Privacy Policy
1. Data controller
The data controller is ZGo, the trading name used by the independent operator of the ZGo API Gateway.
- Privacy and data requests: support@zgoapi.cc (subject: “Privacy Request”)
- Customer support: support@zgoapi.cc
- Data Protection Officer: not appointed. We are a small independent service and do not carry out large-scale systematic monitoring or large-scale special-category processing.
2. Information we collect
2.1 Information you provide
- Account data: email address, username, password hash (we do not store plaintext passwords), account identifiers, and records of your acceptance of our Terms and Privacy Policy.
- OAuth data: if you sign in with Google or GitHub, we receive the account identifier and basic profile information those providers return (such as email address and display name).
- Billing data: transaction identifiers, purchased credit amounts, payment status, currency, and related order metadata. Full card details are processed by our payment provider and are not stored on our servers.
- Support communications: emails, attachments, and information you choose to send us.
2.2 Information generated when you use the service
- API metadata: API key identifiers, model requested, token counts, timestamps, latency, HTTP status, error codes, and request identifiers.
- Device and network data: IP address, browser type, operating system, user agent, and approximate region derived from IP.
- Security data: authentication events, rate-limit events, abuse signals, and bot-protection results.
- API content: prompts, files, and outputs are transmitted through our gateway to the upstream provider you select. We do not intentionally retain full prompt or output content in our ordinary usage records. Content may be processed transiently for routing, security, and error handling, and may be retained if you send it to support or if retention is necessary for abuse investigations or legal compliance.
- Content safety data: before forwarding the latest user prompt to a model, we send the prompt to Waffo Prompt Sift for a content-safety decision. Waffo documents this scan as stateless and states that it does not retain the raw prompt after returning the decision. We apply content rules to outputs as well, and retain the verdict, reason code, matched categories, timestamp, and a one-way prompt hash for audit and abuse prevention.
2.3 Cookies and similar technologies
We use strictly necessary storage for login sessions, language preferences, security, and load balancing. We do not currently use advertising cookies or third-party marketing pixels. We use Cloudflare Turnstile for bot protection; it may process IP address, browser signals, and challenge results under Cloudflare’s privacy terms.
3. How we use information and our legal bases
| Purpose | Legal basis (where GDPR applies) |
|---|---|
| Create and manage accounts; provide API access | Performance of a contract |
| Meter usage, calculate charges, process payments, issue receipts | Performance of a contract; legal obligation |
| Provide customer support and respond to requests | Performance of a contract; legitimate interests |
| Protect the service, prevent fraud and abuse, enforce limits | Legitimate interests; legal obligation |
| Maintain security logs and troubleshoot failures | Legitimate interests |
| Comply with tax, accounting, sanctions, and law-enforcement obligations | Legal obligation |
| Send service notices (security, billing, policy changes) | Performance of a contract; legitimate interests |
| Send marketing communications, if offered | Consent, which you may withdraw at any time |
We do not use your API content to train our own AI models. We may use aggregated or de-identified data that cannot reasonably identify you for reliability, capacity planning, and service improvement.
4. How we share information
We do not sell your personal information, including as “sale” is defined under the CCPA/CPRA. We share information only as needed:
- Payment processing and merchant of record: Waffo Pancake processes payments, applicable taxes, receipts, refunds, and related compliance. Card data is handled by Waffo and is not stored on our servers.
- Hosting and infrastructure: our service is hosted on servers in the United States, including InterServer, with DNS and security services provided by third parties such as Cloudflare and Dynadot.
- AI model providers and aggregators: your API requests and content are transmitted to the upstream provider selected to fulfil the request. Those providers process the content under their own terms and privacy policies.
- Content safety: Waffo Prompt Sift receives the prompt and returns a safety verdict before generation. Waffo acts as a moderation processor for this purpose.
- Email and support tools: providers that deliver verification and support email.
- Legal and safety: courts, regulators, law enforcement, card networks, or professional advisers where required by law or necessary to protect rights, safety, and service integrity.
- Business transfer: a successor in connection with a merger, acquisition, financing, or transfer of the service, subject to continued protection.
5. International transfers
We operate from infrastructure outside mainland China and may process information in the United States, the Hong Kong Special Administrative Region, and other locations where our providers operate. Where required, we use contractual safeguards such as standard contractual clauses, provider data-processing terms, and access controls. The upstream provider you select may process content in other countries; please review its terms before submitting sensitive information.
6. Retention
| Data | Retention |
|---|---|
| Account and profile data | While the account is active, and up to 24 months after closure for dispute, security, and backup purposes |
| Billing, tax, and transaction records | Up to 7 years where required by tax, accounting, or card-network rules |
| API usage metadata | Up to 24 months, then deleted or aggregated |
| Security and access logs | Up to 90 days, unless needed for an investigation |
| Support communications | Up to 24 months after the request is closed |
We may retain information longer where required by law, to resolve disputes, to prevent fraud, or to enforce our agreements. Backups may persist for a limited period before rotation.
7. Security
We use TLS for data in transit, hash passwords, restrict administrative access, keep payment card data out of our systems, and monitor for abuse. No method of transmission or storage is completely secure. You are responsible for protecting your password, API keys, and devices, and for notifying us promptly of suspected compromise.
If we become aware of a personal-data breach that is likely to result in a risk to your rights, we will notify affected users and regulators where required by applicable law, without undue delay and, where GDPR applies, within 72 hours of becoming aware.
8. Your rights
Depending on your location, you may have the right to access, correct, delete, restrict, or object to processing, to receive a portable copy of your data, and to withdraw consent. To exercise a right, email support@zgoapi.cc with the subject “Privacy Request”. We may need to verify your identity. We aim to respond within 30 calendar days.
You may also complain to your local data-protection authority. If you are in the European Economic Area, you can contact the supervisory authority in your country of residence. We will cooperate with reasonable requests.
9. Marketing
We do not currently send marketing email. If we introduce marketing, we will rely on consent where required, include an unsubscribe link, and keep service messages (billing, security, and legal notices) separate from marketing.
10. Children
The service is intended for users aged 18 or older. We do not knowingly collect personal information from children. If you believe a child has provided information, contact us and we will take appropriate steps to delete it.
11. Third-party services
The service depends on third-party providers, including model providers, payment processors, hosting, DNS, security, and email services. Their processing is governed by their own terms and privacy policies. We are not responsible for the privacy practices of services we do not control.
12. Changes to this policy
We may update this policy to reflect changes in the service, law, or our providers. Material changes will be notified through the service or by email at least 14 days before they take effect where practicable. The effective date at the top will be updated. Continued use after the effective date means you accept the updated policy.
13. Contact
ZGo — Privacy
Email: support@zgoapi.cc
Website: https://zgoapi.cc