AI Plaza Privacy Policy

1. Information We Collect and Why

We collect and process personal information as needed to operate accounts, provide AI features, meter fair use, bill subscriptions, prevent abuse and fraud, improve reliability, and comply with law. Categories include:

2. Third-Party AI Model Providers

AI Plaza routes your requests to third-party AI model providers via their APIs or related endpoints. Those providers process prompts, attachments, and related technical metadata to return outputs under their own terms and privacy policies, which may change without notice to you from us.

AI Plaza does not use your prompts or uploads to train its own foundation models. We do not guarantee that every provider, model, region, open-weight endpoint, or aggregator will refrain from training, logging, human review, or retaining content. Review the documentation for the specific model you use before submitting sensitive information. AI Plaza does not sell your personal information.

Your AI Plaza account credentials are not shared with model providers as part of ordinary inference. Limited technical metadata required for the API call, plus the content you choose to send, is shared with the selected provider. Auto routing may select a provider without a separate confirmation step for each message.

3. When We Share Information

We share personal information only as described in this Policy or with your direction:

• AI model providers — to generate chat and tool outputs, as described above
• Stripe (or successor payment processors) — to process subscriptions, invoices, refunds where required by law, and payment method updates
• Clerk (or successor auth providers) — to authenticate users and manage sessions
• Application database and hosting/CDN providers (currently including Supabase and our host/CDN) — to store and serve account, usage, conversation, and abuse-related data
• Organization owners and authorized administrators — to administer Team Enterprise memberships, workspaces, quotas, usage, shared content, and organization billing where applicable
• Cloudflare and similar security vendors — for bot protection such as Turnstile and related edge security
• Email and support vendors — to send transactional messages and support replies
• Professional advisers (legal, accounting) under confidentiality — when needed to operate or defend the business
• Authorities and claimants — when we believe in good faith disclosure is required by law, legal process, or to protect rights, safety, security, or integrity of the Service, users, or the public
• Business transfers — if we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or asset sale, information may transfer as part of that transaction, subject to this Policy or successor protections where reasonably practicable

4. Data Retention

Guest use may involve a short-lived metering cookie (on the order of about one day), a longer-lived guest identifier cookie (which may persist for up to about one year), a device token in local storage, and hashed IP/device signals used for abuse limits (often on a daily cycle). We may retain security, fraud, and ban-related records—including hashed identifiers—longer when needed to protect the Service. Guest chats are not retained as registered account history on our servers.

Registered account data, conversations you save, memory features, billing identifiers, support tickets, and related records are retained while your account is active and thereafter as reasonably needed to provide the Service, enforce limits, prevent abuse, resolve disputes, and meet legal, tax, and accounting obligations. Team Enterprise organization records—including memberships, workspace configuration, shared content, quotas, wallet and subscription records, and security or administrative audit logs—may be retained while the organization uses the Service and thereafter as reasonably needed for the organization, security, compliance, dispute, tax, and accounting purposes. A browser-local History mirror may be stored on your device while you are signed in; we clear that mirror for your account on this browser when you sign out.

When your Clerk account is deleted (for example via Clerk account deletion, or after we process a verified deletion request), we automatically cascade-delete or anonymize personal data we control for that account: conversations and messages, company/brand memory, usage meters tied to your user id, Stripe customer mapping we store, referral attribution and P CASH ledger records tied to your user id, credit ledgers, and identifiable profile fields (email, display name). If the account is a member of a Team Enterprise organization, organization-owned subscriptions, workspaces, shared content, organization billing records, and organization audit records are not necessarily deleted by that individual account deletion; they may remain under the organization’s control, subject to applicable law. We may keep a minimal anonymized profile stub and limited hashed abuse/ban signals so banned actors cannot immediately re-register. Processors (Clerk, Stripe, hosting, Cloudflare, AI Model providers) may retain residual records under their own schedules. Backup systems may take additional time to cycle out deleted data.

You may also email privacy@aiplaza.app from the address associated with your account to request deletion or other privacy rights. After we verify the request (and, where applicable, an authorized agent’s authority), we aim to complete deletion or anonymization of personal data we control within about 30 days, subject to the exceptions above and applicable law. We may deny or limit requests that are unfounded, excessive, fraudulent, or that we cannot verify.

