Privacy Policy

Oxyy ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our API platform and website.

Account Information

When you register, we collect your name, email address, and payment information. This is necessary to provide the Service and process billing.

Usage Data

We collect aggregated usage metrics such as number of API calls, model usage, credit consumption, and timestamps. This data is used for billing, analytics, and service improvement.

API Prompts and Responses

We do not use your prompts or model outputs to train any model, and we do not sell them. A request is passed to the AI provider that serves it and the answer is returned to you. Request content is kept only in the cases below, for the periods listed under Data Retention:

• Idempotent retries. If you send an Idempotency-Key header, the finished reply is stored so that a retry with the same key returns the same answer instead of running (and charging) twice. Streamed replies are never stored this way.
• Asynchronous jobs. Image, audio and video requests that run as jobs are saved as a job record — the request you sent (including the prompt) and the result — so you can poll for and retrieve the output.
• Stored Responses API conversations. When you call the Responses API (POST /v1/responses), the input you sent with that request and the response returned to you are stored, encrypted, so that a later request can continue the conversation with previous_response_id and you can retrieve the response by its id. Only your own account (any of its API keys, or you when signed in) can read, continue or delete it. Nothing is stored when you send store: false, or for a model marked zero data retention in our catalogue. You can delete a stored response at any time with DELETE /v1/responses/{id}.
• Failed requests. When a request fails, we record which providers were tried and the errors they returned, with credentials removed and without your prompt. If you ask our support team to investigate failing requests, we can turn on payload capture for your account; the body of each failed request is then kept for a short time with credentials redacted and uploaded files stripped out.

• To provide, maintain, and improve the Service
• To process billing and payments
• To send important service notifications
• To detect and prevent fraud or abuse
• To comply with legal obligations

We do not sell your personal information. We may share data with:

• Payment processors (Stripe, Cryptomus, NOWPayments) for billing
• AI model providers (only the API request data, as required to fulfill your request)
• Law enforcement, if required by law

We implement industry-standard security measures including encryption in transit (TLS 1.3) and encrypted storage for sensitive data. API keys are hashed and never stored in plaintext.

• Account information: as long as your account is active.
• Usage metrics (model, token counts, charges, timestamps — no prompt or response content): for as long as they are needed for billing and your account’s usage history.
• Idempotent replies: 24 hours, then deleted automatically.
• Stored Responses API conversations (input and response, encrypted): 24 hours after the latest stored turn of the conversation, then deleted automatically; continuing a conversation keeps all of its turns for another 24 hours. A response you delete with DELETE /v1/responses/{id} is removed at once.
• Asynchronous job records (request and result): result links expire after 24 hours; the job record itself is kept with your account. Ask us at the address below and we will delete it.
• Failed-request records (providers tried and their errors, no prompt content): up to 90 days.
• Failed-request bodies (only when payload capture is on for your account): 3 hours by default, and never more than 30 days, then deleted automatically.

You have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request deletion of your account and data
• Export your usage data
• Opt out of marketing communications

Our website uses essential cookies for authentication and session management, and stores your preferences (such as theme and cookie choices) in your browser. We do not use advertising cookies. Optional analytics are only ever enabled with your consent through the cookie banner, and you can change your choice at any time. The full list of what we set and why is in our Cookie Policy.

The Service is not intended for users under 18 years of age. We do not knowingly collect information from minors.

Your data may be processed in the United States. By using the Service, you consent to such transfers.

We may update this Privacy Policy from time to time. We will notify you of material changes via email or platform notification.