Privacy Policy

Last updated 10 November 2026 · Effective 5 October 2026

This Privacy Policy is provided in English and Chinese; the Chinese version is for reference only. If the two versions conflict or are inconsistent, the English version prevails.

1. Introduction and Scope

This Privacy Policy explains how OceanToken (“OceanToken”, “we”, “us”) collects, uses, discloses and protects personal information when you visit oceantoken.ai, use our console, API, Chat, AI Workspace, MCP service and command-line tool (CLI), or contact us (together, the “Service”). By using the Service you acknowledge that you have read and understood this policy.

Where we process data submitted through the Service by an enterprise customer and on its instructions, we act as a service provider / processor under our written agreement or data processing agreement (DPA) with that customer.

2. Information We Collect

Account information: email address, name or display name, organization name, basic profile data from third-party sign-in, and account settings.

Payment information: top-up amount, currency, payment status and transaction identifiers. Card details are processed directly by our payment processor; we do not store full card numbers.

Usage metadata: model used, token counts (including cached tokens), cost, timestamps, latency, request status, an identifier of the API key used (not the full key) and the originating IP address. Metadata does not include the content of prompts or responses.

Device and log information: IP address, browser and device type, access times, error logs and similar technical data.

Communications: information you provide by email, forms or support channels.

Request content: the prompts and files you submit and the Output returned by models (“Request Content”). How we handle Request Content is described in Section 3.

3. How We Handle Request Content

We store Request Content. The prompts you send and the responses you receive are stored with the record of each request, so that the console can show you your request logs and conversation history, so that a multi-turn request can continue from an earlier response, and so that we can investigate failures and billing disputes. If your account belongs to an organization or team, its administrators can see the request logs of its members, including their content.

Prompts and responses are deleted automatically 365 days after the request. Conversations saved in Chat are deleted automatically 365 days after they were last updated, and you can delete a saved conversation yourself at any time. Files you upload and media generated for you, such as images, videos and audio, are kept in our cloud storage and are deleted automatically 30 days after they were uploaded or generated. A saved conversation keeps its text, but images and files in it that are older than 30 days will no longer display. You can ask us at any time to delete your Request Content, including these files, by writing to support@oceantoken.ai.

We keep Request Content longer than described above, or after you ask us to delete it, only where: (a) we automatically screen requests to detect, investigate and prevent fraud, abuse, unlawful activity or security incidents, and content is flagged, in which case we may keep the flagged content until the relevant investigation ends; or (b) required to comply with law, regulation, legal process or lawful requests from authorities, or to preserve evidence.

We may automatically mask some sensitive data we detect before a request is sent, but we do not guarantee that all sensitive data will be identified; please do not submit unnecessary sensitive personal information.

4. Model Providers

To generate Output, we send Request Content to the provider of the model you select or the provider chosen by our dynamic routing. Model Providers process Request Content under their own terms and data policies and may retain or use it. Where known to us we may label providers’ data retention and training policies, but we make no warranty regarding Model Providers’ data handling, retention, training or security practices.

5. How We Use Information

We use information (including Request Content) to: provide, maintain, improve and develop our products and services; bill, settle and collect amounts owed; authenticate users, manage risk and prevent fraud; monitor security, troubleshoot and investigate abuse; enforce our terms and policies; comply with legal obligations and lawful requests; send service, billing and security notices; and, where permitted by law, send marketing communications, including a short series of emails after you create an account and, if you sign up for it on our website, the OceanToken newsletter (product updates and model price changes, about one email a week; we keep the email address you enter, the page and language you signed up from, and when you signed up or unsubscribed). Every such email has an unsubscribe link that takes effect at once, and you may also opt out at any time by writing to support@oceantoken.ai; service, billing and security notices still reach you after you opt out.

We may aggregate or de-identify information so that it does not identify you or any individual, and may use such data for any lawful purpose, including analytics, research and development, and commercial purposes.

We do not use your Request Content (prompts, files you upload and Output) to train artificial intelligence models, and “improve and develop our products and services” above does not include such training. Model Providers process Request Content under their own terms, as described in Section 4.

6. Legal Bases (EEA / UK Users)

Where the GDPR or UK GDPR applies, we process personal information on the following legal bases: performance of our contract with you; our legitimate interests (such as securing the Service, preventing fraud and improving the Service), where not overridden by your rights; compliance with legal obligations; and your consent, which you may withdraw at any time.

7. How We Disclose Information

We may disclose information: (a) to Model Providers, as described in Section 4; (b) to service providers that work for us, including cloud infrastructure and storage, payment processing, third-party sign-in, email delivery, tool services such as web search and code execution, customer support and risk-control services; (c) to our affiliates; (d) to comply with law, regulation, legal process or lawful requests from law enforcement or regulators, or to protect the rights, property and safety of us, our users or the public, including to investigate and combat fraud, unlawful or grey-market activity; (e) in connection with a merger, acquisition, financing, reorganization, asset sale or bankruptcy; or (f) with your consent or at your direction.

8. International Data Transfers

We are a U.S. company. We, our service providers and Model Providers may store and process your information in any country or region where we or they operate, which may be outside your country or region of residence and may have data protection laws different from yours. We do not commit to storing or processing data in any particular country, region or data center, and the location shown by a network endpoint or IP address does not indicate where data is actually processed.

Where applicable law requires it, we use appropriate safeguards for international transfers, such as standard contractual clauses. Where we agree a specific processing region with you in a written enterprise agreement, that agreement governs.

