Privacy Policy

Privacy Policy

Effective date: October 17, 2026

This policy explains what information BigModel.io ("we", "the Service") collects, how we use and share it, how long we keep it, and the choices you have. It applies to the website, the console and the API.

1. Who this applies to

The Service is for people aged 18 or older and for businesses. We do not knowingly collect information from children. If you believe a child has given us information, contact support@bigmodel.io and we will delete it.

2. Information we collect

Account information. Email address, username, password (stored only as a hash), sign-in method (including a third-party account if you sign in with one), role, team and invitation details.

Billing information. Top-up and plan orders, amounts, currency, payment method type, order status, refunds and disputes. Card details are entered on and handled by the payment processor; we do not receive or store full card numbers. For USDT payments we record the network, the paying wallet address and the transaction hash. These are already public on the blockchain and cannot be deleted from it.

Usage information. For each API request: the API key used, model, time, token counts, cost, status, latency, error type, and the IP address and user agent of the request.

Request content.

• Prompts, files and outputs of successful requests pass through the Service to the model provider. We do not keep them after the response is delivered.
• When a request fails, we keep the request body for up to 30 days to troubleshoot the error. Credentials in the body are removed.
• For asynchronous tasks such as video generation, we keep the task parameters, including the prompt, with the task record for billing and dispute handling. Generated files are kept for a limited time so you can download them.

Sign-in and network information. When you register or sign in, we record your IP address and derive from it your country, region, network operator, and whether the connection appears to come from a data center, VPN or proxy, or a home or mobile network. We also record your browser's time zone and language. We use this to protect accounts, prevent abuse and fraud, and enforce supported regions.

Support and feedback. Messages, attachments and contact details you send us, and our replies.

Website analytics. See section 5.

3. How we use information

We use information to provide and bill the Service, keep it secure, prevent fraud and abuse, troubleshoot problems, answer support requests, improve the product, and meet legal obligations.

We do not use your prompts or outputs to train models. We do not sell your personal information. We send service and billing emails (such as verification codes, balance alerts and replies to your support requests); we do not send marketing emails without your consent.

4. Model providers

To answer a request, we send its content to the provider of the model you chose. Each provider processes that content under its own terms and privacy policy. Some providers may keep request content for a period or use it to improve their services. Check the model's page or contact us before sending sensitive data. Do not submit personal data, trade secrets or regulated data that you are not allowed to share.

5. Website analytics and cookies

We use cookies and local storage that are strictly necessary for sign-in, security and your settings (such as language and theme).

On public pages (home, models, pricing, docs, blog, legal pages, sign-in and registration), we also measure how visitors use the site:

• First-party measurement: pages visited, referring site, landing page, and campaign or search terms when the link provides them.
• Google Analytics 4: traffic sources, page views and limited click and scroll events.
• Microsoft Clarity: session recordings and heatmaps of public pages. Form fields on sign-in, registration and feedback pages are masked.

These tools use a random visitor identifier. We do not send them your email, user ID, API keys, prompts or payment details. If you register, we may link your visitor identifier to your account, so our administrators can see which pages led to your sign-up and view your recordings on public pages. Analytics are not used on the console, API key, payment, playground, account or admin pages.

You can turn analytics off with "Turn off anonymous analytics" at the bottom of any public page. Browser Do Not Track and Global Privacy Control signals turn off Google Analytics and Clarity automatically.

We use Google Search Console to see which search terms bring visitors to the site. It reports totals only and cannot identify the search terms of any individual.

6. Who we share information with

We share information only as needed to run the Service, with:

• Hosting and network providers: servers, content delivery, network security and bot protection (including Cloudflare).
• Payment providers: third-party payment processors (such as Alipay and its acquiring partners), and blockchain data services used to confirm USDT payments.
• Email delivery providers: to send service and billing emails.
• Analytics providers: Google (Analytics, Search Console) and Microsoft (Clarity), as described in section 5.
• Internal notification tools: we use Feishu (Lark) to alert our team about support messages and billing events. These alerts may include your user ID, email, order number and amount.
• Model providers: as described in section 4.
• Authorities and others: when required by law, to respond to legal process, to protect the rights and safety of users and the Service, or as part of a merger, acquisition or sale of the Service.

7. International transfers

Our servers, processors and model providers are located in several countries. Your information may be processed outside the country where you live. We use providers that protect data with appropriate safeguards.

8. How long we keep information

• Account information: while your account is open.
• Billing and order records: as long as needed for accounting, tax, fraud prevention and dispute handling, even after the account is closed.
• Usage records: while your account is open, and afterwards only as needed for billing and audit.
• Failed-request bodies: up to 30 days.
• Sign-in and security records: as long as needed to protect accounts and prevent abuse.
• Analytics data: only as long as needed for aggregate reporting.

When information is no longer needed, we delete it or make it anonymous.

9. Security

We use encryption in transit, access controls, permission separation, audit logs and backups. No system is completely secure. If a security incident affects your personal information, we will notify you without undue delay.

10. Your rights

You can ask to access, correct, export or delete your personal information, to object to or restrict certain processing, or to withdraw consent. Email support@bigmodel.io from the address on your account. We will reply within 30 days. We may keep information we are required to keep by law, as described in section 8. For team accounts, some requests must come from the team administrator.

11. Changes to this policy

If we make material changes, we will tell you by email or on the site at least 14 days before they take effect. The effective date at the top shows the latest version.

12. Contact

For privacy questions or requests, contact support@bigmodel.io.