Privacy Policy

Welcome to MirAPI!

Introduction

This privacy policy (“Privacy Policy”) applies to the personal data relating to you (“Personal Data,” or other similar terms as defined by applicable data protection law) that MirAPI processes in connection with the MirAPI websites, applications, application programming interfaces (APIs), software, and related services (the “Services”) that link to or reference this Privacy Policy. The Services enable you to access a variety of third-party generative artificial intelligence models (“Models”) provided by third-party model developers, providers, or their hosting partners (“Model Providers”) through a unified API and related interfaces. Capitalized terms used but not defined in this Privacy Policy have the meanings given to them in the MirAPI Terms of Use (the “Terms”).

Data Controller: The Services are provided and controlled by Benxi HengFeng Network Technology Co., Ltd. (“MirAPI,” “we,” “us,” or “our”). If you have any questions about how we use your Personal Data, please contact us at support@mirapi.ai.

Please be informed that this Privacy Policy does not cover the processing of Personal Data collected from end users by downstream applications or services developed by developers or authorized resellers using the Services. The developer or reseller operating such an application, as the controller of that Personal Data processing activity, is responsible for disclosing its own privacy policies to its end users. This Privacy Policy also does not cover the independent processing of your data by Model Providers, which is described in the section “How We Process Inputs and Outputs” below.

By using the Services, you acknowledge the practices described in this Privacy Policy. If you do not agree with any part of this Privacy Policy or the Terms, you should not use or access the Services.

1. What Personal Data We Collect

We collect your Personal Data in three ways: Personal Data You Provide, Automatically Collected Personal Data, and Personal Data From Other Sources. More detail is provided below.

1.1 Personal Data You Provide

Account Personal Data. We collect Personal Data that you provide when you set up an account, such as your email address and password, and, where applicable, your username and other registration information.

User Input. When you use the Services, we process the content you submit to the Services through the API or other interfaces, such as text, prompts, uploaded files, images, and other supported formats (“Inputs”), in order to transmit them to the Model you select and to return to you the content generated in response (“Outputs”). As described in the section “How We Process Inputs and Outputs” below, we process Inputs and Outputs on a transient basis and do not persistently store their content. We do not extract or mine voiceprints, facial recognition information, or other unique biological patterns or characteristics used to identify a specific individual from any voice, image, or video content you submit.

Payment and Transaction Personal Data. When you purchase Credits or use paid features of the Services, we collect your payment order and transaction records (such as the amount, time, and status of a purchase, and your Credit balance and consumption records) to provide order placement, payment, billing, customer service, and after-sales support. Payments are processed by third-party payment processors; we do not store your full payment card numbers or equivalent payment credentials, which are handled by the applicable payment processor under its own privacy policy.

Personal Data When You Contact Us. When you contact us, we collect the Personal Data you send to us, such as your contact details, proof of identity where needed, and the content of your feedback, inquiries, refund requests, or reports about possible violations of our Terms or other policies.

1.2 Automatically Collected Personal Data

Device and Network Personal Data. We collect certain device and network connection Personal Data when you access the Services, such as your IP address, browser type, operating system, device identifiers, and system language. We also collect service-related, diagnostic, and performance information, such as error reports and performance logs, to keep the Services stable and secure.

Usage Metadata. We collect metadata regarding your use of the Services, such as request timestamps, the Models you select, token counts, request status, latency, error codes, API key usage, and billing records. This metadata is necessary to operate, meter, bill, and secure the Services. It does not include the content of your Inputs and Outputs.

Approximate Location Personal Data. We may derive your approximate location from your IP address (1) for security reasons, such as detecting unusual login activity; and (2) where a Model Provider requires information about the country of an originating request, as described in the Terms. We do not collect precise geolocation information.