9. Retention

We keep information for as long as needed for the purposes described in this policy, taking into account legal, tax, accounting, fraud-prevention, dispute-resolution and enforcement needs. In general: account information is kept while your account is open; usage metadata and billing records are kept while your account is open and afterwards for as long as legally or commercially reasonably required, and deleting Request Content does not delete them; prompts and responses are deleted 365 days after the request, and conversations saved in Chat 365 days after they were last updated, or sooner if you ask us; files you upload and media generated for you are deleted 30 days after they were uploaded or generated, as described in Section 3; and content preserved for security, abuse or legal reasons is kept until the relevant investigation, proceeding or legal period ends.

When retention ends we delete or de-identify the information; de-identified or aggregated data may be kept indefinitely.

10. Security

We use reasonable technical and organizational measures to protect information, such as encryption in transit, access controls and hashed storage of passwords and API keys. No transmission or storage over the internet is completely secure; we cannot guarantee absolute security, you assume that risk, and you are responsible for safeguarding your account and API keys. If a security incident requiring notification occurs, we will notify as required by applicable law.

11. Your Rights

Depending on where you live, you may have the right to access, correct or delete your personal information, obtain a copy of it, restrict or object to certain processing, withdraw consent, and complain to a data protection authority. Residents of certain U.S. states (such as California) may have the right to know the categories and specific pieces of personal information we collect, to request deletion or correction, and not to be discriminated against for exercising their rights; where applicable you may opt out of the “sale” or “sharing” of personal information.

To exercise your rights, email support@oceantoken.ai. We will respond within the period required by applicable law after verifying your identity; you may use an authorized agent, but we may require proof of authorization. To the extent permitted by law, we may decline a request in whole or in part for a lawful reason, such as complying with law, completing a transaction, preventing fraud or establishing legal claims.

12. Cookies and Similar Technologies

We use cookies necessary for sign-in and security and may use analytics tools to understand website usage; where required by law we obtain consent before using non-essential cookies. You can manage cookies in your browser settings, but disabling necessary cookies may prevent the Service from working properly.

On our sign-up, sign-in, Credits top-up (including organization billing) and first-API-key pages, and only there, we load Google's tag, which runs Google Analytics. It runs in a hidden frame served from oceantoken.ai that cannot read the console page you are on. Google may set cookies and receives information about your browser and device and these events: that you viewed the sign-in form, signed in (with the sign-in method: password, Google or GitHub) or could not sign in (with a general reason such as a wrong password, never what you typed), signed up (with the sign-up method, and the sign-in that follows a Google or GitHub sign-up), started or completed a top-up (with its amount and, once paid, a one-way hash of its payment reference), or created your first API key. It does not receive the address of the console page, your email address, password, prompts, responses, API keys, access tokens or invitation links. Google's use of this information is governed by Google's own privacy policy.

On our website, oceantoken.ai (not in the console), we use Microsoft Clarity to understand how visitors use our pages, through session recordings, heatmaps and usage statistics. Clarity records clicks, taps, scrolling and mouse movement, the pages you visit and how they are shown to you, and information about your browser and device, and it may set its own cookies. It never records what you type into form fields, and it masks numbers and email addresses shown on the page. For visitors in the European Economic Area, the United Kingdom and Switzerland it runs only after you accept analytics cookies; it does not run in a browser that sends a Global Privacy Control signal; and anywhere, you can stop it with a browser setting or extension that blocks clarity.ms. Clarity keeps most recordings for 30 days; recordings we save and heatmap data are kept longer, under Microsoft's retention rules. Clarity is operated by Microsoft, which collects this information directly from your browser. Microsoft collects or receives personal data from us to provide Microsoft Advertising, and uses it as described in the Microsoft Privacy Statement at privacy.microsoft.com/en-us/privacystatement.

Two events may also reach Google Analytics from our servers rather than from your browser: when you sign up, and when a card payment for a top-up succeeds. Our server sends one only if Google Analytics was running in your browser when you signed up or opened the payment page: in the EEA, the UK and Switzerland only after you allowed analytics; elsewhere it runs by default unless your browser blocks it. It carries only the Google Analytics identifiers already set in your browser and, for a sign-up, the sign-up method; for a payment, the amount credited in US dollars, when it was paid and a one-way hash of its payment reference. It never includes your name, email address, account ID, IP address or payment card details. We use these events only to count sign-ups and purchases correctly.

Our emails after sign-up contain a small image and links that tell us whether an email was opened and which link was clicked. We use this only to measure and improve those emails.

On the console's sign-in, sign-up and set-password pages we set a first-party cookie, ot_dfp, holding a one-way hash of characteristics of your browser and device (browser and operating system version, languages, time zone, screen size, number of processor cores, memory, and how your browser draws a small test image). It identifies a browser, not a person. We use it only to stop the same device from claiming the free credit we offer new accounts more than once, and to notice when many accounts are created from one device: when an account is created we read it and store only a keyed hash of it, with the account and in our record of that credit, which we keep for as long as the account exists and we offer that credit, and do not share it with anyone. The cookie expires after 400 days; you can delete it in your browser settings at any time.

On the console's sign-up pages, and on the page that finishes a sign-up with Google or GitHub, we use Cloudflare Turnstile to check that a person, not an automated program, is creating an account. Turnstile runs in a frame from challenges.cloudflare.com and sends Cloudflare your IP address and information about your browser and device. Cloudflare uses this information to run the check and to improve it, under Cloudflare's privacy policy; it does not use it for advertising. We receive only whether the check passed.

13. Children

The Service is intended only for users aged 18 and over. We do not knowingly collect personal information from minors and will delete it if we learn that we have.

14. Changes to This Policy

We may update this policy at any time and will change the “Last updated” date at the top. For material changes we will give notice through the website, console or email where reasonable. Your continued use of the Service after a change means you acknowledge the updated policy.