Privacy Policy

Version Number: 2026V1 · Last Updated: 2026.07

This Privacy Policy describes how Zenlayer Inc. ("Company," "we," "us," or "our") collects, uses, and discloses information about you when you visit our website at https://www.tkex.ai (the "Site"), register for an account, or use the Zenlayer Token Exchange platform and related services (collectively, the "Service").

Please read this Privacy Policy carefully. By accessing the Site or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Service.

1. Who This Policy Applies To

This Privacy Policy applies to:

  • Visitors who browse the Site without registering;

  • Registered users who create an account on the Site;

  • Customers who use the Service to access AI model inference through our API;

  • Model Providers and other partners who onboard onto the platform as suppliers.

Where different categories of individuals have different rights or where we process data differently, we note this within the relevant section below.

2. Information We Collect

2.1 Information You Provide to Us

When you register for an account or use the Service, we collect:

  • Email address: used for account creation, authentication, service communications, and (with your consent) marketing communications.

  • OAuth authentication data: if you register or log in using a third-party OAuth provider (such as GitHub), we receive the information that provider makes available under the OAuth scope you authorize, which typically includes your email address and public profile identifier. We do not receive or store your OAuth provider password.

  • Payment information: when you purchase Credits, payment is processed by Stripe. We do not receive or store your full payment card number or CVV. We retain only transaction identifiers, amounts, payment method type, and billing status as returned by Stripe.

  • Communications: if you contact us by email or through support channels, we retain the content of that communication and your contact details in order to respond.

  • Business and compliance information: where required for identity verification, tax compliance, or regulatory purposes, we may collect business registration information, including company name, country or region of incorporation, business registration number, tax identification number, and supporting documentation such as business licenses or certificates of incorporation, as applicable.

2.2 Information We Collect Automatically

When you visit the Site or use the Service, we automatically collect certain technical information, including:

  • IP address: collected for security, fraud prevention, geo-restriction enforcement, and service operations.

  • Request metadata: when you make API calls through the Service, we collect metadata associated with each request, including the model identifier, Provider routed to, token counts, request latency, response status code, and timestamps. This metadata does not include the content of your prompts (Inputs) or AI model responses (Outputs).

  • Log data: standard server logs including browser type, operating system, referring URLs, and pages visited on the Site.

  • Cookies and similar technologies: we use cookies and similar tracking technologies to operate the Site, remember your preferences, and maintain your session. We may also use third-party analytics tools to understand how visitors interact with the Site. For more details, see Section 7 (Cookies and Analytics) below.

2.3 Information We Do Not Collect

The following categories of information are not collected or stored by the Company:

  • Prompt content (Inputs): we do not store, log, or retain the content of any prompts or instructions you submit to the Service. Inputs are transmitted in real time to the applicable Model Provider and discarded by the Company upon completion of transmission.

  • Output content: we do not store, log, or retain the content of any AI model responses (Outputs) returned to you.

  • Real name, phone number, or company name: we do not require or collect these at registration.

3. How We Use Your Information

We use the information we collect for the following purposes:

  • Providing and operating the Service: processing API requests, managing your account, issuing and validating API keys, billing, and providing customer support.

  • Security and fraud prevention: detecting abuse, enforcing geo-restrictions, screening for prohibited use patterns, and protecting the integrity of the Service.

  • Analytics and service improvement: understanding usage patterns, diagnosing technical issues, and improving Service performance. Request metadata (not prompt content) is used for this purpose.

  • Legal compliance: complying with applicable laws, responding to lawful requests from public authorities, and enforcing our Terms of Service.

  • Communications: sending you transactional emails related to your account (such as billing confirmations and security notices). We will only send you marketing or promotional communications if you have opted in to receive them.

We do not use your personal data to train, fine-tune, or improve any AI model, and we do not sell your personal data to third parties.

4. How We Share Your Information

We do not sell your personal data. We may share your information in the following limited circumstances:

4.1 Model Providers

When you submit an API request, your Input is transmitted to the applicable third-party Model Provider (such as OpenAI, Anthropic, Google, and others) in order to generate a response. Each Model Provider receives and processes your Input under its own terms of service and privacy policy. The Company is not responsible for Model Providers' data handling practices. We encourage you to review each Provider's privacy documentation before submitting sensitive data.

