Introduction
Zyloo, LLC (“Zyloo”, “we”, “us”), a Delaware limited liability company with its registered office at 131 Continental Dr, Suite 305, Newark, DE 19713, USA, operates a unified API gateway for third-party AI models. This policy explains what personal data we handle when you sign up, browse our site, or send requests through the API.
If anything below is unclear, write to us at privacy@zyloo.io and we will respond within seven days.
What we collect
We only collect what we need to run the service:
- Account information — name and email from your Google or GitHub sign-in.
- Usage metadata — request timestamps, model id, token counts, latency and HTTP status. We do not log prompt or completion content by default.
- Technical data — IP address, user agent and referrer, used for fraud prevention and rate limiting. The IP address you signed up from is also used to derive an approximate country for regional statistics and regional email targeting, and is retained for fraud prevention for the life of the account.
How we use it
- Operate, secure and improve the API gateway.
- Bill you for the tokens you consume and prevent abuse.
- Notify you about service-critical events such as outages or pricing changes.
- Send you product updates and new-model announcements by email — only with your consent; every email includes one-click unsubscribe.
- Comply with legal obligations and respond to lawful requests.
We do not sell, rent or share your personal data with advertisers. We do not use your prompts or completions to train models — ours or anyone else's.
Legal bases
Where the GDPR or a similar law applies, we rely on the following legal bases for processing your personal data:
- Contract — operating the service you signed up for and billing you for usage.
- Legitimate interests — fraud prevention, security, and service analytics.
- Consent — marketing emails such as product updates and new-model announcements.
- Legal obligation — tax and accounting records we are required to keep.
Data retention
- Request payloads (prompt + completion) — not stored. Discarded as soon as the response is sent.
- Request metadata — kept for 7 days, then automatically deleted. Only aggregated token totals are retained for statistics.
- Account and billing records — kept for the lifetime of the account, plus the period required by tax law.
If you need specific data-handling or retention arrangements, contact us at privacy@zyloo.io.
Third-party providers
When you call a model, we forward the request to the upstream provider you selected (OpenAI, Anthropic, Google, xAI, DeepSeek, Moonshot or Zhipu). Each provider has its own privacy policy that governs the request once it leaves our infrastructure. We negotiate zero-retention enterprise terms with every provider where they offer them.
International transfers
Our sub-processors and the model providers you call may be located outside your country, including in the United States (e.g. NOWPayments, Vercel, and the upstream model providers listed above) and Algeria (Chargily Pay). Where required, transfers of personal data rely on safeguards such as Standard Contractual Clauses or an applicable adequacy framework.
Sharing
We share personal data only with:
- Sub-processors that operate the service (cloud hosting, email, error tracking).
- Legal or regulatory bodies when compelled by a valid legal process.
- An acquirer in the unlikely event of a merger or acquisition, under equivalent privacy commitments.
Security
Data in transit is protected by TLS 1.3. Data at rest is encrypted with AES-256. Access to production systems is restricted and protected by multi-factor authentication, and we monitor for vulnerabilities. Despite our efforts, no system is invulnerable — if we discover a breach affecting you we will notify you without undue delay.
Your rights
Depending on where you live, you may have the right to access, correct, export, restrict or delete the personal data we hold about you. You can delete your account directly from the Profile page in your dashboard; for access or export requests, email privacy@zyloo.io.
Cookies
We use a small number of strictly necessary cookies for authentication and load balancing, and privacy-focused product analytics (PostHog) to understand how the service is used. We do not use third-party advertising cookies. You can disable cookies in your browser, but core features such as signing in will stop working.
Children
Zyloo is not directed to children under 13 (or under 16 in the EU). We do not knowingly collect data from children. If you believe a child has provided personal information, contact us and we will delete it.
Payment methods
We never hold your card details. All payments are processed by our payment providers — NOWPayments for cryptocurrency, Chargily Pay for EDAHABIA and CIB cards, and Whop for international cards, Apple Pay, Google Pay, Cash App, UPI, Alipay and WeChat Pay. Crypto checkouts show a one-time address and amount, and card details are entered only on the provider's secure page. If you choose to save a card for automatic top-ups or an auto-renewing subscription, the card itself is stored by Whop, not by us: we keep only a reference to it plus the brand, last four digits and expiry, so we can show you which card is on file and charge it when you have asked us to. You can remove it at any time from the Billing page. Otherwise we retain only the transaction reference and the amount credited, so your balance and receipts stay auditable.
Refund policy
- Credit purchased with crypto (USDT, Bitcoin or any other cryptocurrency) or through Chargily Pay is non-refundable — no exceptions.
- Credit purchased by card — or with UPI, Alipay or WeChat Pay, which run on the same gateway — can be refunded for the unused remainder of that top-up: email support@zyloo.io from your account address and we will return what is left of it. Credit already spent on requests cannot be returned.
- Subscription plan payments are non-refundable once the period has started, however they were paid.
- If a payment does not credit your balance, email support@zyloo.io with the transaction reference and we will investigate and correct it.
- By continuing to use the platform you agree to these refund terms.
Changes to this policy
When we make material changes we will post the new policy here and notify active users by email. Your continued use of the service after a change means you accept the updated policy.
Contact
Questions, complaints or data requests? Email privacy@zyloo.io. The data controller is Zyloo, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, USA. You may also escalate to your local data protection authority.