Privacy

This page says what we collect when you use the OSMEXO AI Model Exchange, why, how long we keep it, and who else handles it. We collect as little as the service needs.

Account data

Your email address, name, and either a password (stored as an Argon2 hash, never in clear) or your Google sign-in identity; your organisation’s name, billing country and members. Used to sign you in, to send you verification, password-reset and billing emails, and to contact you about the service. Sessions record a hash of your IP address and browser so we can spot a stolen session.

Request data

For every API and playground request we store metadata: model, tokens, cost, latency, status, the route that served it, and the time. It is kept for 90 days. Request and response content is stored only if your organisation turns on request logging in its settings, and then for seven days; it is never stored otherwise. Generated images, audio and video are kept on our storage for seven days so you can download them, then deleted. Content is sent to the third-party provider that serves the request under that provider’s terms; we do not use it to train models, and we do not sell it.

Billing data

Payments are processed by our payment providers through hosted checkouts: PayPal and card (Visa, Mastercard) outside India; card, UPI and netbanking through Razorpay in India. We store the transaction reference, the amount, the currency and the time. We never see or store card numbers, UPI ids or bank details.

Emails

We send emails to verify your address, to reset your password, to answer a free-credit or discount request, and for the alerts you switch on in the dashboard. They are delivered through Resend. We do not send marketing email.

Cookies and analytics

The dashboard sets one cookie, llm_session, to keep you signed in; it expires after seven days without use. This website uses Google Analytics 4 to count visits and see which pages are read; it sets its own cookies, and IP addresses are anonymised before storage. It also loads the Meta (Facebook) pixel, which sets its own cookies, so that our ads can be shown to people who visited this site and withheld from people who already have an account; when you create an account we tell Meta that a registration completed, identified only by a one-way hash of your email. The Reddit pixel does the same job for Reddit ads: it sets its own cookies and records page visits and clicks on the sign-up button, nothing from your account. Nothing else from the website is joined to your account data.

Security records

Sign-in attempts, key creation and revocation, member changes and billing changes are written to security and audit logs so we can investigate abuse. Security events are kept for 90 days; audit records for as long as your account exists. Secrets, prompts and completions are never written to logs.

Who processes your data

The model providers that serve your requests (only the request content, never your account), PayPal and Razorpay for payments, Resend for email, and Google for sign-in (if you use it) and for website analytics. We do not share personal data with anyone else except when the law requires it.

Retention

Account and billing records are kept while your account exists and afterwards as long as tax law requires. Request metadata is kept for 90 days, request content (when logging is on) and generated media for seven days, security events for 90 days. Closing your account from the dashboard disables it at once; we then delete the personal data we are not legally required to keep.

Your rights

You can export or delete your data, correct it, or ask questions, through the contact form. We answer within two business days.