Privacy Policy for TokenLab

This Privacy Policy explains how TokenLab ("we," "us," or "our") collects, uses, discloses, and protects information when you use https://tokenlab.sh (the "Website") or our API services (the "Services").

By using the Website or Services, you agree to this Privacy Policy. If you do not agree with these practices, do not use the Website or Services.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Name: To personalize your experience and communicate with you
• Email Address: For account management, notifications, and important updates
• Authentication records: Provider and session information needed to sign you in

1.2 Payment Information

We collect payment details to process purchases, but we do not store full card numbers on our servers. Third-party processors handle payment processing:

• Stripe (for credit/debit card payments)
• Additional regional payment providers may be used in certain areas

1.3 API Usage Data

We automatically collect information about your API usage, including:

• API request metadata (timestamps, model names, token counts)
• Response status codes and error messages
• IP addresses from which API calls are made
• Rate limiting and quota information

1.4 Website Usage Data

We collect information through cookies and similar technologies:

• IP address and geolocation (country/region level)
• Browser type and version
• Device information (operating system, screen resolution)
• Pages visited and time spent on our Website
• Referral sources

2. How We Use Your Information

We use collected information for the following purposes:

• Providing, operating, and maintaining our Services
• Processing payments and managing your account balance
• Sending transactional emails (receipts, API key changes, balance alerts)
• Improving and optimizing our Services
• Detecting, preventing, and addressing fraud, abuse, or technical issues
• Complying with legal obligations
• Communicating with you about updates, security alerts, and support
• Sending product update emails about the Services, such as new features. You can turn them off at any time with the unsubscribe or email preferences link in any of these emails.

3. Data Sharing and Disclosure

We do not sell your personal data. We may share data with:

3.1 Service Providers

• Payment processors (Stripe) for secure transaction handling
• Cloud infrastructure providers (for hosting and data storage)
• Analytics services (for Website usage analysis)

3.2 AI Model Providers

Your API requests, including prompts and parameters, are forwarded to AI service providers to fulfill your requests. The provider used may vary by model and service. Review the relevant provider's privacy policy for details on data handling.

3.3 Legal Requirements

We may disclose information if required by law, legal process, or government request, or to protect the rights, property, or safety of TokenLab, our users, or others.

4. Data Security

We use technical and organizational measures to protect data, including:

• Encryption in transit (TLS/HTTPS)
• Access controls for sensitive data
• API key hashing (we never store plaintext API keys)
• Security monitoring and logging

However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

5. Data Retention

• Account Data: Retained while your account is active and afterward when needed for legal, security, or financial records
• Request and response details are available for 30 days for review and troubleshooting. After expiry, the original content can no longer be retrieved. Billing and usage records are kept separately. Deletion from storage may finish later than access expiry.
• Payment Records: Retained as required by financial regulations
• Account Deletion Requests: We delete or de-identify personal data unless it must be retained for legal, security, fraud-prevention, or financial purposes

See our Data Retention page for specific retention periods.

6. Your Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your data
• Portability: Request your data in a portable format
• Objection: Object to certain processing of your data

To exercise these rights, contact us at support@tokenlab.sh.

7. Cookies and Tracking Technologies

7.1 What Are Cookies?

Cookies are small text files stored on your device. They keep the Website working, remember preferences, and help us understand aggregate use.

7.2 Types of Cookies We Use

We categorize cookies into the following types:

7.3 Managing Your Cookie Preferences

Manage cookie preferences at any time:

• Click "Cookie Settings" in the website footer to change your preferences
• Use the cookie consent banner when you first visit our Website
• Disable cookies through your browser settings (note: this may affect functionality)

7.4 Do Not Track

Browser Do Not Track (DNT) signals are not a substitute for your choices in Cookie settings. Use Cookie settings to allow or reject optional cookies.

7.5 Third-Party Cookies

We do not use third-party advertising or tracking cookies. Any analytics tooling we enable is privacy-focused and used for aggregated product and site measurement.

8. International Data Transfers

Your data may be transferred to and processed in countries outside your residence. We use safeguards required by applicable law for international transfers.

9. Children's Privacy

Our Services are not intended for children under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us.

10. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be notified via email or through the Website. The "Last Updated" date at the top indicates the latest revision.

11. Contact Us

For questions, concerns, or requests regarding this Privacy Policy:

Email: support@tokenlab.sh

12. TokenLab plugins for ChatGPT, Codex and Claude

This section applies when you use the TokenLab plugin or its public model-directory MCP server (mcp.tokenlab.sh) inside ChatGPT, Codex, Claude or another MCP client. The plugin does not require a TokenLab account, does not ask for or accept API keys, does not take payments, and does not forward your prompts to any AI model provider.

What we receive. The tool name and the arguments the client sends (for example a model category, a search term or two model IDs); the time of the request; the IP address and user-agent of the client's servers; and error and latency data. We do not receive your chat history, your name or email, or your ChatGPT, Codex or Claude account details, unless you type them into a tool argument.

Why. To return public catalog results, keep the service reliable and secure, prevent abuse, and count aggregate usage of each tool.

Who receives it. Our hosting and logging providers, under contract, for these purposes only. We do not sell or share this data for advertising, and we do not send it to AI model providers.

How long. Request logs for the plugin are kept for up to 30 days, then deleted. Aggregate counts that cannot identify you may be kept longer.

Your controls. You can stop using the plugin at any time by disconnecting it in your client. Do not put personal information in search terms. To ask for access to or deletion of plugin logs linked to you, email support@tokenlab.sh with the approximate time of use.