Skip to content
Relaykit
Menu

Legal

Privacy Policy

Last updated Applies to oneaiapikey.com and the API at api.oneaiapikey.com

In short: we collect what we need to run a prepaid API (your email, usage metadata and payment records from our processor), we do not train models on your prompts, requests are processed by upstream model providers under their terms, and you can access or delete your data at any time.

Template, not legal advice

Written for a prepaid API-credit service. It must be reviewed by a qualified lawyer before launch.

Who we are

Relaykit ("Relaykit", "we", "us") operates this website and the API at https://api.oneaiapikey.com. For the personal data described here we act as the data controller. Contact us about privacy at legal@relaykit.dev.

Data we collect

Data you give us

  • Account data: email address, username, hashed password or the identifier from a sign-in provider you choose, and account settings.
  • Support data: the content of emails and messages you send us, and any attachments.
  • Billing data: the credit packs you buy, amounts, currency, dates and the transaction reference from our payment processor. We do not receive or store your full card number; payments are handled by the processor, which acts under its own privacy policy.

Data created when you use the API

  • Usage metadata: for every request, the API key identifier (never the full key), model, timestamp, input, output and cached token counts, cost deducted, latency, status or error code, and the request's IP address and user-agent.
  • Security logs: sign-in events, key creation and revocation, rate-limit hits and signals we use to detect fraud and abuse.

Data collected on this website

  • Technical data: IP address, browser type, pages requested and referrer, as recorded in standard server and CDN logs.
  • Cookies and similar technologies: see the Cookie Policy. Advertising and analytics cookies are used only where permitted and, in the EEA, UK and Switzerland, only with your consent.

Prompts & responses

  • We do not train on your data. We never use the prompts, files or outputs that pass through the API to train or fine-tune any model, and we do not sell them.
  • Default handling. By default the content of your prompts and responses is relayed in memory to complete the request and is not written to our usage logs. Only the metadata listed above is stored.
  • Troubleshooting. If you ask us to investigate a specific request, or if we must investigate suspected abuse, we may temporarily capture request content for that purpose and delete it within 30 days unless we must keep it longer for a legal claim or to comply with law.
  • Upstream providers. To produce an answer, your request is sent to the provider that operates the chosen model (for example Anthropic, OpenAI, xAI or Zhipu AI). Each provider processes it under its own API terms and privacy policy, which may include short-term retention for abuse monitoring. Their policies, not ours, govern their processing. Do not send sensitive personal data, health data or secrets in prompts unless you are comfortable with this.

How we use data

  • To create and secure your account, authenticate API keys and route requests to models.
  • To meter usage, deduct credits, show your usage logs and balance, and process top-ups and refunds.
  • To detect, prevent and respond to fraud, abuse, security incidents and breaches of our Acceptable Use Policy.
  • To provide support and send service messages such as receipts, low-balance alerts, security notices and changes to our terms.
  • To understand aggregate website and API performance and improve the Service.
  • To show advertising on parts of this website (see below) and measure it, where permitted.
  • To comply with legal, tax and accounting obligations and to establish or defend legal claims.

We send marketing email only if you opt in, and every such email includes an unsubscribe link.

  • Contract: running your account, processing requests and billing.
  • Legitimate interests: security, fraud and abuse prevention, service improvement and essential website operation, balanced against your rights.
  • Consent: non-essential cookies, personalised advertising, analytics and marketing email. You can withdraw consent at any time.
  • Legal obligation: tax, accounting and responses to lawful requests.

Who we share data with

We do not sell your personal data. We share it only with:

  • Upstream model providers, to process your API requests.
  • Payment processors, to take payments, prevent fraud and handle refunds and chargebacks.
  • Infrastructure providers such as hosting, CDN, email delivery and database services, under contracts that limit their use of the data.
  • Advertising and analytics partners, including Google, as described below and only where permitted.
  • Authorities or other parties when required by law, to protect rights and safety, or in connection with a merger, acquisition or sale of assets (with notice to you).