5. Your Privacy Rights

Depending on your location (including the GDPR, UK GDPR, and CCPA/CPRA where applicable), you may have rights to request access, correction, deletion, portability, restriction, or objection to certain processing, and to appeal a denial where required by law. You may also have the right to lodge a complaint with a supervisory authority in your jurisdiction.

To exercise these rights, email privacy@aiplaza.app from the address associated with your account (or provide other information sufficient for verification). If the information is controlled by a Team Enterprise organization, we may direct you to that organization or require the organization’s authorization before providing, changing, or deleting organization-controlled records. We may need to verify your identity (and an authorized agent’s authority) before responding. We will respond within the time required by applicable law—generally within about 45 days under CCPA/CPRA and about one month under GDPR, extendable as permitted by law. To appeal a denial where the law provides an appeal right, reply to our decision email with “Appeal” in the subject line.

We do not provide a consumer “do not sell or share” link because we do not sell or share personal information for cross-context behavioral advertising as described above. California residents may designate an authorized agent as permitted by law. We will not discriminate against you for exercising rights afforded by applicable privacy law.

Where GDPR/UK GDPR applies, our primary legal bases are: performance of a contract (providing the Service you request); legitimate interests (security, abuse prevention, service improvement that does not override your interests); consent where we rely on it (and you may withdraw consent without affecting prior lawful processing); and legal obligation where applicable. You may object to processing based on legitimate interests; we will assess whether we have compelling grounds to continue.

6. Security

We use commercially reasonable administrative, technical, and organizational safeguards appropriate to the nature of the Service, including encryption in transit (HTTPS/TLS), production access controls, organization and workspace authorization checks, abuse monitoring, content-safety filters, and automated cascade deletion/anonymization of account content when a Clerk account is deleted. Conversation APIs are scoped to the signed-in user and workspace permissions where applicable. No method of transmission or storage is completely secure. You are responsible for protecting your account credentials and for what you choose to submit to AI models and organization workspaces. Report suspected security incidents affecting the Service to support@aiplaza.app or privacy@aiplaza.app.

7. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact privacy@aiplaza.app and we will take appropriate steps to delete it as required by law. Parents or guardians who consented to a minor’s use (where permitted by these Terms and local law) remain responsible for that use.

8. International Transfers

We and our processors may process information in the United States and other countries where our vendors and AI providers operate. Those countries may have different data-protection laws than your home country. Where required, we rely on appropriate transfer mechanisms (such as standard contractual clauses) or other lawful bases. In-product “data region” or routing preferences, if offered, are preferences only and are not a contractual guarantee of data residency or exclusive processing in a single country.

9. Automated Processing

We use automated systems for rate limiting, abuse detection, bot challenges, model routing, metering, and content-safety filtering of prompts (including refusals for clear harmful or transactional intent on sensitive topics described in Section 1). These systems may automatically restrict, refuse, or block requests or access when signals indicate abuse, limit exhaustion, or a Terms violation. Soft in-product notices may appear when a related sensitive topic is detected or a request is refused. These systems are not intended to produce legal or similarly significant effects about you solely by automated means without human involvement where such protection is required by law. If you believe you were wrongly blocked, contact support@aiplaza.app.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the “Last updated” date. For material changes, we will provide additional notice when required by law (for example by email or in-product notice) where reasonably practicable. The updated Policy applies from its effective date. If you do not agree, you must stop using the Service and, if applicable, request account deletion.

11. Language; Conflicts

This Privacy Policy may be summarized or translated in the product UI. If there is any conflict between the English version on this page and a translation or summary, the English version prevails. If there is a conflict between this Policy and the Terms of Service on a privacy topic, this Policy controls for that topic.

12. Contact

Controller / operator: WISE INTERNATIONAL LLC, a Wyoming limited liability company, doing business as AI Plaza. Privacy and deletion requests: privacy@aiplaza.app. Legal: legal@aiplaza.app. Product support: support@aiplaza.app. Postal inquiries may be directed to WISE INTERNATIONAL LLC at the registered agent address on file with the Wyoming Secretary of State (request via privacy@aiplaza.app if needed for a formal legal notice).