Privacy Policy

This policy explains what data apiegg (“we”, “us”) collects when you use our website and API, why we collect it, and what we do — and never do — with it. It’s written to be read, not skimmed past. Plain English, no surprises.

§1 Who we are & scope

apiegg (apiegg.com) is a server-side routing service for AI model API requests. This policy covers our website, our waitlist email form, and the API at api.apiegg.com. It applies to visitors, waitlist subscribers, and API customers alike.

§2 What we collect

Account information

When you create an account: your name, email address, company (optional), and a hashed password. If you pay us, billing details are handled by a payment processor — we keep only what they report back to us (for example, the last digits of a card).

API keys

The keys you create to authenticate API calls. Keys are stored hashed; we show the full value exactly once, at creation.

Request metadata (needed for routing)

For every API call, technical signals required to analyze and route it: payload size and shape, which tools a request references, client type, token counts, latency, error and success outcomes. This is the operating data of the router.

Prompts & outputs — processed transiently

To route a request we have to read it. Prompts, context, and outputs pass through our routing layer in memory, where they’re analyzed just long enough to choose a route, validate tool-call responses, and return the result. They are not written to persistent storage for general retention, and we don’t build a corpus of customer content.

Anonymized outcome signals

Aggregated, de-identified signals — did a route complete, how fast, at what cost — that we use to improve routing quality over time. These signals aren’t tied to your identity or your content.

Waitlist email (landing page)

If you submit the early-access form, we store your email to contact you when access opens. One email address, one purpose.

§3 What we never do

• We never sell, rent, or trade your personal data or your customer content.
• We never train third-party models on your prompts or outputs. Your traffic is not anyone’s training data — not ours to give.
• We never build content libraries or datasets from customer traffic.
• We never share your data with advertisers or analytics brokers.

§4 How we use it

We use the data above to:

• Route your requests — analyze, forward, validate, and return them (the service itself);
• Operate your account — authentication, quotas, billing, and support;
• Keep the service healthy — detect abuse, debug failures, and monitor performance;
• Improve routing — using the anonymized outcome signals described in §2;
• Communicate with you — service notices, security alerts, and (for the waitlist) early-access invitations.

We don’t use your data for any purpose beyond running and improving the service. No “secondary purposes,” no behavioral profiling.

§5 Cookies & local storage ⚖ review at launch

• The landing page sets no tracking cookies and runs no third-party analytics today.
• The waitlist form saves a note in your browser’s localStorage (key: apiegg_waitlist) so it can show you a success state after you sign up. It lives on your device — clearing your browser storage removes it.
• The API is cookieless.
• If we add analytics or other cookies later, we’ll update this section before we do. [Placeholder — re-check at launch.]

§6 How long we keep it ⚖ windows TBD

• Request & response content: apiegg does not persist it — requests are processed in memory to pick a route, then gone. Model providers behind each endpoint apply their own retention policies, including abuse-monitoring carve-outs for flagged content; we disclose these per endpoint in our catalog. ⚖ review
• Operational logs (request metadata, errors): up to 30 days, then deleted or aggregated beyond recognition.
• Account data: kept while your account is active; up to 90 days after deletion, to handle closing the books and comply with tax law.
• Billing records: kept as long as Kazakhstani law requires for financial documents. [Placeholder — confirm retention periods with counsel.]
• Waitlist emails: until early access opens, or until you ask us to remove you.
• Anonymized outcome signals: kept indefinitely — they can no longer be linked to you.

§7 How we protect it

We treat your data like it’s ours:

• Encryption in transit — TLS for all traffic to and from our endpoints;
• Access controls — least-privilege, need-to-know access for the team; API keys stored hashed;
• Monitoring — we watch for abuse and anomalies;
• Hygiene — secrets never in code or logs; routine reviews of what we store and why.

No system is perfectly secure. If a breach ever affects your data, we’ll tell you promptly and plainly. Found a security issue? Please write to [email protected] and give us a chance to fix it first.

§8 International data transfers ⚖ confirm posture

Honest version: routing means your data crosses borders. The model providers in our network operate data centers outside Kazakhstan — typically in the United States, the European Union, and Asia. When you send a request through apiegg, the prompt and context needed to serve it are transmitted to the provider we route it to, wherever it operates. Residency settings (EU end-to-end; Kazakhstan) constrain where residency-flagged traffic may land — see our residency page.

Those providers process your data under their own terms and privacy policies, which may differ from Kazakhstan’s data-protection rules. By using the service, you acknowledge and agree to these transfers. If your own customers’ data flows through your agents, make sure your privacy terms tell them the same thing. [Placeholder — review transfer mechanisms and provider DPAs with counsel.]

§9 Your rights ⚖ confirm with counsel

It’s your data. You can:

• Access it — ask what personal data we hold about you;
• Correct it — fix anything inaccurate or out of date;
• Export it — get a copy in a machine-readable format;
• Delete it — close your account and ask us to erase your personal data;
• Object or withdraw — for the waitlist, unsubscribe at any time.

We align this policy with Kazakhstan’s Law “On Personal Data and Their Protection” (Law No. 94-V, as amended), under which you may request access to, correction of, or deletion of your personal data. To exercise any of these rights, email [email protected] — we’ll respond within 30 days. [Placeholder — confirm response window and verification process with counsel.]

§10 Children

apiegg is a developer service intended for adults. It is not directed to minors, and you must be at least 18 years old (or the age of majority where you live) to use it. We don’t knowingly collect data from minors; if we learn we have, we’ll delete it.

§11 Changes to this policy

We may update this policy as the service grows. Material changes will be announced in advance — by email or in-product notice — and the effective date at the top of this page will change. Continued use after the effective date means you accept the updated policy. Past versions are available on request.

§12 Contact ⚖ confirm inbox

Privacy questions, data requests, or complaints: [email protected] (placeholder address). For anything else, the home page has general contact details.

End of Privacy Policy · Effective 2026 · Terms of Service →