Privacy Policy

한국어 버전 보기

1. Introduction

BROZ Corp. ("Company," "we," "us," or "our") operates everyais, a multi-cloud AI API gateway service available at everyais.com (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By accessing or using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use the Service.

2. Information We Collect

2.1 Account Information

When you register for an account, we collect:

• Name and email address
• Phone number (optional)
• Organization information (optional)
• Authentication credentials managed through AWS Cognito

2.2 Payment Information

Payment processing is handled by a third-party processor (Hecto Financial). We do not store your full credit card number or payment credentials. We receive transaction confirmation data such as payment status, amount, and transaction ID.

2.3 API Usage Data

When you use our API, we collect:

• AI model used and provider routed to
• Token counts (input and output)
• Request timestamps and response times
• IP address
• API key identifier (hashed)

Usage logs do not include prompt or response bodies.

2.4 AI Input/Output Data

We do not collect prompts, completions, or generated media as a dataset. Bodies are held only as a 24-hour cache so you can retrieve outputs (presigned URLs). When that cache expires they are irrecoverably deleted from our databases and object storage. We do not use them for training, analytics, or any purpose other than delivering that request.

2.5 Device & Technical Data

We automatically collect technical information including browser type, operating system, IP address, device type, and referring URLs when you visit our website.

2.6 Cookies & Tracking

We use essential cookies for authentication and session management. Google Tag Manager and Google Analytics 4 are loaded only after explicit analytics consent; no cookieless analytics ping is sent before consent. Analytics covers acquisition, page, CTA, content, and completed lead interactions. It excludes user IDs, payment amounts, API keys, prompts, responses, and server-side activation events. You can reject or withdraw consent at any time through the "Privacy settings" control on this page.

Analytics and advertising are optional. Privacy settings lets you allow or reject both together. Previously saved preferences remain in effect until you update them. Google consent states default to denied (analytics_storage, ad_storage, ad_user_data, ad_personalization), with ads_data_redaction enabled. GTM is loaded only after analytics consent. Advertising consent permits remarketing and first-payment conversion measurement, including the consented gclid, gbraid, or wbraid click identifier, transaction ID, purchase value and currency through Google Data Manager. everyais encrypts click identifiers and retains them for up to 90 days. Email, phone, address, API keys, prompts and responses are not sent for this measurement. Withdrawing advertising consent deletes local advertising identifiers and updates your account; if the account update fails, Privacy settings displays a retry control. Refusal does not affect API access.

2.7 Inquiries

The business inquiry form collects purpose, company name, business email, message, and consent version, plus optional contact name, budget range, and adoption timeline. The support form collects inquiry type, reply email, message, and consent version. Neither collects a telephone number. When you open a ticket in our Discord support server, we receive your Discord username, user ID, and profile; what you write in the ticket (the service, when it happened, steps and error text, request, job, or order IDs, and the like) and attached files; and account details such as your sign-up email that you give us to handle the request.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process API requests and route them to appropriate AI providers
• Calculate billing and manage credits
• Authenticate users and manage API keys
• Respond to customer support inquiries
• Detect and prevent fraud, abuse, and security incidents
• Generate aggregated and anonymized analytics to improve our Service
• Comply with legal obligations

4. Data Retention

5. Data Sharing & Third Parties

We share your data only as necessary to provide the Service:

5.1 AI Cloud Providers

Your API input data (prompts) is forwarded to the selected AI provider for processing. These providers include AWS Bedrock, Google Gemini API, Nebius, Meta, and Z.AI. Each provider processes data according to their own privacy policies.

For Z.AI model requests, we entrust API input and output processing to JINGSHENG HENGXING TECHNOLOGY PTE.LTD (Z.AI) to perform inference and deliver results. API content is processed in real time without storage or use for model training. We do not consent to its use for model development or improvement.

5.1.1 Community suppliers (processing entrusted)

If you opt in to community supply, that request's inference may be entrusted to a third-party community supplier. This is off by default. You can turn it on or off (opt out) in dashboard settings at any time. We enter into a DPA with each supplier; they must delete prompts immediately after processing and must not store or train on them. On everyais, prompt and response bodies are still not collected and are fully deleted after the 24-hour cache.

We do not provide your input or output data to any provider for AI model training or retraining unless you explicitly opt in. The default is "not provided".

Some providers offer heavily discounted models ("training-tier models") on the condition that they may use inputs and outputs to train their own models. You can choose this by turning on "Allow training-tier models" in account settings. Even then, what is provided for training is limited to the inputs and outputs of requests you sent to a training-tier model by name while that setting was on. It does not apply to requests to any other model, nor to requests made before you turned it on. Requests made with an organization API key follow the organization setting, not the individual one. Training-tier models are labelled in the catalogue and model pages; accounts that have not opted in do not see them listed and are refused if they call them.