Advertising & Google AdSense

Some pages of this website, such as Resources articles, may display advertising served by Google AdSense. We do not show ads in the customer console or inside API responses.

  • Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites.
  • Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the Internet.
  • You can opt out of personalised advertising by visiting Google Ads Settings. You can also opt out of some third-party vendors' use of cookies for personalised advertising at www.aboutads.info or, in Europe, www.youronlinechoices.eu.
  • Learn more in How Google uses information from sites or apps that use its services and Google's advertising technologies page.
  • If you do not consent or opt out, Google may still show non-personalised or limited ads, which use cookies only for purposes such as frequency capping, fraud prevention and aggregated reporting where permitted.

If we enable Google Analytics, it collects pseudonymous data about page views and interactions to help us understand how the site is used. Analytics storage is disabled by default until consent is given where consent is required.

For visitors in the European Economic Area, the United Kingdom and Switzerland, we use a Google-certified consent management platform (CMP) that supports the IAB Transparency & Consent Framework. Our pages implement Google Consent Mode v2 with advertising and analytics storage denied by default; they are only enabled for the purposes you accept. You can change or withdraw your choice at any time using the privacy or cookie settings link shown by the consent message, or by clearing cookies for this site. Withdrawing consent does not affect processing already carried out.

Retention

  • Account data: while your account is open, then deleted or anonymised within 30 days of a deletion request, except where we must keep it.
  • Usage metadata: up to 12 months, so you can review your spending and we can resolve billing questions.
  • Request content captured for troubleshooting or abuse investigation: up to 30 days.
  • Security and server logs: up to 90 days.
  • Billing and transaction records: as long as tax and accounting law requires (typically 7-8 years).

Security

We use encryption in transit (HTTPS/TLS), hashed passwords, access controls and least-privilege access to production systems. API keys are shown in the console so you can copy them; treat them like passwords and revoke any key you think is exposed. No system is perfectly secure; if we become aware of a breach affecting your personal data we will notify you and the relevant authorities as the law requires.

International transfers

We, our infrastructure providers and the Upstream Providers may process data in countries other than yours, including the United States and India. Where the law requires, we rely on safeguards such as adequacy decisions or the European Commission's Standard Contractual Clauses.

Your rights (GDPR)

Depending on where you live, you may have the right to:

  • access the personal data we hold about you and receive a copy in a portable format;
  • correct inaccurate data, or ask us to delete it;
  • restrict or object to processing based on legitimate interests, including profiling for advertising;
  • withdraw consent at any time;
  • lodge a complaint with your local data protection authority.

To exercise a right, email legal@relaykit.dev from your account email address. We will respond within 30 days (extendable where the law allows) and may need to verify your identity. We will not discriminate against you for exercising your rights.

California & US state rights

If you are a California resident, the CCPA/CPRA gives you the right to know what personal information we collect, use and disclose; to delete and correct it; and to opt out of the "sale" or "sharing" of personal information for cross-context behavioural advertising. We do not sell personal information for money. Cookies used for personalised ads on our Resources articles may count as "sharing"; you can opt out through Google Ads Settings, by enabling the Global Privacy Control signal in your browser, or by emailing us. Residents of other US states with similar laws have comparable rights and may contact us the same way.

Categories collected in the last 12 months: identifiers (email, IP address), commercial information (purchases), internet activity (usage metadata, website interactions) and inferences used for advertising where permitted. Sources and purposes are described above.

Children

The Service is intended for adults aged 18 or older and is not directed to children. We do not knowingly collect personal data from children under 13 (or under 16 in the EEA and UK). If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

We will post any changes on this page and update the "Last updated" date. If changes are material, we will notify account holders by email or in the console before they take effect.

Questions about this policy

Email legal@relaykit.dev for legal or privacy matters, or support@relaykit.dev for account and billing help. You can also use ourcontact page.