Privacy Policy

Last updated: August 7, 2026

1. Introduction

TokenEase ("we", "us", or "our") operates the website tokenease.io and provides AI model API gateway services. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our services. By accessing or using TokenEase, you agree to the collection and use of information in accordance with this policy. This policy is designed to comply with the General Data Protection Regulation (GDPR) for users in the European Economic Area (EEA), the California Consumer Privacy Act (CCPA) for California residents, and other applicable data protection laws.

2. Information We Collect

2.1 Account Information

When you register for an account, we collect your email address and any optional information you provide. Your email is used as your primary identifier and for service-related communications.

2.2 Payment Information

Payments are processed by our payment processor Paddle. We do not store your full credit card details on our servers. Paddle handles payment data in accordance with PCI-DSS standards. We receive transaction summaries including payment amount, date, and subscription plan from Paddle.

2.3 API Usage Data

We log all API requests for billing, debugging, and service improvement purposes. This includes: timestamp of request, model used, token counts (input/output), estimated cost, and your API key identifier. We do not store the full content of API requests or responses unless explicitly required for debugging with your consent.

2.4 Technical Data

We automatically collect technical information including IP address, browser type, operating system, referring URLs, and access times. This data helps us maintain security and improve service performance.

2.5 Communications

When you contact our support team, we collect and store the content of your messages to provide assistance and maintain records of our interactions.

3. How We Use Your Information

We use the collected information for the following purposes:

• Service Provision: To operate and maintain the TokenEase API gateway, authenticate your requests, and track usage for billing purposes.
• Billing and Accounting: To process payments, generate invoices, manage subscriptions, and calculate usage-based charges.
• Security: To detect and prevent fraud, abuse, unauthorized access, and other harmful activities.
• Service Improvement: To analyze usage patterns, monitor service performance, and develop new features.
• Communication: To send service announcements, billing notifications, security alerts, and optional marketing communications (which you can opt out of).
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.

4. Legal Basis for Processing (GDPR)

For users in the EEA, our legal basis for processing personal data depends on the specific context:

• Contract Performance: Processing necessary to fulfill our service contract with you (account management, API service, billing).
• Legitimate Interests: Processing for security, fraud prevention, and service improvement.
• Legal Obligation: Processing required to comply with tax, accounting, and other legal requirements.
• Consent: Processing based on your explicit consent, such as for marketing communications.

5. Data Sharing and Third Parties

5.1 Service Providers

We engage trusted third-party service providers to perform functions on our behalf:

• Paddle: Payment processing and subscription management.
• Cloud Infrastructure: Our servers are hosted on Alibaba Cloud (China region) and other cloud providers for global distribution.
• API Providers: When you make API requests through TokenEase, your requests (excluding your API key) are forwarded to the underlying AI model providers including DeepSeek, Zhipu AI (GLM), Alibaba Cloud (Qwen), ByteDance (Doubao), Moonshot AI (Kimi), and Tencent Cloud.

5.2 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., court orders, subpoenas).

5.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

5.4 We Do Not Sell Data

TokenEase does not sell, rent, or trade your personal information to third parties for marketing purposes.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Account Data: Retained while your account is active. Deleted within 30 days of account deletion request.
• API Usage Logs: Retained for 90 days for billing and debugging purposes, then aggregated and anonymized.
• Payment Records: Retained for 7 years to comply with tax and accounting obligations.
• Support Communications: Retained for 2 years for quality assurance and dispute resolution.

You may request deletion of your account and associated data at any time by emailing privacy@tokenease.io.

7. Data Security

We implement industry-standard security measures to protect your data:

• All API communications are encrypted using TLS 1.2 or higher.
• API keys are hashed before storage and never displayed in full after initial creation.
• Access to production systems is restricted to authorized personnel only.
• Regular security audits and vulnerability assessments are conducted.
• Database backups are encrypted and stored securely.

Despite our efforts, no security system is impenetrable. We cannot guarantee the absolute security of your data.

8. Data Residency and International Transfers

TokenEase is operated from China. Your data is primarily stored on servers located in China. When you use our API gateway, your requests may be forwarded to AI model providers located in various jurisdictions including China, the United States, and other countries.

For users in the EEA, when we transfer your personal data outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, to protect your data in accordance with GDPR requirements.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data ("right to be forgotten").
• Right to Restrict Processing: Request limitation of how we use your data.
• Right to Data Portability: Receive your data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests or for direct marketing.
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.

To exercise these rights, contact us at privacy@tokenease.io. We will respond within 30 days.

10. Cookies and Tracking

We use cookies and similar technologies for the following purposes:

• Essential Cookies: Required for the website to function (session management, language preferences).
• Analytics Cookies: Help us understand how visitors interact with our website.

You can control cookies through your browser settings. Disabling essential cookies may affect website functionality.

11. Children's Privacy

TokenEase is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you believe we have collected information from a child under 16, please contact us immediately and we will delete such information.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of the service after such changes constitutes acceptance of the updated policy.

13. Contact Us

For privacy-related questions, data subject requests, or concerns about this policy, please contact:

Email: privacy@tokenease.io
Address: TokenEase Privacy Team, Xi'an, China

We are committed to working with you to resolve any privacy concerns. If you are located in the EEA and believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local supervisory authority.