The inference path minimizes content persistence, while accounts, usage, payments, and security operations require durable records.
Important distinction: the Amanai gateway does not persist prompt or response content. Amanai is not wholly stateless: it stores account, usage, credit, order, payment, and security data, and upstream AI processors may have their own data practices.
Scope
This policy covers Amanai websites, dashboard, APIs, credits, payments, promotions, and related support. It does not govern third-party sites or independent upstream services except to describe when Amanai sends data to them.
Information we collect
Account and authentication
When you use Google or GitHub OAuth, we receive and store the provider name, provider account identifier, email address, display name, and related account-link information. We do not collect an Amanai password. OAuth access tokens are used to retrieve identity information and are not retained by the gateway.
We store API-key and server-side session records. The current service supports revealing generated API keys and therefore may retain a retrievable copy in addition to a hash. Treat every API key as a secret.
Usage and billing metadata
For API requests we may store the key or account association, timestamp, public model, serving route/provider, input/output/cache/reasoning token counts, pricing multipliers, credits charged, whether usage was estimated, delivery status, response status, latency, billing provenance, effective limits, and attribution decision metadata.
The usage record does not contain prompt text, response text, user-agent, or ordinary request IP address.
Payments, credits, and promotions
We store orders, amount, pack, status, QR data, credit grants and ledger entries, referrals, campaign participation, CD-key redemption, and support or reconciliation details. QRIS processing uses Pakasir; Amanai sends an order identifier, amount, project identifier, and platform credential—not your account email or phone—to create or check payment.
For USDC, blockchain addresses, amounts, transaction hashes, network, and settlement status are public or derived from public chain data and may be stored indefinitely for reconciliation. We do not collect wallet seed phrases from users.
Community information
If you voluntarily join a phone-based community flow, Amanai may store your telephone number in E.164 form and a keyed digest used for uniqueness, together with membership and account identifiers.
IP and security information
We process IP addresses for rate limits, bot checks, signup controls, abuse prevention, CD-key redemption, and administrative auditing. Signup IP records are designed for short operational retention; selected redemption and audit IP records are currently retained with their associated record. Cloudflare Turnstile may receive your IP address and challenge token.
Cookies and browser storage
We use authentication, OAuth state, Turnstile, and referral cookies plus local storage for theme, announcements, and cookie choice. See the Cookie Notice.
Inference content and stateless processing
The gateway handles prompts, messages, images, tool definitions, context, and generated responses in memory to route and deliver an inference request. The audited gateway does not write that content to its database or persistent application logs. Temporary in-memory assembly may be used for streaming, protocol conversion, attribution, or delivery.
Your payload is forwarded to upstream inference infrastructure. Those services may log, retain, review, or process content under their own policies and operational requirements. Amanai cannot promise zero retention across every upstream route. Do not submit secrets or sensitive data that you are not authorized and prepared to send to an upstream AI processor.
How we use information
- authenticate users and provide API keys, sessions, dashboard access, and account linking;
- route requests, measure delivery, calculate credits, enforce limits, and troubleshoot reliability;
- create, verify, settle, reconcile, and support payments and credit grants;
- operate referrals, promotions, rewards, and community eligibility;
- detect spam, account farming, fraud, credential abuse, and attacks;
- provide support, communicate material changes, resolve disputes, and maintain records;
- comply with law, protect rights and safety, and enforce our policies.
When information is shared
| Recipient | Typical data and purpose |
|---|---|
| AI upstream infrastructure | Inference payload and model parameters to generate output; no ordinary Amanai account email or IP is added to the standard payload |
| Google or GitHub | OAuth request and identity data for authentication |
| Cloudflare | Network/edge processing and Turnstile token with IP for bot detection |
| Pakasir | Order identifier, amount, project, and platform credential for QRIS processing |
| Blockchain networks and RPC services | Public address, token, block, log, and transaction data for USDC verification |
| Operational alerts | Selected event and account identifiers; rare reward alerts may include account email through Telegram |
| Authorities or counterparties | Data reasonably necessary for law, safety, fraud, disputes, or protection of rights |
We do not state that we sell personal information for behavioral advertising. The audited service does not include third-party advertising or behavioral analytics SDKs.
Retention
Current records for accounts, API keys, usage, credits, orders, referrals, promotions, audits, and community membership do not all have automated deletion schedules and may be retained for the life of the service or longer where needed for accounting, reconciliation, security, dispute handling, backup integrity, or legal obligations. Expired sessions can remain as inactive database rows. Database backups use limited rolling copies, but deleting a live record may not immediately remove every backup copy.
Signup IP logs are pruned on a short operational window. Other selected IP fields attached to redemption or audit records currently have no automatic expiry. We intend to refine retention controls as the platform matures; this policy describes current behavior rather than promising a deletion schedule that is not implemented.
Your choices and requests
You can revoke API keys, unlink an OAuth provider when another login method remains, clear browser storage, and choose not to use optional community or promotional features. Amanai does not currently provide self-service account deletion, full data export, or automatic erasure.
You may request access, correction, deactivation, or deletion review at privacy@amanai.dev. We may verify your identity and may retain billing, transaction, security, dispute, and legal records where deletion is not operationally possible or legally appropriate. Deactivation alone does not erase stored data.
Security and international processing
We use technical and operational safeguards described in our Security page. No system is perfectly secure. Amanai and its upstream or infrastructure providers may process data in different jurisdictions; by using the service, you understand that data can be transferred outside your location subject to applicable requirements.
Policy changes
We may update this policy as architecture, providers, features, or law changes. We will update the effective date and, when practical, communicate material changes through the site, dashboard, changelog, or active contact channel. Continued use after an effective change constitutes acknowledgment where permitted by law.
Contact
Privacy questions and requests: privacy@amanai.dev. General support: support@amanai.dev.