Cookies and Similar Technologies. We may use cookies and similar technologies to operate and provide the Services, including strictly necessary cookies (for example, to keep you logged in and provide a secure browsing experience), functional cookies (to remember your preferences), and analytics cookies (to understand how the Services are used in aggregate). We do not use cookies to deliver targeted advertising. We will allow you to manage our use of non-essential cookies where required by law. Your browser may also allow you to refuse or remove cookies; if you disable cookies, some parts of the Services may not function properly.

1.3 Personal Data From Other Sources

Log-in, Sign-up, or Linked Services. Where available, if you choose to sign up or log in to the Services using a third-party service, we may collect Personal Data from that third-party service, such as an access token and the email address associated with your third-party account.

Security Personal Data. We may receive Personal Data from trusted partners, such as security and fraud-prevention partners, to protect against fraud, abuse, and other security threats to the Services.

1.4 Sensitive Personal Data

The Services are not designed or intended to process sensitive Personal Data (e.g., personal data revealing racial or ethnic origin, religious beliefs, health, sexuality, citizenship or immigration status, genetic or biometric data, personal data of children, precise geolocation, or criminal records). We do not ask for, and you should not submit, sensitive Personal Data to the Services, whether about yourself or other individuals.

If you submit image, audio, or video content containing the voice or likeness of an identifiable individual to a Model, you are responsible for ensuring that you have obtained any notice and consent from that individual required by applicable law. MirAPI acts as an intermediary that transmits such content to the applicable Model Provider: we do not use such content for any independent purpose, do not store it beyond the transient processing described in “How We Process Inputs and Outputs” below, and do not generate any biometric identifiers from it.

2. How We Process Inputs and Outputs

This section describes the data practices that are specific to the nature of the Services as a model aggregation and routing platform.

Transmission to Model Providers. When you submit Inputs through the Services, those Inputs are transmitted to the Model Provider you select, or that is selected through your routing preferences and fallback configurations, in order to generate Outputs. This transmission is necessary to provide the Services.

Transient Processing; No Persistent Content Storage. We process Inputs and Outputs on a transient basis, solely as necessary to route, process, and fulfill your requests (including temporary storage where required for batch or large-volume request processing), to maintain the security of the Services, to prevent abuse, to troubleshoot issues, and to comply with applicable legal obligations. We do not persistently store the content of your Inputs and Outputs beyond such transient processing, and we do not use your Inputs or Outputs to train generative artificial intelligence models.

Model Provider Data Practices. Different Model Providers have different data practices, including with respect to whether they retain your Inputs and Outputs or use them to train, fine-tune, evaluate, or improve their Models. Model Providers process your Inputs and Outputs under their own terms and privacy policies, and we do not control, and are not responsible for, their handling of your data. Before using a Model, you should review the applicable Model Provider’s terms and data practices. If you do not want your Inputs used for model training, select a Model or Model Provider that commits to not using your data for that purpose.

3. How We Use Your Personal Data

We use your Personal Data to operate, provide, and secure the Services, including for the following purposes:

• To provide, administer, and maintain the Services and to enforce our terms, conditions, and policies, such as creating your account, authenticating your access, routing your requests to Model Providers, and providing user support.
• To meter your usage, calculate and deduct fees from your Credit balance, process purchases and refunds, manage Dormant Account status, and maintain billing and transaction records.
• To communicate with you, including to notify you about changes to the Services, your account, transactions, security matters, and these policies, and to respond to your inquiries. Where we send promotional communications, you may opt out at any time as described in “Your Choices” below.
• To promote the safety, security, and stability of the Services, such as by preventing and detecting abuse, fraud, and illegal activity, enforcing rate limits, and conducting troubleshooting, data analysis, testing, and research on the basis of usage metadata in aggregated or de-identified form.
• To comply with our legal obligations, or as necessary to perform tasks in the public interest, or to protect the vital interests of our users and other people, in accordance with the due process prescribed by law.

PLEASE NOTE: We do not use the content of your Inputs or Outputs to train models or to improve the Services. We do not “sell” your Personal Data, do not use your Personal Data for targeted advertising, and do not engage in “profiling” or other automated processing of Personal Data to make decisions that could have legal or similarly significant impact on you or others.

