qziraBack to home

Privacy Policy

Last updated: February 5, 2026

Version: 3.0

138data (“we,” “our,” or “us”) establishes this Privacy Policy (“Policy”) regarding how we handle personal information in connection with the AI API gateway service “qzira” (“Service”). Please read this Policy carefully before using the Service.

Article 1 (Information We Collect)

1-1. Account Information

When you register for the Service, we obtain the following information via Google OAuth:

  • Email address
  • Display name (from your Google account)
  • Profile picture URL

* Your Google account password is never shared with us.

1-2. Service Usage Data

To operate and improve the Service, we record the following metadata:

  • API request timestamps
  • AI model name used
  • Request/response token counts
  • Response time
  • Status codes (success/error)
  • Subscription plan and billing information

1-3. Access Information

For security management purposes, we may record:

  • IP address (for rate limiting and fraud detection)
  • User agent (browser/client type)
  • Login/logout timestamps

1-4. Information We Do NOT Collect

The following information is NOT persistently stored on our servers:

  • Prompts (input content): Relayed to AI providers only
  • AI response content: Relayed to users only
  • BYOK key plaintext: Stored encrypted; plaintext is never retained

Article 2 (Purposes of Use)

Collected information is used solely for the following purposes:

  1. Providing, operating, and maintaining the Service
  2. Authenticating and managing user accounts
  3. Measuring usage and processing billing
  4. Operating safety features such as budget alerts and auto-stop
  5. Improving the Service and developing new features
  6. Investigating and responding to security incidents
  7. Sending important notices to users (service changes, security alerts, etc.)
  8. No machine learning use: We do not use collected data for training AI models. We do not operate any AI models, and our architecture makes such use technically impossible.

Article 3 (Sharing with Third Parties)

We do not share your personal information with third parties except in the following cases:

  1. Payment processing: We share information necessary for billing with Stripe, Inc.
  2. Authentication: Supabase processes information required for authentication.
  3. Data transfer to AI providers: Your API requests (metadata) are sent to the AI provider you specify. Each AI provider's privacy policy also applies.
  4. Legal requirements: When disclosure is required by applicable law.
  5. With your consent: When you have explicitly consented.

Article 4 (International Data Transfers)

  1. The Service uses Cloudflare's global infrastructure, and your data may be processed or stored on servers outside Japan.
  2. We endeavor to implement appropriate security measures for international data transfers.
  3. Data transferred to AI providers is processed at each provider's server locations (primarily the United States).

Article 5 (Data Storage & Security)

  1. User data is stored on Cloudflare's global infrastructure.
  2. BYOK keys are stored encrypted; plaintext is never retained.
  3. All communications are encrypted via HTTPS/TLS.
  4. We implement appropriate security measures including access control and audit logging.

Article 6 (Security Incident Notification)

  1. In the event of a security incident such as leakage, loss, or damage of personal information, we will promptly confirm the facts and endeavor to notify affected users without delay.
  2. In the event of a serious security incident, we will report to the relevant supervisory authority in accordance with the Act on the Protection of Personal Information and other applicable laws.

Article 7 (Data Retention Periods)

Data TypeRetention Period
Account informationDeleted within 30 days of account deletion request
Usage dataDuring account lifetime and 90 days after cancellation
Billing historyAs required by law (up to 7 years)
Security logs90 days
Access logs (IP addresses, etc.)30 days

Article 8 (Your Rights)

You have the following rights:

  1. Right of access: You may request disclosure of the data we hold about you.
  2. Right of rectification: You may request correction of inaccurate data.
  3. Right of erasure: You may request account deletion and data erasure.
  4. Right to object: You may object to how your data is used.
  5. Right to portability: You may request your data in a machine-readable format.

To exercise these rights, please contact us at https://138io.com/contact.

Article 9 (Use of Cookies)

The Service uses cookies necessary to maintain authentication sessions. We do not use marketing or tracking cookies.

Article 10 (Minors)

The Service is not intended for users under 18 years of age. If we become aware that a user under 18 has registered, we will delete that account.

Article 11 (Users Outside Japan)

  1. The Service complies with Japan's Act on the Protection of Personal Information (APPI).
  2. Users in the EU or UK may have rights under the GDPR (right of access, erasure, portability, etc.). Please contact us if this applies to you.
  3. Users in California may have rights under the CCPA (California Consumer Privacy Act).

Article 12 (Changes to This Policy)

We may update this Policy from time to time. Changes will be published on the Service, and we will provide advance notice of material changes. Continued use of the Service after changes take effect constitutes your acceptance of the revised Policy.

Article 13 (Contact)

For inquiries regarding this Policy, please contact us at:

This Policy is effective as of February 5, 2026.