Privacy Policy — AI Nexus

1. Who we are and what this policy covers

This Privacy Policy explains how RAYTREND TECHNOLOGY LIMITED ("AI Nexus", "we", "us"), the operator of useainexus.com, processes personal data when you visit this website or use our model API platform. We act as the data controller for the processing described here.

This policy applies to the international platform at useainexus.com. Our mainland China service is operated separately under its own privacy policy.
Where you use the Platform through your employer or a client, we act as their processor for the content they send to the API. See section 4.
We do not sell personal data, and we do not run third-party advertising or tracking scripts on this website.

2. How we collect personal data

From you: account details (name, email, company, billing country), API keys you create, support and sales correspondence, and payment or invoice records.
From your use of the API: request metadata (timestamp, model, token counts, latency, status code, source IP, request identifier) and the technical payload required to route the call.
From your browser: language preference, device and browser type, and pages viewed, through first-party logs.
From third parties: payment providers confirming transactions, and upstream model providers returning generation results.

3. Why we process data and our lawful basis

Purpose	Data	Lawful basis (GDPR)
Provide the API service and route requests	Account, API key, request metadata, payload	Performance of a contract
Meter usage, bill and issue invoices	Usage records, billing data	Performance of a contract; legal obligation
Keep the Platform secure and detect abuse	IP, logs, anomalous patterns	Legitimate interest (security)
Answer support and sales enquiries	Contact details, correspondence	Legitimate interest; performance of a contract
Improve reliability and capacity planning	Aggregated, de-identified usage statistics	Legitimate interest
Comply with law, court or regulator requests	Relevant records	Legal obligation

We do not process your content for model training. We do not build advertising profiles and we do not make decisions based solely on automated processing that produce legal or similarly significant effects.

4. Prompt and output content (customer personal data)

Text, image and video material sent through your API key may contain personal data. You decide why and how it is processed, so you are the controller and we are the processor for that material.
We process that material only to execute the call, return the result, meter usage, and provide debugging and abuse prevention, in accordance with your instructions and these terms.
You must have a lawful basis for any personal data you submit, give required notices to your end users, and avoid submitting sensitive data unless your use case genuinely requires it.
You can instruct us to delete or export specific request records through the console or by emailing [email protected], subject to the retention floors in section 7.
Content moderation may be applied by upstream models. Refused or filtered requests are logged as metadata, not as full content, except where needed to investigate a security incident.

5. Who we share data with

Upstream model providers: the content of your API requests is transmitted to the third-party model provider that serves the model you selected, so it can generate the result.
Payment and invoicing providers: transaction data needed to take payment and issue documents.
Infrastructure and hosting providers: who store and transmit data on our behalf under written confidentiality and security obligations.
Professional advisers, insurers and auditors: under duties of confidentiality.
Authorities: where we are legally required, and to the minimum extent necessary.
We never sell personal data and never disclose it for third-party marketing.

A list of sub-processors is available on request from [email protected]. We update that list before materially changing a sub-processor and will tell account holders where a change affects them.

6. International transfers

We operate from Hong Kong and use providers located in Hong Kong, Singapore, Japan, the United States and the European Economic Area. Data may therefore be transferred outside the region where you are based.
Where a transfer requires a transfer mechanism under GDPR or the UK GDPR, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision, together with technical and organisational safeguards.
Where transfers require safeguards under the Personal Data (Privacy) Ordinance of Hong Kong, we apply contractual and technical measures that give a level of protection comparable to that Ordinance.
Contact [email protected] for a copy of the applicable safeguards.

7. How long we keep data

Data category	Retention period
Account and profile data	Active account life, plus 12 months after closure for legal and fraud prevention
API request and response content	30 days for debugging, unless disabled in your console settings where that feature is available
Usage and metering logs	7 years to support billing, disputes and audits, matching the record-keeping period for invoices
Security logs (IP, auth events)	180 days
Support and sales correspondence	3 years from the last exchange with us
Invoices and transaction records	As required by Hong Kong tax and company record-keeping rules, normally 7 years

After a retention period ends, data is deleted or irreversibly anonymised. Where deletion is not immediately possible (for example in encrypted backups), the data is isolated and deleted once backup cycles expire.

8. Your rights

Under the GDPR and UK GDPR: access, rectification, erasure, restriction of processing, objection to processing, data portability, and the right to withdraw consent where consent is the basis.
Under the CCPA/CPRA: the right to know what personal information we collected, disclosed or sold (we do not sell it), the right to delete, the right to correct, and the right to limit use and disclosure of sensitive personal information.
Under Hong Kong's Personal Data (Privacy) Ordinance: the right to request access to and correction of your personal data held by us.
Exercise any right through the console or by emailing [email protected]. We respond within 30 days and may need to verify your identity first. You may use an authorised agent, and we do not discriminate for exercising your rights.
If you are an end user of a business that uses our API, direct your request to that business, which controls your data.

9. Cookies and local storage on this website

This marketing website sets no advertising, profiling or third-party tracking cookies.
Your language choice is stored in your browser's localStorage so the site remembers the version you selected. This is strictly necessary for the preference to work and is not used for any other purpose.
Standard server access logs (IP address, timestamp, requested path, HTTP status, user agent) are kept for security and capacity management.
If we later add analytics or any non-essential cookie, this page will be updated and a consent prompt will appear before such cookies are set.

10. Security

Traffic to the API and this website is encrypted in transit with TLS.
API keys are stored independently of application data, are shown once at creation, and can be rotated or revoked at any time.
Access to production systems is role-based, logged and limited to personnel who need it; contractors are bound by confidentiality obligations.
We maintain backups, monitoring and incident response procedures, and review our controls periodically.
No method of transmission or storage is completely secure. Please protect your keys and contact us promptly if you believe your account is compromised.

11. Data breaches

If we become aware of a personal data breach that is likely to result in a risk to individuals, we will notify the relevant supervisory authority without undue delay and, where required, within 72 hours, and we will notify affected account holders without unreasonable delay with the information we are able to provide.

12. Children

The Platform is a developer and business tool and is not directed at children under 16. We do not knowingly collect their personal data. If you believe a child's data has reached us, email [email protected] and we will delete it.

13. Changes to this policy

We may update this policy as the Platform and applicable law change. The current version is always published here with its publication date, and material changes are additionally announced in the console or by email to account holders.

14. Complaints and contact

Privacy and data protection enquiries: [email protected].
Controller: RAYTREND TECHNOLOGY LIMITED, ROOM 7, 8/F., HO LIK CENTRE, 66A SHA TSUI ROAD, TSUEN WAN, NT.
EU / UK representative: we have not appointed one. The Platform is operated from Hong Kong, and we have no establishment in the EU or the UK. If our activity in those markets reaches the scale that requires an appointment under Article 27 of the EU GDPR or the UK GDPR, we will appoint a representative and update this policy. Until then, EU and UK data subjects should contact [email protected] directly, and may still lodge a complaint with their own supervisory authority as described below.
You may lodge a complaint with the Privacy Commissioner for Personal Data in Hong Kong, or with the data protection authority in your region, for example an EU member state supervisory authority or the UK Information Commissioner's Office.

This policy was first published on 9 October 2026.