Privacy policy

1. Operator and scope of application

Rate C Ltd, a company registered in Hong Kong, determines the purposes and means of processing personal data of Rate Cloud users. For questions about access, correction and deletion of data, contact [email protected]. This Policy applies to the website, registration, personal account, API and the associated Telegram bot.

The provision of data necessary for the account, authorization and API operation is mandatory for the relevant service; without it the account or individual features cannot function. Telegram linking is required for the free trial and certain confirmations, but not for every method of using paid access. Data designated as optional may not be provided.

2. What data is processed

During registration and sign-in, the name, email, password hash, email confirmation flag, Google identifier when this sign-in method is chosen, session records, and consent to the document edition are processed. When linking Telegram, the identifier of the linked account and data necessary for message delivery and action confirmation are processed.

For API security and operation, masked key information, their hashes and settings, IP addresses, browser and device information, login and request timestamps, selected model, technical status and rejection reason, duration, usage data when received, security events and slot restrictions are processed. The service is not designed to store the full text of prompts and responses in the account request log; the content of requests is transmitted to the selected model provider for processing.

When a payment exists, the order number, selected model, amount, currency, payment time and status, payment event and refund identifiers are processed. Full bank card details are not requested or stored by Rate Cloud through the account. In correspondence with support, messages and information that the User voluntarily provides to resolve the request are processed.

3. Purposes of use and recipients

Data is used for creating and protecting the account, providing access and trial, executing API requests, applying restrictions, accounting for paid periods, support, diagnostics, preventing abuse, complying with mandatory requirements, and resolving disputes. Data is not sold to third parties and is not used for direct marketing without a separate appropriate legal basis.

Data may be transferred as necessary to infrastructure and content delivery network providers, model providers for request processing, confirmation email delivery providers, Google when chosen for sign-in, Telegram when linking or contacting support, and once payments are connected — to the payment provider. Transfer is limited to the necessary scope and the corresponding purpose. The model provider may process request content under its own terms; do not submit information there that cannot be disclosed to third parties.

Infrastructure and recipients may be located outside Hong Kong or the User's country of residence. For such transfers, the Operator applies available contractual and technical safeguards and assesses the requirements of applicable law.

4. Cookies and security

The website uses necessary cookies and similar mechanisms for session, security, protection against automated requests, OAuth transition and user interface settings. Disabling necessary cookies may make sign-in impossible. Rate Cloud does not store the full API secret in browser persistent storage; after creation or reissue, it is shown once. The User must store the secret independently.

Access to data is limited by operational necessity. Access control, secret hashing, technical event logging, network restrictions and backup are applied. No system can guarantee absolute security; upon a confirmed incident, the Operator takes measures and notifies affected individuals and authorities where required by applicable law.

5. Retention periods

Detailed request logs, model probes and slot records are deleted under the current retention policy after 30 days. The minimum timestamp of the first successful request within a paid period is retained alongside the purchase record for refund eligibility verification. Short-lived confirmation tokens and OAuth states are deleted after expiry and an additional technical period. Account data is stored while it remains active and as long as necessary for service delivery, security, accounting and protection of legal claims. Paid transaction data may be stored longer to the extent required by law and accounting standards.

After account deletion, personal fields are cleared or deleted, except for data whose retention is required by law or is necessary to prevent abuse, perform accounting or resolve disputes. Retention periods are reviewed by data purpose; indefinite storage solely for the Operator's convenience is not applied.

6. User rights

The User may request information about stored personal data, access to it, correction of inaccuracies and deletion where permitted by law. Requests are sent to [email protected] from the account address or after another secure identity verification. The Operator responds within the timeframe provided by applicable law and explains the legal basis for denial if the request cannot be fully fulfilled.

The User may opt out of optional processing and notifications through available settings. Opting out of processing that is necessary for contract performance or security may require discontinuing the relevant function or deleting the account. Complaints about data processing may be directed to the Operator and the competent supervisory authority.

7. Changes

In the event of a material change in purposes, categories of recipients or processing procedures, the new edition is published with an effective date and, where required, a separate notice is provided to the User or consent is requested. The previous edition does not apply retroactively to justify an incompatible new purpose.