This policy explains what data Khidi ("we", "us") collects when you use khidi.ai and the Khidi API, why we collect it, and how prompts are handled. We aim to collect the minimum needed to run a prepaid API service.
1. What we collect
Account data: email address, name (if provided), and authentication records.
Billing data: purchase history and credit balance. Card details are processed by our merchant of record and payment processors — we never see or store full card numbers.
Usage metadata: per-request token counts, model used, timestamps, latency, and spend — the data needed to meter your prepaid budget and show you usage dashboards.
Technical logs: IP addresses and request metadata in server and security logs (retained briefly for abuse prevention and debugging).
Email preferences: whether you opted in to product and maintenance announcements.
Messages you send us: if you use the contact form, we receive the name, email and message you submit (delivered via our transactional email provider). Messages typed into the on-site AI support chat are processed like API prompts — transiently, not stored, never used for training.
2. Your prompts and outputs
We do not store the content of your prompts or model outputs, and we never use them for training. Content passes through our servers transiently to be processed and returned.
Honest disclosure: inference is performed on specialized GPU infrastructure operated by independent third-party compute providers. Your prompts are transmitted to those providers for processing, the same way any AI provider processes prompts on its servers. Our providers are not required to store content, but as with any third-party processor, transient processing happens outside our physical control. Do not send data (e.g., medical records, credentials, personal data of others) that you are not permitted to share with third-party processors.
3. What we do NOT do
We do not sell or rent your personal data.
We do not use prompt or output content for advertising, profiling, or training.
We do not send marketing email without your consent; every broadcast has an unsubscribe link.
4. Service providers
We use a small set of processors to run the Service: hosting in Germany (Hetzner), CDN and security (Cloudflare), payment processing (our merchant of record), authentication, and transactional email. Each receives only the data needed for its function. Inference processing is performed by independent third-party GPU providers as described above.
5. Data retention
Usage metadata (token counts, spend): retained while your account is active, for billing integrity and your own dashboards.
Security and access logs: retained up to 30 days.
Account and billing records: retained as required by tax and accounting law.
6. Your rights
You may request a copy of your personal data, correction, or deletion of your account and associated data by emailing [email protected]. If you are in the EU/EEA or UK, you have rights under the GDPR including access, rectification, erasure, restriction, and portability; we honor these requests regardless of where you live. Deletion requests are completed within 30 days, except records we must keep by law.
7. Cookies
The khidi.ai website uses only cookies necessary for login sessions and security (including Cloudflare's security cookies). No advertising or cross-site tracking cookies.
8. Changes
We will announce material changes to this policy by email to registered users and on this page at least 14 days before they take effect.