1. Scope and roles
This Privacy Policy applies to personal data Open Token LLC collects through getopentoken.com, customer accounts, support and sales communications, billing, and the Open Token API. It does not replace the privacy terms of Amazon Web Services, Stripe, model providers, or websites linked from our Services.
Open Token generally acts as a controller for account, business-contact, security, and billing data. For personal data that Customer chooses to include in API Inputs, Open Token generally processes that data for Customer to provide the requested inference. Customer decides what to submit and remains responsible for its legal basis, notices, and end-user requests. A data processing addendum may be appropriate for some customers.
2. Personal data we collect
- Account and company data: name, business email, company name, headquarters country, account role, status, login timestamps, and Terms-acceptance version and time.
- Authentication and configuration: password hashes, session cookies, API-key names, one-way API-key hashes and prefixes, spending limits, and encrypted BYOK provider credentials.
- Billing and transaction data: Stripe customer and checkout identifiers, purchase amount, fees, credit balance, ledger entries, payment status, refund status, and invoice or receipt references. We do not store complete payment-card numbers.
- API usage metadata: model and provider, whether BYOK was used, token counts, cost, latency, streaming status, completion reason, request status, generation and API-key identifiers, timestamp, and a limited error description when a request fails.
- Communications: contact name, email, company, message, delivery status, user agent, and a keyed hash of the sender's IP address for abuse prevention.
- API content: prompts and model responses pass through Open Token while a request is being served. The application does not persist this content in its database or intentionally write it to operational logs. More detail appears in the Data & Logging Policy.
3. How we use personal data
- Provide, authenticate, route, meter, bill, and support the Services.
- Administer companies, users, API keys, credits, invoices, refunds, and provider integrations.
- Secure the Services, enforce rate limits and policies, investigate failures, and prevent fraud or abuse.
- Respond to sales inquiries, support requests, legal notices, and privacy requests.
- Maintain business records, comply with law, resolve disputes, and enforce agreements.
- Analyze aggregate service performance and capacity without using prompt or response content for training.
Where the European Economic Area, United Kingdom, or similar law requires a legal basis, we rely as applicable on performance of a contract, legitimate interests in operating and securing a B2B service, compliance with legal obligations, and consent where requested. Customer may contact us for more detail about a particular processing activity.
4. API content and model providers
To answer a request, Open Token sends the Input and technical request data only to the model provider of the connection Customer selects (Amazon Bedrock, OpenAI, Anthropic, Google Gemini, Vertex AI, Azure OpenAI, Mistral, Cohere, or an OpenAI-compatible endpoint). With BYOK, requests are made and billed under Customer's own provider account; they still pass through Open Token for routing and metering. Provider handling can vary by model, region, and account settings, so Customer must review the applicable model-provider terms before sending sensitive data.
Open Token does not use API Inputs or Outputs to train models and does not sell them. Upstream providers have their own legal obligations and data practices. The Model Licenses & Attributions page identifies relevant model terms, and the Data & Logging Policy explains the current application behavior.
5. When we disclose data
- Cloud and inference: Amazon Web Services hosts the application, database, operational logs, email delivery, and Amazon Bedrock inference.
- Payments: Stripe processes checkout, payment methods, receipts, invoices, and billing portal functions.
- Customer administrators: authorized company users may see company account, usage, keys, balance, and billing information according to their access.
- Professional advisers and authorities: we may disclose data to advisers, regulators, courts, or law enforcement where reasonably necessary and legally permitted.
- Business transactions: data may transfer in a financing, merger, acquisition, reorganization, or sale, subject to appropriate confidentiality and applicable law.
We do not sell personal data or share it for cross-context behavioral advertising.
6. Cookies and similar technologies
The dashboard uses an essential, HTTP-only session cookie to keep a signed-in user authenticated. It is configured with same-site protections and normally expires after seven days. The current application does not use advertising cookies. Infrastructure providers may process ordinary request information needed to deliver and secure the site.
7. Retention
We keep account, transaction, ledger, and API usage metadata while the account is active and afterward as reasonably necessary for billing, tax, audit, fraud prevention, dispute resolution, security, and legal obligations. Contact messages remain available to staff for sales and support follow-up. Encrypted BYOK credentials remain until Customer replaces or disconnects them. The production application's CloudWatch operational logs are configured for fourteen-day retention.
Prompt and response content is not persisted by the Open Token application. A limited provider error description may be stored with failed-request metadata. Provider-side retention is controlled by AWS, Customer's AWS configuration when using BYOK, and applicable model terms. Backups and legally required records may remain for a limited additional period.
8. Security
We use safeguards designed for the nature of the data, including password hashing, one-way hashing of API keys, encryption of provider credentials using AES-256-GCM, access controls, transport encryption, and limited operational-log retention. No security measure eliminates all risk. Customer should use dedicated, least-privilege AWS credentials for BYOK and must not submit data that its security or legal requirements prohibit providers from processing.
9. International transfers
Open Token is a United States company and uses service providers that operate in the United States and other countries. Personal data may therefore be processed outside the country where it originated. Where required, the parties will use an approved transfer mechanism and appropriate safeguards.
10. Privacy rights and choices
Depending on location and applicable law, an individual may have rights to request access, correction, deletion, portability, restriction, or objection; to withdraw consent; or to appeal a denied request. Some data must be requested through the individual's employer because the company controls the account.
Submit a request to support@getopentoken.com. We may verify identity and authority, and legal exceptions may apply. Authorized agents may submit requests where local law permits. Individuals may also complain to their local data-protection authority.
11. Children
The Services are business products and are not directed to children. Account holders must be at least eighteen years old and authorized to act for their organization. We do not knowingly create accounts for children.
12. Changes and contact
We may update this Policy as the Services, providers, or laws change. We will post the new effective date and provide additional notice for material changes where required.
Questions and requests may be sent to support@getopentoken.com or Open Token LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, USA.