Kebijakan privasi

Dokumen ini diterbitkan dalam bahasa Inggris. Teks bahasa Inggris adalah versi yang berlaku; bagian lain situs ini diterjemahkan untuk kemudahan.

NeevAI Supercloud Private Limited (“ai.ml”, “we”), Indore, Madhya Pradesh, India. Last updated 6 October 2026.

This policy explains what personal data ai.ml collects, why, how it is used and stored, who it is shared with, and the choices you have. It covers the website ai.ml, the console at console.ai.ml, the API at api.ai.ml and sign-in at auth.ai.ml.

1. Who we are

ai.ml is a gateway for large language models: developers send requests in the OpenAI, Anthropic or Gemini format to one endpoint, and ai.ml routes each request to a model provider, returns the answer and meters the usage against prepaid credit. The service is operated by NeevAI Supercloud Private Limited, Unit No. 401, Plot No. 12/A/A, Astra Building, Scheme No. 74C, Vijay Nagar, Indore, Madhya Pradesh 452010, India.

We act in two roles. For the people who create an account and use the console, we decide why and how their data is used (data fiduciary under India’s Digital Personal Data Protection Act 2023, controller under the GDPR). For the prompts and responses a customer’s application sends through the API, we act only on that customer’s instructions (processor), under the data processing agreement.

Questions and requests about this policy go to [email protected] or to the grievance officer.

2. Information we collect

Information you give us

  • Account details: your name, e-mail address and password when you register. Passwords are stored only as a salted hash by our sign-in service; we cannot read them.
  • Organisation details: the organisation’s name, country, and the people you invite and their roles.
  • Billing details: legal name, billing address, billing e-mail address and tax identifier (GSTIN or PAN) where you provide one. Card numbers and bank details are entered on our payment processor’s page and never reach our systems; we receive the last four digits, the card network and the payment reference.
  • Access requests and support: what you write when you ask for access or contact support, including your company, role and intended use.

Information we receive when you sign in with Google

If you choose “Sign in with Google”, Google shares with us the basic profile information you approve on Google’s consent screen:

  • your name,
  • your e-mail address and whether Google has verified it,
  • your Google account’s unique identifier, and
  • the address of your profile picture.

We request only the openid, email and profile scopes. We do not request, access or store your Gmail messages, contacts, calendar, Drive files or any other Google data, and we never receive your Google password.

Information collected automatically

  • Sign-in and security records: the time of each sign-in, the IP address and browser it came from, and whether a second factor was used.
  • Usage records: for each API request, the model, the number of tokens, the cost, the latency, the time, a request identifier and the API key used. These are needed to bill you and to show your usage.
  • How you found us, only if you allow campaign measurement: if the link that brought you carried campaign tags or an advertising click identifier, we keep them with the page you landed on and the site that referred you.
  • Page views: each page of the website and each screen of the console tells our own servers that it was opened, so we can count visits. We keep the page, the referring site, the country and a one-day identifier made by hashing your IP address and browser with a key that is discarded after two days. We do not store the IP address with it, and the identifier cannot link one day’s visits to another’s.
  • Google Analytics, only if you allow analytics cookies on the website: Google then collects usage data through its own cookies, as described in section 10.
  • Technical logs: server logs of requests to our systems, including IP address and user agent.

Content sent through the API

Prompts and model responses pass through the gateway to the provider you selected. By default we do not store them. If your organisation turns on payload logging in its data policy, they are stored encrypted under a key specific to your organisation, for the retention period you chose.

3. How we use information

  • to create and secure your account and sign you in;
  • to provide the service: route requests, meter usage, apply budgets and limits, and show you your history;
  • to take payments, issue receipts and tax invoices, and keep the accounting records the law requires;
  • to send service messages: e-mail confirmation, password reset, security notices such as a new API key, billing notices and changes to these terms;
  • to detect and prevent fraud, abuse and security incidents;
  • to answer support requests;
  • to understand which of our own campaigns bring sign-ups, in aggregate.

We do not sell personal data, we do not use it for advertising to you on other sites, and we do not use your prompts or responses to train models.

How we use Google user data

The name, e-mail address and Google account identifier we receive from Google are used for one purpose: to create your ai.ml account and to recognise you when you sign in again. Specifically:

  • your e-mail address identifies your account and is where we send service messages;
  • your name is shown in the console and to the other members of your organisation;
  • the Google account identifier links your Google sign-in to your ai.ml account;
  • the profile picture address is not stored and not used.

