identifier that is not directly identifying.

If you are signed in and have allowed anonymous analytics, some fixed registration, first-successful-call, or payment milestones may use a controlled, irreversible identifier generated by SU8 for attribution. It does not contain or directly reveal your email address, name, phone number, or workspace identifier.

Anonymous analytics does not collect or retain model inputs or outputs, form or search text, API keys, passwords, cookie values, authorization credentials, full IP addresses, raw internal account identifiers, email addresses, phone numbers, names, workspace identifiers, order or payment identifiers, full URLs, mouse movements, keystrokes, copied content, session replay, raw error content, or performance metrics. We also disable automatic collection of forms, inputs, copies, buttons, link clicks, URL parameters, and other automatic interaction data.

Raw anonymous analytics events are retained for up to 90 days and then deleted under the applicable retention policy. An analytics failure does not change registration, API calls, billing, payment, or any other business result.

We retain account, order, usage, and security records for as long as needed to provide the service, process billing, resolve disputes, complete security audits, and meet applicable legal obligations. Console request logs are kept for up to 30 days and have a maximum query window of 30 days, and raw anonymous analytics events are retained for up to 90 days. Actual periods may differ by record type, status, purpose, and applicable law.

We use access controls, least-privilege practices, credential protection, operational auditing, and service isolation to protect information. Sensitive credentials should not be written to plaintext logs; API keys and analytics credentials are managed by restricted server-side processes. No network transmission is risk-free, so protect your account and API keys.

You can manage account information and API keys, withdraw anonymous analytics consent, and, where applicable law permits, request access to, correction of, deletion of, or restriction of processing for your personal information. Some information is necessary for account, billing, security, or legal functions, and deletion or restriction may affect those services.

To make a privacy request, use the Contact page and include the request and enough account information for verification. We verify the requester before acting and handle the request subject to applicable law and necessary retention obligations.

We may update this policy when our services, legal obligations, or data practices change. Updated versions will be published here with a new effective date; material changes may also be communicated through appropriate service notices. Send security issues to security@su8.codes. For account, billing, or privacy questions, use the Contact page.