Privacy Policy

Thalam operates an API gateway service. This policy explains what personal data we collect, why we collect it, and what we do with it. If you have questions, email privacy@thalam.ai.

We collect the following information when you use our service:

• Account information — your email address and hashed password when you register
• Usage metadata — for each API request: the model used, number of input and output tokens, estimated cost, timestamp, and which API key was used
• Billing information — your account balance, top-up history, and Stripe payment records (Stripe handles card details directly; we never see your raw card number)
• API keys — we store a hashed version of your keys for authentication; the plaintext key is shown to you once at creation and not stored

We do not log the content of your prompts or the content of model responses. Your requests pass through our infrastructure and are forwarded to the underlying model provider in real time. Once the response is returned to you, we do not retain the payload. What you send to AI models is your business.

We use the data we collect to:

• Calculate and deduct credits from your balance after each request
• Display your usage history in your dashboard
• Detect and prevent abuse, fraud, and policy violations
• Send you transactional emails (account confirmation, billing receipts)
• Improve the service — for example, understanding which models are most used to prioritise infrastructure

We do not sell your data. We do not use your data for advertising.

Running this service requires sharing some data with third-party providers:

• Supabase — hosts our database and authentication system. Your account data and usage logs are stored on Supabase infrastructure.
• Stripe — processes payments. When you top up your balance, your payment flows through Stripe. We receive a confirmation and the amount; Stripe holds your card data under their own privacy policy.
• Novita and model providers (DeepSeek, Alibaba Cloud, Tencent, Kuaishou) — your API request payloads (including prompts) are sent to the relevant provider to generate a response. Each provider has their own data handling terms. We recommend reviewing them if your use case is sensitive.

Our database infrastructure is hosted in the UAE/GCC region. API requests are routed through GCC-region endpoints where available. Some underlying model providers process data on infrastructure located in China. By using this service, you acknowledge and accept this routing.

We retain your account data and usage logs for as long as your account is active. Billing records are kept for seven years to comply with financial record-keeping requirements.

If you delete your account, we delete your profile, API keys, and usage logs within 30 days. Anonymised aggregate statistics (e.g. total requests per model per day) may be retained indefinitely.

You can, at any time:

• Access the data we hold about you via your dashboard
• Delete your account and all associated data by going to your dashboard settings
• Request a copy of your usage data by emailing privacy@thalam.ai
• Ask us to correct inaccurate information

Deleting your account is permanent. Unused credits cannot be recovered after account deletion.

We use industry-standard security practices: HTTPS for all traffic, hashed passwords (bcrypt), hashed API keys, and row-level security on all database tables so that each user can only access their own records.

No system is perfectly secure. If you discover a vulnerability, please report it to privacy@thalam.ai.

We may update this policy. If the changes are significant, we will notify you by email at least 14 days before they take effect. The date at the top of this page always reflects the last update.

Privacy questions or data requests: privacy@thalam.ai

For legal matters, see our Terms of Service.