4. How We Share Your Personal Data

Model Providers. When you use the Services, we transmit your Inputs to the Model Provider(s) you select in order to generate Outputs, together with such technical information as is necessary to fulfill the request (which may include the country of the originating request where required by the Model Provider). Model Providers may, depending on their own terms and data practices, retain and use your Inputs and Outputs for their own purposes. The Model Provider’s own terms govern its independent use of your data.

Service Providers. We engage service providers that help us provide, support, and develop the Services, such as cloud hosting and infrastructure providers, payment processors, communication service providers, analytics providers, and security and abuse-monitoring providers. Pursuant to our instructions, these parties will access, process, or store Personal Data only in the course of performing their duties to us and are obligated to keep it confidential.

Our Corporate Group. The Services may be supported by entities within our corporate group, which may process Personal Data for us as necessary to provide certain functions, such as storage, content delivery, security, analytics, and customer and technical support.

Parties to a Corporate Transaction. Your Personal Data may be disclosed to third parties in connection with a corporate transaction, such as a merger, sale of assets or shares, reorganization, financing, change of control, or acquisition of all or a portion of our business.

Law Enforcement and Parties with Other Legal Rights. We may access, preserve, and share your Personal Data with law enforcement agencies, public authorities, rights holders, or other third parties if we have a good-faith belief that it is necessary to: (a) comply with applicable law, legal process, or government requests, in accordance with the due process prescribed by law; (b) protect the rights, property, and safety of our users, rights holders, and others, including protecting life or preventing imminent bodily harm; (c) investigate potential violations of and enforce our Terms or other applicable policies; or (d) detect, investigate, prevent, or address fraud, abuse, security issues, or other illegal activity.

With Your Consent. We may share Personal Data with third parties where you have authorized or requested it, for example if you choose to log in using a third-party account.

Third-Party Content. The Services and Outputs may contain links to policies, functionality, or content maintained by third parties not controlled by us. We are not responsible for, and make no representations regarding, such policies, functionality, or content, or any other practices or operations of such third parties.

5. Your Rights

Depending on where you live and subject to exceptions provided under applicable data protection laws, you may have certain rights with respect to your Personal Data, which may include:

• the right to know whether and how we process your Personal Data;
• the right to access your Personal Data;
• the right to correct inaccuracies in your Personal Data;
• the right to delete Personal Data you have provided to us or that we have obtained about you;
• the right to receive a portable copy of your Personal Data, to the extent it is available in a digital format and where technically feasible;
• the right to object to, or request restriction of, the processing of your Personal Data;
• the right to withdraw consent at any time, where processing is based on your consent (withdrawal will not affect the lawfulness of processing before such withdrawal); and
• the right to opt out of the processing of your Personal Data for the purposes of targeted advertising, sale, or profiling that could have legal or similarly significant impact on you. NOTE THAT WE DO NOT ENGAGE IN TARGETED ADVERTISING, “SELL” PERSONAL DATA, OR USE PERSONAL DATA FOR SUCH “PROFILING.”

To exercise your rights, you or an authorized agent may submit a request by emailing us at support@mirapi.ai. After we receive your request, we may verify it by requesting information sufficient to confirm your identity or your authority to act on behalf of someone else. You may also appeal a request that we deny by emailing the same address. If your appeal is unsuccessful, and depending on where you live, you may have the right to lodge a complaint with the competent supervisory authority. We will not discriminate against you for exercising any privacy right you may have.

A note about accuracy: generative AI services produce Outputs by predicting the content most likely to follow from a request, and the result may not be factually accurate. You should not rely on the factual accuracy of Outputs. If you notice that an Output contains factually inaccurate Personal Data about you, you may submit a correction or removal request to support@mirapi.ai, and we will consider your request based on applicable law and the technical capabilities of the Services; please note that because Outputs are generated by third-party Models, our ability to correct the behavior of a Model may be limited, and we may refer you to the applicable Model Provider.