⚠️ This choice is only partially reversible. Turning the setting off stops future requests from being used for training, but content already incorporated into a trained model cannot be recalled. Do not use it for requests containing confidential or personal data.

Separately, certain models are subject to retention requirements mandated by the model provider:

5.2 Payment Processors

Payment data is processed by Hecto Financial (Korean domestic payments). We do not store your full payment credentials.

5.3 Infrastructure Providers

We use AWS for cloud infrastructure and Vercel for web hosting. Subject to your optional-data consent choices above, Google LLC processes limited website analytics through GTM and GA4, plus consented remarketing and first-payment conversion data through Google Data Manager. These providers may process data in the United States or other provider processing regions.

5.4 Customer Support

Support inquiries submitted through the contact form are forwarded to Discord Inc. so our support staff can review them. The forwarded data is the inquiry type, reply email, and message. Business inquiries are not forwarded. It is deleted 180 days after the last activity on a closed inquiry. Posts you make directly in our Discord support server are processed under Discord's privacy policy, and you can delete them in Discord yourself. Discord Inc. also runs the support server and sends and stores ticket messages and attached files, and Ticket Tool opens and manages tickets and creates transcripts of closed tickets. If you email portal@everyais.com directly instead of using the form or Discord, nothing is transferred to Discord Inc. or Ticket Tool.

5.5 No Sale of Personal Data

We do not sell, rent, or trade your personal information to third parties for marketing or advertising purposes.

6. International Data Transfers

Your data may be processed in multiple regions depending on the AI provider selected:

• United States (AWS us-east-1) — Authentication, billing, account management, and AI model inference via AWS Bedrock
• United States / Global — Google Gemini API processing
• United States / Google processing regions — consented website analytics through GA4/GTM (14 months) and consented advertising measurement through Google Data Manager; everyais retains encrypted click identifiers for up to 90 days
• Netherlands / Finland — Nebius Token Factory processing
• Singapore (general processing location) — JINGSHENG HENGXING TECHNOLOGY PTE.LTD (Z.AI) processes API input and output content sent over TLS when you call a Z.AI model. Content is not stored
• United States — Meta Model API processing. For training-tier models you opted into, inputs and outputs are additionally used by the provider to train their models
• United States — Discord Inc. receives support inquiries from the contact form over TLS for support review; deleted 180 days after the last activity on a closed inquiry
• United States — Discord Inc. (privacy@discord.com) receives your Discord username and user ID, ticket messages, and attached files over TLS when you open a ticket or send a message in our Discord support server, kept 3 years after the request is resolved (your Discord account information under Discord's policy)
• Not disclosed by the provider — Ticket Tool (support@tickettool.xyz) receives your Discord user ID, ticket messages, and attached files through Discord when a ticket is opened or closed, kept under its policy (it currently states it keeps data only as long as needed to provide its service)

We implement appropriate safeguards to protect your data during international transfers, including encryption in transit (TLS) and at rest.

Z.AI API processing follows its API Services DPA and Additional Terms for API Services. Separate retention conditions may apply to data other than API content, such as account or payment data.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — Request a copy of the personal data we hold about you
• Correction — Request correction of inaccurate or incomplete data
• Deletion — Request deletion of your personal data
• Portability — Request your data in a portable, machine-readable format
• Objection — Object to certain processing of your personal data
• Restriction — Request restriction of processing in certain circumstances

To exercise any of these rights, please contact us at portal@everyais.com. We will respond to your request within 30 days.

8. Data Security

We implement industry-standard security measures to protect your data:

• TLS encryption for all data in transit
• AES-256-GCM encryption for stored provider credentials
• SHA-256 hashing for API keys (plaintext keys are never stored)
• JWT-based authentication with JWKS verification
• Rate limiting to prevent abuse
• Regular security audits and monitoring

9. Children's Privacy

Our Service is not intended for individuals under the age of 14. We do not knowingly collect personal information from children under 14. If we learn that we have collected personal data from a child under 14, we will take steps to delete such information promptly.

10. Changes to This Policy

v1.9.0, effective October 18, 2026: added Discord Inc. as a processor and United States transfer for customer support inquiries, and the items and retention period of tickets in our Discord support server with Ticket Tool as a processor and international recipient.

v1.8.0, effective October 17, 2026: removed the overseas payment processor; overseas payments are not offered.

v1.7.0, effective October 16, 2026: changed the global payment processor and added the related international transfer.

v1.6.0, effective September 15, 2026: added Z.AI processing, disclosure, Singapore transfers, and API content retention and training conditions.

We may update this Privacy Policy from time to time. Changes will be identified by an updated version number and effective date. We will notify you of material changes through the Service or via email. Your continued use of the Service after the effective date constitutes your acceptance of the updated policy.

11. Contact Us

If you have any questions about this Privacy Policy, please contact us: