Privacy Policy

This policy explains what TokLab (toklab.ai) collects when you create an account and call models through our API, why we collect it, and who else sees it. Write to [email protected] with any question about it.

What we collect

• Account data. When you sign in with Google we receive your name, email address and profile picture. We store them so your account, balance and API keys belong to you.
• Billing records. For every top-up we store the amount, currency, time and the payment reference returned by our payment processor. We never see or store your card number.
• Usage records. For every API request we store the model you called, the time, whether it succeeded and what it cost, so your balance and usage page are correct and auditable.
• Request content. Prompts, reference files and the outputs a model returns pass through our systems while your request is being fulfilled.
• Technical data. IP address, browser type and similar request metadata, used to keep the service available and to detect abuse.

Advertising and site analytics

Google Ads, Pageview, Rybbit and Cloudflare Web Analytics load automatically on our site; they are not controlled by the X tracking preference. These services receive page/referrer, browser and network information to measure visits, interactions, advertising performance or site performance. Google Ads may use cookies and browser identifiers. For registration and purchase conversions, our code supplies account email and, when available, name to Google's tag for enhanced conversions; purchase events can include the transaction identifier, amount and currency. Rybbit's script can also use browser storage and visitor identifiers. There is no site-wide consent banner. Browser privacy settings and blocking tools can limit these requests.

X advertising measurement

When enabled for the site, the X Pixel loads automatically unless you have turned it off in X privacy choices. It measures visits, new accounts, API key creation and confirmed Stripe or PayPal top-ups. This shares opaque conversion IDs, the X click ID when available, and the actual paid amount and currency with X, together with browser and network information collected by its script. This integration does not send your email address, phone number, prompts, generated content or API keys. We associate campaign identifiers with conversion receipts in our database until account deletion; first-party campaign cookies last up to 30 days. You can turn X measurement off or back on in X privacy choices on any page. This control affects X only; it does not change the other advertising or analytics services described above. See our Cookie Policy for storage and withdrawal details.

Why we use it

We process account, billing and usage data to perform the contract you enter when you open an account. We use technical data to operate and secure the service. We use the advertising and analytics information described above to understand site usage and advertising performance.

Who else sees it

• Model vendors. To fulfil a request, its content is sent to the vendor of the model you chose. They process it under their own terms.
• Payment processing. Top-ups are handled by our payment processor, which receives the data it needs to take the payment.
• Infrastructure. Hosting, database and storage providers process data on our instructions.
• Advertising and analytics services. Google Ads, Pageview, Rybbit, Cloudflare Web Analytics and X receive the information described above.

We do not sell personal data and we do not use your prompts or outputs to train models of our own.

How long we keep it

Account, billing and usage records are kept while your account is open and afterwards only for as long as tax and accounting rules require. Request content is kept only as long as needed to deliver the result and to investigate failures.

Your rights

You can ask for a copy of your data, ask us to correct it, or ask us to delete your account and the data attached to it. Some billing records must be retained by law even after deletion. Write to [email protected] and we will answer.

Security

Access to production data is limited to the people who need it. Traffic to and from toklab.ai is encrypted in transit. No service can promise perfect security, so tell us immediately at [email protected] if you believe your account or key has been exposed.

Changes

If this policy changes materially we will post the new version here and update the date at the top of this page.