We do not use Google user data for advertising, do not sell it, do not transfer it to third parties except the service providers described in section 5 who process it on our behalf to operate sign-in, and do not use it to develop, improve or train artificial-intelligence or machine-learning models. No person at ai.ml reads this data except where needed for security, to comply with law, or with your consent for support.

ai.ml’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Legal bases

Under the GDPR we rely on performance of our contract with you (running your account and the service), legal obligation (tax and accounting records, security logs), and legitimate interests (preventing abuse, securing the service, measuring our own campaigns). Under the DPDP Act we rely on the consent you give when you register and on the legitimate uses the Act permits.

5. Who we share information with

  • Model providers: the content of a request goes to the provider that serves the model you chose, and to no other. Your data policy can restrict providers to those that neither retain nor train on requests.
  • Service providers acting for us: hosting and network providers, our payment processor (Stripe), our billing system for tax invoices, our e-mail delivery provider, and Google Analytics for website visitors who accept it. They may use the data only to provide their service to us.
  • Other members of your organisation: your name, e-mail address and role are visible to them.
  • Authorities: where the law requires it, or to protect the rights and safety of our users and the service.
  • A successor: if the business is merged or sold, under the same commitments as this policy.

The model providers and infrastructure vendors in use are listed in the console under Settings, Data. We do not sell or rent personal data to anyone.

6. Where data is processed

Our systems are operated from India. Model providers may process requests in other countries. Providers outside India process data under the transfers the DPDP Act permits; for personal data from the EU we rely on the European Commission’s Standard Contractual Clauses. You can restrict processing to chosen regions in your data policy.

7. How long we keep information

  • Account data (including the name, e-mail address and Google identifier received from Google): for as long as your account exists, and deleted within 30 days of an erasure request.
  • Invoices, receipts and the credit ledger: eight years, as tax law requires.
  • Usage records: 400 days.
  • Stored prompts and responses, where you turned logging on: the period your data policy sets, then destroyed by deleting their encryption key.
  • System and security logs: 180 days, kept in India as CERT-In requires.
  • Campaign information in your browser: 30 days.

8. Your choices and rights

You can see and correct your account details in the console, export your organisation’s data, and ask for your account and its data to be erased. You may also ask us for a copy of the personal data we hold about you, object to a use of it, or withdraw consent. Write to [email protected] or the grievance officer; we answer within 30 days.

If you signed in with Google, you can remove ai.ml’s access at any time in your Google Account under Security, Third-party apps and services. Removing access stops future sign-ins through Google; to have the data we already hold deleted as well, ask us for erasure as above.

You may complain to the Data Protection Board of India or, in the EU, to your supervisory authority.

9. Security

Data is encrypted in transit and at rest. Secrets such as API keys are stored only as hashes or under envelope encryption with keys specific to each organisation. Access by our staff is limited by role and recorded in an audit log. If we confirm a breach affecting your data, we notify affected organisations and the Data Protection Board within 72 hours.

10. Cookies and similar storage

The first time you visit ai.ml we ask which optional cookies you allow. Nothing optional is set or loaded until you answer, and “Reject optional” is as easy to choose as “Accept all”. You can change your answer at any time with “Cookie settings” in the footer of the website.

Necessary (always on)

  • Sign-in cookies on console.ai.ml and auth.ai.ml keep you signed in.
  • Your cookie choice (aiml_consent, 180 days) records what you allowed, so we do not ask on every page.
  • Google sign-in: the website offers Google’s one-tap sign-in to every visitor, as part of signing in. To do that the page loads a script from Google, which lets Google know the page was opened and keeps a small cookie (g_state) recording whether you dismissed the prompt. Nothing is shared with us unless you tap the prompt, and tapping it starts the same Google sign-in described in section 2.

Optional (only if you allow them)

  • Analytics: Google Analytics cookies (_ga and related, up to two years) on ai.ml. If you do not allow this, nothing of Google Analytics is loaded. Google processes this data as described in its own privacy policy. Google Analytics is never loaded on the console.
  • Campaign measurement: a cookie (aiml_src, 30 days) records the campaign tags of the link that first brought you, as described in section 2. It is removed once you create an organisation, or when you withdraw this permission.

Preferences such as your language and display currency are kept in your browser’s local storage and are not sent to us. Our own visit counts use no cookie and need no permission. We do not use third-party advertising cookies.

11. Children

The service is for businesses and developers. It is not directed at anyone under 18, and we do not knowingly collect their personal data.

12. Changes to this policy

When we change this policy we update the date at the top and, for a material change, tell account owners by e-mail or in the console before it takes effect.

13. Contact

NeevAI Supercloud Private Limited, Unit No. 401, Plot No. 12/A/A, Astra Building, Scheme No. 74C, Vijay Nagar, Indore, Madhya Pradesh 452010, India. E-mail: [email protected]. Grievance officer: Noel Varghese, [email protected].