6. Your Choices

Account Information. You can review and update certain account information directly through your account settings, or by contacting us at support@mirapi.ai.

Account Deletion. You may request to delete your account and the Personal Data in your account, subject to certain limitations, through your account settings or by emailing support@mirapi.ai. Refunds of remaining purchased Credits upon termination are handled as described in the Terms. If you choose to delete your account, you will not be able to reactivate it or retrieve any of the content or Personal Data connected with it, except where retention is required as described in “Data Retention” below.

Marketing Communications. If we send you promotional or marketing communications, you may opt out at any time by following the “unsubscribe” instructions included in those messages or by emailing support@mirapi.ai. Opt-out requests may take a reasonable amount of time to process. This opt-out does not apply to service-related communications, such as notices about your account, transactions, security, or changes to our terms and policies.

Cookies. You can manage cookies through your browser settings as described in “Cookies and Similar Technologies” above.

7. The Security of Your Personal Data

The security of your Personal Data is important to us. We maintain commercially reasonable technical, administrative, and physical security measures designed to protect your Personal Data from unauthorized access, theft, disclosure, modification, or loss, and we regularly review our security measures to consider available new technology and methods. However, no Internet or email transmission is ever fully secure or error free. In particular, emails sent to or from us may not be secure. Therefore, you should take special care in deciding what Personal Data you send to us via the Services or email. In addition, we are not responsible for the circumvention of any privacy settings or security measures contained on the Services or third-party websites.

8. Data Retention

We retain Personal Data for as long as necessary to provide the Services and for the other purposes set out in this Privacy Policy. We also retain Personal Data when necessary to comply with contractual and legal obligations, when we have a legitimate business interest to do so (such as maintaining the safety, security, and stability of the Services), and for the exercise or defense of legal claims. In particular:

• Account Personal Data is retained for as long as you have an account.
• Payment and transaction records are retained for as long as you have an account and thereafter for the period required by applicable accounting, tax, e-commerce, and other laws.
• Usage metadata and network logs are retained for the periods necessary for the operational, metering, billing, security, and legal purposes described in this Privacy Policy, including any minimum log-retention periods required by applicable law.
• The content of Inputs and Outputs is not persistently stored, and is processed only on the transient basis described in “How We Process Inputs and Outputs” above.
• If you violate our terms, policies, or guidelines, we may keep relevant Personal Data as necessary to process the violation.

When the Personal Data collected is no longer required by us, we and our service providers will perform the necessary procedures for destroying, deleting, erasing, or converting it into an anonymous form as permitted or required under applicable laws.

9. Where We Store Your Personal Data; International Transfers

The Personal Data we collect from you may be stored on secure servers located outside of the country where you live. In addition, when you use the Services, your Inputs are transmitted to the Model Providers you select, which may be located in various countries around the world; their processing of your data is governed by their own terms and privacy policies.

Where required by applicable data protection laws, we will use appropriate safeguards for transferring Personal Data outside of certain countries, such as transfer mechanisms recognized under those laws (for example, for transfers out of the European Economic Area or the UK, adequacy decisions or standard contractual clauses), and we will do so in accordance with the requirements of applicable data protection laws.

10. Personal Data Relating to Children

The Services are not aimed at children, and we do not knowingly process Personal Data from children. As described in the Terms, if you are under 18 years old or the minimum age required in your country, you may use the Services only with the consent of your legal guardian. If we notice or receive feedback that we have collected Personal Data from a child without the consent required by applicable law, we will investigate and, where appropriate, delete the Personal Data to the extent permitted by applicable law. If you believe that we have processed Personal Data about or collected from a child, please contact us at support@mirapi.ai.