4.2 Payment Processor

We share your payment transaction information with Stripe, our third-party payment processor, solely to process Credit purchases and manage billing. Stripe's processing is governed by its own privacy policy and terms of service.

4.3 Service Providers

We may engage third-party service providers to assist in operating the Site and Service (for example, cloud infrastructure providers, analytics vendors, or email delivery services). Such providers access your information only to the extent necessary to perform services on our behalf and are contractually required to protect it.

4.4 Legal Requirements and Protection of Rights

We may disclose your information if we believe in good faith that disclosure is necessary to: (a) comply with applicable law, regulation, legal process, or government request; (b) enforce our Terms of Service or other agreements; (c) detect, prevent, or address fraud, security, or technical issues; or (d) protect the rights, property, or safety of the Company, our users, or the public.

4.5 Business Transfers

If the Company undergoes a merger, acquisition, reorganization, or sale of all or substantially all of its assets, your information may be transferred as part of that transaction. We will notify you via email or a prominent notice on the Site if such a transfer occurs and this Privacy Policy changes materially as a result.

5. Data Retention

We retain your personal data only for as long as necessary for the purposes described in this Privacy Policy, or as required by applicable law.

  • Account information (email address, account settings): retained for the duration of your account and for a reasonable period thereafter to comply with legal obligations or resolve disputes.

  • Billing metadata (Credits consumed, token counts, model identifier, Provider routed to, response status, and timestamps): retained for 12 months for billing reconciliation, dispute resolution, and financial record-keeping purposes.

  • Operational and analytics metadata (request latency, error rates, and aggregated usage statistics): retained for 45 days in identifiable form. After this period, data may be retained in aggregated and anonymized form that cannot be linked to any individual user or account, for an indefinite period.

  • IP address: retained in server logs for 180 days.

  • Payment records: retained as required by applicable financial regulations.

  • Prompt content / Output content: not retained. Discarded upon completion of each transmission.

To request deletion of your account and associated personal data, please contact us at info@tkex.ai. We will respond within 30 days and fulfill your request to the extent required by applicable law. Note that certain data categories described above may be retained for their respective periods following account deletion, where required by applicable law or for legitimate business purposes such as fraud prevention and financial record-keeping.

6. International Data Transfers

The Company is based in the United States. If you access the Service from outside the United States, your personal data may be transferred to and processed in the United States or other countries where our service providers or Model Providers operate. Data protection laws in these countries may differ from those in your home jurisdiction.

Where transfers of personal data from the European Economic Area (EEA), the United Kingdom, or Switzerland require a legal transfer mechanism under applicable data protection law, we rely on appropriate safeguards as required by applicable law. Where Standard Contractual Clauses or other transfer mechanisms apply, these are incorporated into the Company's Data Processing Agreement (DPA), available at https://www.tkex.ai/legal/dpa. The DPA automatically applies where required by applicable law upon your acceptance of these Terms.

By using the Service, you acknowledge that your data may be transferred internationally as described above.

7. Cookies and Analytics

The Site uses cookies and similar technologies solely to operate core functionality, such as session management, authentication, and security. These cookies are necessary for the Service to function and cannot be disabled without affecting your ability to use the Site.

We do not currently use third-party analytics or advertising cookies. If this changes in the future, we will update this Privacy Policy and, where required by applicable law, obtain your consent before placing any non-essential cookies.

8. Marketing Communications

We will only send you marketing or promotional communications if you have actively opted in to receive them (for example, by checking the relevant box during registration). You may withdraw your consent and unsubscribe from marketing communications at any time by clicking the unsubscribe link in any marketing email or by contacting us at info@tkex.ai.

Opting out of marketing communications will not affect transactional communications related to your account, such as billing notifications or security alerts.

9. Your Privacy Rights

Depending on your location, you may have certain rights regarding your personal data. These rights may include:

  • Right to access: request a copy of the personal data we hold about you.

  • Right to correction: request correction of inaccurate or incomplete personal data.

  • Right to deletion: request deletion of your personal data, subject to legal retention requirements.

  • Right to object or restrict processing: object to or request restriction of certain processing activities.

  • Right to data portability: receive your personal data in a structured, machine-readable format.

  • Right to withdraw consent: where processing is based on consent (such as marketing communications), withdraw that consent at any time.

