Privacy Policy

Hyphen (“Hyphen”, “we”, “us”) is an AI API gateway based in Malaysia. We collect the minimum needed to run your account and enforce usage caps. We do not log the content of your prompts or completions, we do not sell your data, and we use no advertising trackers. Contact: support@hyphen-solution.com.

We collect and store:

• Account data — your email address and, if you sign in with OAuth (e.g. GitHub), the basic profile the provider shares (name, avatar, account id).
• Billing data — handled by Stripe. Your card number never touches Hyphen's servers; we store only Stripe's references (customer id, subscription status, purchase history).
• Per-request metadata — token counts, the model called, timestamps, and the computed spend for each request. This is what enforces your monthly cap and your fair-use rate limits, powers the usage page, and lets us spot abuse.
• Consent record — the details in section 3, stored when you accept the Terms of Service.
• Product milestone events — account-linked timestamps for actions such as starting or completing checkout, revealing an API key, making a first request, returning after seven days, opening the billing portal, and scheduling or reversing cancellation. Event metadata is limited to operational identifiers and plan choices; it does not contain prompt or completion content.
• Marketing preference — whether you opted in, plus the time and signup/settings source of that choice. Marketing is optional and starts off disabled.

When you tick the box to accept our Terms of Service at signup, we store a record of that acceptance against your account: the time you accepted, the version of the Terms you accepted, the IP address the acceptance came from, and your browser's user agent string.

We keep this because it is the evidence that the agreement between us exists and that you agreed to a specific version. The legal basis is our legitimate interest in being able to establish and defend the contract. We do not use the legal acceptance record for marketing.

The record is kept for as long as your account exists, and afterwards only for as long as we need it to resolve or defend a dispute, or for as long as the law requires. If we publish a material update to the Terms and you accept the new version, the record is updated to the version you accepted.

Hyphen does not persist prompt or completion content in its own gateway logs or account database. Message logging is disabled at the gateway. The text of your requests and the model's responses still passes through our gateway and is sent to the upstream model provider selected by your request.

Upstream providers process content under their own terms and privacy policies and may temporarily cache or retain it for service delivery, safety, abuse prevention, or legal compliance. Some provider features, including automatic prompt caching, can retain repeated prompt prefixes for a provider-controlled period. Do not send passwords, API keys, highly sensitive personal data, or content you are not permitted to disclose.

We use a small set of processors to run the service:

• Supabase (Singapore region) — account database and authentication.
• Stripe — payments, subscriptions, and invoices.
• Vercel — hosting for the website and console.
• Oracle Cloud — hosting for the API gateway.
• Upstream model providers, currently MiniMax (Nanonoble Pte. Ltd.) — process request content to generate completions and may cache or retain it under their own terms and privacy policy.

We use authentication cookies to keep you signed in, short-lived first-party cookies to carry signup attribution, purchase intent, and the choices you make on the signup form through an email or OAuth redirect, and a first-party preference cookie for interface settings. There are no advertising or cross-site tracking cookies on any Hyphen property.

We measure aggregate site traffic with Vercel Web Analytics, a cookieless, privacy-respecting service. It records page views and approximate region without identifying you, storing anything on your device, or tracking you across sites.

We use the account-linked product milestone events in section 2 to understand whether setup works, measure conversion and retention, and troubleshoot billing journeys. We do not place prompt or completion content in those events and do not sell or share them for advertising.

Account and billing records are kept while your account is active and for as long as tax and accounting law requires afterwards. Per-request metadata is kept to operate caps and rate limits, show usage history, and detect abuse, and is deleted or anonymized when no longer needed for those purposes. The consent record in section 3 is kept while your account exists and afterwards only as long as we need it to resolve a dispute. When you delete your account we delete your data, except the minimal records law requires us to retain.

You can download a structured copy of the account data available in the console from Settings. You can also ask us for a fuller copy, ask us to correct data, or ask us to delete your account and data by emailing support@hyphen-solution.com from your account email; we will act on it within 30 days.

If you are in the European Economic Area or the UK, the GDPR gives you these rights formally (access, rectification, erasure, restriction, portability, objection), and our legal bases for processing are the performance of our contract with you (running the service), legal obligations (tax records), and legitimate interests (abuse prevention). If you are in Malaysia, the Personal Data Protection Act 2010 (PDPA) grants equivalent access and correction rights, which we honor the same way. You may also complain to your local data-protection authority.

Our processors operate in multiple countries. Account data is hosted in Supabase's Singapore region; other processing may occur in Malaysia, Singapore, the United States, and locations used by Stripe, Vercel, Oracle Cloud, and upstream model providers. We use contractual and technical safeguards appropriate to the service and applicable cross-border transfer rules.

We use access controls, encryption in transit, restricted service credentials, usage caps, and monitoring intended to protect account data. No internet service is completely secure. If a personal-data breach creates a legally reportable risk, we will notify the regulator and affected people within the periods required by applicable law.

If we change what we collect or who processes it, we will update this page and its effective date, and give notice of material changes by email or a prominent notice on the site before they take effect.

Privacy questions and requests: support@hyphen-solution.com.