11. Privacy Policy Updates

We may update this Privacy Policy from time to time as required by law or to reflect changes to the Services. When we update this Privacy Policy, we will notify you by updating the “Last Updated” date at the top of the new Privacy Policy and posting the new Privacy Policy, or by providing any other notice required by applicable law. For material changes to how we collect, use, or disclose your Personal Data, we will provide advance notice by email or in-product notification. We recommend that you review this Privacy Policy each time you access the Services to stay informed of our privacy practices.

12. Contact Us

Questions, comments, and requests regarding this Privacy Policy should be addressed to support@mirapi.ai.

Benxi HengFeng Network Technology Co., Ltd.

13. Supplemental Clause — Jurisdiction-Specific

13.1 European Economic Area (“EEA”), Switzerland, and UK

If you are using the Services in the EEA, Switzerland, or the UK (the “European Region”), the following additional terms apply.

Legal bases for processing. We use your Personal Data only as permitted by law. Our legal bases for the processing described in this Privacy Policy are as follows:

Purpose of processing	Personal Data categories	Legal bases
To provide, administer, and maintain the Services, including creating accounts, authenticating access, routing requests to Model Providers, metering and billing, and providing user support	Account Personal Data; User Input; Payment and Transaction Personal Data; Personal Data When You Contact Us; Device and Network Personal Data; Usage Metadata; Approximate Location Personal Data; Cookies	Performance of a contract with you; your consent where we ask for it for a specific purpose
To promote the safety, security, and stability of the Services, including preventing and detecting abuse, fraud, and illegal activity	Account Personal Data; User Input; Device and Network Personal Data; Usage Metadata; Approximate Location Personal Data; Cookies	Our legitimate interests in keeping the Services safe and secure; compliance with our legal obligations
To communicate with you, including service notices and responses to your inquiries	Account Personal Data; Personal Data When You Contact Us	Performance of a contract with you; your consent where we ask for it
To comply with our legal obligations, perform tasks in the public interest, or protect the vital interests of our users and other people	All categories described in this Privacy Policy	Compliance with our legal obligations; our legitimate interests in protecting our business, employees, and users

You may choose not to provide some Personal Data, but this may affect the Services you are able to use.

Your rights in the European Region. You have the rights described in “Your Rights” above, including the rights of access, rectification, erasure, restriction, data portability, withdrawal of consent, and objection (including objection to processing based on our legitimate interests and to any direct marketing), the right not to be subject to automated individual decision-making that produces legal or similarly significant effects, and the right to lodge a complaint with your local data protection authority. To exercise these rights, please email support@mirapi.ai; before we can respond, you may be required to verify your identity or your account details.

Data transfers. When your Personal Data is transferred outside of the European Region, we ensure it benefits from adequate legal protection by relying on adequacy decisions where available, or on standard contractual clauses or other transfer mechanisms recognized under applicable data protection laws.

13.2 United States — State Law Disclosures

If you are a resident of a U.S. state with a comprehensive privacy law (such as California), the following additional disclosures apply. As described in this Privacy Policy, we collect the following categories of personal information: identifiers (such as email address, IP address, and device identifiers), commercial information (such as transaction history), internet or other network activity information (such as usage metadata), approximate geolocation data derived from IP address, account credentials, and the content of communications you send to us. We collect these categories from you directly, automatically from your use of the Services, and from the third-party sources described above; we use them for the purposes described in “How We Use Your Personal Data”; and we disclose them to the categories of recipients described in “How We Share Your Personal Data.”

We do not “sell” your personal information and do not “share” your personal information for cross-context behavioral advertising, as those terms are defined under applicable state laws, and we do not use or disclose sensitive personal information for purposes other than those permitted by such laws. You have the rights described in “Your Rights” above, including the rights to know, access, correct, delete, and obtain a portable copy of your personal information, and the right not to be discriminated against for exercising your rights. You may exercise these rights, directly or through an authorized agent, by emailing support@mirapi.ai.

Some browsers transmit “Do Not Track” signals. Because there is currently no common industry standard for responding to such signals, we do not respond to them. As stated above, we do not track users over time and across third-party websites for targeted advertising purposes.