To exercise any of these rights, please submit a request to info@tkex.ai. We will respond within 30 days. We may ask you to verify your identity before fulfilling your request. We will not discriminate against you for exercising your privacy rights.

California residents should refer to Annex B for the response timelines applicable to requests under California law.

If you are located in the European Economic Area or the United Kingdom and believe we have not addressed your privacy concerns adequately, you have the right to lodge a complaint with your local data protection authority.

10. Data Security

We implement commercially reasonable technical and organizational security measures to protect your personal data from unauthorized access, disclosure, alteration, or destruction. These measures include encryption of data in transit, access controls, and regular security reviews.

However, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee the absolute security of your data. If we become aware of a security breach that affects your personal data, we will notify you in accordance with applicable law.

11. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected personal data from a person under 18, please contact us at info@tkex.ai and we will take steps to delete that information promptly.

12. Third-Party Links and Services

The Site or Service may contain links to third-party websites or services, including Model Provider documentation pages. This Privacy Policy does not apply to those third-party services, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party services you access through the Service.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. For material changes that affect your rights or how we handle your personal data, we will provide advance notice via email or a prominent notice on the Site at least 30 days before the changes take effect. For non-material changes, we will update the "Last Updated" date at the top of this policy.

Your continued use of the Service after the effective date of any update constitutes your acceptance of the revised Privacy Policy. If you do not agree with the updated policy, you should stop using the Service and may request deletion of your account.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

  • Email: info@tkex.ai

  • Mailing address: Zenlayer Inc., 21700 Copley Drive Suite 350, Diamond Bar, CA 91765, United States.

For data subject requests (access, correction, deletion), please email info@tkex.ai with the subject line "Privacy Request." We will respond within 30 days.

Annex A: Additional Information for EEA and UK Users

This Annex provides additional information for individuals in the European Economic Area (EEA) and the United Kingdom (UK), as required by the General Data Protection Regulation (GDPR) and UK GDPR.

Legal Bases for Processing

We process your personal data on the following legal bases:

  • Performance of a contract (GDPR Art. 6(1)(b)): processing your account information, API requests, and billing data is necessary to provide the Service to you.

  • Legitimate interests (GDPR Art. 6(1)(f)): we process technical data such as IP addresses, log data, and request metadata for security, fraud prevention, and service improvement, where our legitimate interests are not overridden by your rights.

  • Consent (GDPR Art. 6(1)(a)): we send marketing communications only with your prior, freely given, specific consent. You may withdraw consent at any time.

  • Legal obligation (GDPR Art. 6(1)(c)): we process and retain certain data where required by applicable law.

Controller and Processor

With respect to your account and usage data, Zenlayer Inc. acts as the data controller. With respect to the content of API requests transmitted through the Service on behalf of customers, Zenlayer Inc. acts as a data processor. A Data Processing Agreement (DPA) is available for customers subject to GDPR or UK GDPR.

Data Protection Officer

We have not appointed a Data Protection Officer at this time. Privacy-related inquiries should be directed to info@tkex.ai.

Supervisory Authority

If you are located in the EEA or UK and have concerns about our privacy practices that we have not adequately addressed, you have the right to lodge a complaint with your local data protection supervisory authority.

Annex B: Additional Information for California Residents

This Annex supplements the Privacy Policy for California residents under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA).

Categories of Personal Information Collected

In the preceding twelve months, we have collected the following categories of personal information: identifiers (email address, IP address, account ID, and OAuth provider identifiers where applicable); internet or electronic network activity information (including request metadata, log data, cookies, and similar technical data); and commercial information (including Credits purchased and transaction records). We have not collected sensitive personal information as defined under CPRA.

Your California Privacy Rights

As a California resident, you have the right to: (1) know what personal information we collect, use, disclose, and sell; (2) request deletion of your personal information; (3) opt out of the sale or sharing of your personal information; (4) correct inaccurate personal information; and (5) non-discrimination for exercising your rights.

No Sale or Sharing of Personal Information

We do not sell your personal information for money. We do not share your personal information for cross-context behavioral advertising purposes.

How to Submit a Request

To exercise your California privacy rights, please contact us at info@tkex.ai. We will verify your identity before processing your request and respond within 45 days, with an extension of an additional 45 days where reasonably necessary.