Legal
Privacy Policy
We collect what we need to run an API business: your account, your billing and your usage. We do not sell personal data, and we do not use your prompts to train models. This page explains exactly what happens to your data.
1.Who is responsible
[legal entity], registered at [registered address], Indonesia, is the data controller for personal data processed through arx.ai.id and platform.arx.ai.id. For privacy matters, write to hello@arx.ai.id.
2.Data we collect
Account data
- Name, email address and password (stored only as a salted hash).
- Account settings, timezone and preferences.
- API key names, scopes, budget limits and expiry dates. Key values are shown once and stored hashed.
Billing data
- Credit balance, top-up history, invoices and tax identifiers you provide.
- Card data is entered on our payment provider's checkout and never reaches our servers.
Usage and technical data
- Per request: model, input, cached and output token counts, timestamp, latency, HTTP status, key identifier.
- IP address, user agent and request identifiers used for security, abuse prevention and debugging.
Support data
- Messages you send us, including any attachment you choose to include.
3.What we do not collect
- Card numbers and CVCs. Handled entirely by our payment provider.
- Prompt and completion content. We do not retain request or response bodies by default; our logs record metadata only.
- Sensitive categories. We do not ask for health, biometric or political data. Please do not send it to us in support messages.
4.How we use it
- Deliver the service — authenticate keys, route requests to the selected model, return output, enforce budgets. Legal basis: performance of a contract.
- Bill correctly — calculate token costs, apply top-ups, issue invoices, handle refunds and tax. Legal basis: contract and legal obligation.
- Keep the platform safe — detect abuse, fraud, credential leaks and attacks; enforce our Terms of Service. Legal basis: legitimate interests.
- Support and improve — answer tickets, fix bugs, understand aggregate usage patterns. Legal basis: legitimate interests.
- Tell you about the service — billing notices, security alerts and, with consent, product updates. You can opt out of marketing at any time.
We do not make automated decisions that produce legal or similarly significant effects about you.
6.International transfers
Our infrastructure and the model providers we route to may process data outside Indonesia. Where personal data leaves the country, we rely on appropriate safeguards such as standard contractual clauses with the recipient.
7.How long we keep it
- Account data — while your account is open, then up to 12 months for recovery and dispute handling.
- Usage metadata — up to 12 months, so you can audit spend and we can investigate abuse.
- Billing records and invoices — up to 10 years, as required by Indonesian bookkeeping rules.
- Support messages — up to 24 months.
- Server logs — short-lived, typically 30 days.
When a period ends, data is deleted or irreversibly anonymised.
8.Security
Traffic is encrypted in transit. Passwords and API keys are stored as hashes, access to production systems is limited and logged, and keys can be scoped, budgeted and revoked at any time. No system is perfectly secure; if a breach affects your data, we will notify you and the competent authority as required by applicable law.
9.Your rights
Under Indonesia's Personal Data Protection Law (Law No. 27/2022), and under the GDPR where it applies, you can ask us to:
- confirm what personal data we hold and give you a copy;
- correct inaccurate data;
- delete data we no longer need, subject to legal retention duties;
- restrict or object to certain processing, including direct marketing;
- provide data in a portable format;
- withdraw consent for anything based on consent.
Write to hello@arx.ai.id. We respond within 30 days and may need to verify your identity first. You can also complain to the Indonesian data protection authority or your local supervisory authority.
11.Children
The service is for businesses and developers and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a minor created an account, contact us and we will delete it.
12.Changes
We will update this page when our practices change and revise the date at the top. Material changes are announced by email to account holders before they take effect.
13.Contact
Privacy questions and requests: hello@arx.ai.id. Security reports: same address, with "security" in the subject line.