This policy explains what personal data NovaToken ("we") collects when you use novatoken.dev and the NovaToken API, why we collect it, and what rights you have. We keep it deliberately short because we collect very little.
| Category | Examples | Why |
|---|---|---|
| Account data | Email address, hashed password, account creation date | To create and secure your account |
| Billing data | Payment provider customer ID, credit balance, top-up history, country | To charge you and issue receipts. Card numbers never reach our servers. |
| Usage metadata | Timestamps, token counts, model name, HTTP status, latency, API key ID | To meter usage, bill correctly, detect abuse and debug failures |
| Technical data | IP address, user agent, approximate region derived from IP | Security, fraud prevention, rate limiting |
We do not retain the content of your prompts or the model's responses. Request bodies pass through our gateway to the inference backend and are not written to persistent storage. We also do not use your inputs or outputs to train or fine-tune models, and we do not sell personal data to anyone.
We use a small number of vendors who process data on our behalf:
We do not share data with advertisers or data brokers.
We process account and billing data to perform our contract with you; usage and technical data on the basis of our legitimate interest in keeping the service secure and correctly billed; and we rely on your consent where we send optional product announcements (which you can opt out of at any time).
Account data is kept while your account is open. Usage metadata is kept for up to 12 months for billing and dispute resolution. Billing records are kept as long as required by tax law. When you delete your account, account data is removed within 30 days, except records we are legally required to keep.
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to certain processing, and to lodge a complaint with your local data protection authority. To exercise any of these, email [email protected]. We respond within 30 days.
Our infrastructure and processors are located in several countries, including the United States, the European Union and Asia. Data may be transferred to and processed in countries other than yours. Where required, we rely on standard contractual clauses.
Traffic to the API and website is encrypted in transit (TLS). Passwords are stored using a one-way hash. API keys are stored hashed and shown to you only at creation. Administrative access to production systems is protected by multi-factor authentication. No system is perfectly secure; if we become aware of a breach affecting your data we will notify you without undue delay.
The Service is not directed to anyone under 18 and we do not knowingly collect data from children.
The marketing site sets no advertising or analytics cookies. The account console uses a single session cookie that is strictly necessary to keep you logged in.
We may update this policy; the "last updated" date above will change. Questions or requests: [email protected].