Privacy policy

1. Scope, controller, and contact

This Policy applies when you visit klystrax.com, create or use a Klystrax account, use Studio, manage API keys or billing, contact support, or send requests through the Klystrax API. It does not cover data stored independently by your IDE, terminal, application, or another third-party service.

Klystrax is the controller of personal data processed for its own account, billing, security, support, and product operations. For privacy questions or requests, email [email protected] or call +234 704 852 3145. Email is preferred for requests that require identity verification or a written response.

2. Personal data we collect

• Account and identity data: name, email address, password hash, public account identifier, email-verification status, account role and status, registration date, and last sign-in time.
• Authentication and security data: bearer-token identifiers and usage times, one-time-code challenge records, password-reset records, IP addresses, user-agent or client details, security events, rate-limit information, and diagnostic logs.
• API-key data: key name, generated identifier, visible prefix, one-way key hash, creation time, last-used time, and revocation status. The complete customer API key is shown only when created.
• AI request and usage data: model, prompts and message history, system instructions, tool definitions and calls, uploaded images or other submitted content, model responses, request and provider IDs, status and error details, timestamps, token counts, latency, IP address, reservation, rates, and cost.
• Studio data: conversation titles, messages, model and reasoning settings, uploaded file names, types, storage paths and URLs, and related usage records.
• Billing data: wallet balance and ledger, payment reference, provider, currency, requested funding, charged amount, processor fee, payment status, provider response data, review records, and refund or dispute status.
• Referral and promotion data: referral code, referring account, referred user's name and registration date, reward status and amount, and evidence used to prevent abuse.
• Support and communications data: emails, phone details you provide, screenshots, attachments, issue descriptions, and our responses.
• Website preference data: theme preference and the customer authentication token stored in your browser's local storage. Google Fonts and hosting or delivery services may also receive ordinary request data such as IP address and browser headers.

3. How we obtain data

We obtain data directly from you when you register, configure a key, submit content, make a payment, or contact support; automatically from your browser, API client, and use of the Service; from a referrer when you register through a referral link; and from payment, model, hosting, email, security, or other providers when they return transaction or service information.

4. API requests, responses, and model providers

Klystrax sends the content needed to fulfill a model request—including prompts, relevant message history, tools, and images—to the configured model gateway or compute provider. Do not submit secrets, special-category personal data, confidential information, or third-party data unless you are authorized to do so and accept the processing required to generate a response.

For request delivery, billing, replay protection, reconciliation, support, and security, the Klystrax backend records API request payloads and usage metadata and may retain the provider response. Response payloads are encrypted at rest in the current implementation; access to request and response records is restricted to authorized operational personnel. Klystrax does not use Customer Content to train its own AI models.

A model or gateway provider processes submitted content on Klystrax's behalf or as otherwise described in its contractual terms. Provider retention and international processing may differ by model route. Do not rely on a zero-retention assumption unless Klystrax expressly confirms it for the specific model and request route in writing.

5. Studio conversations and uploads

Studio is a persistent chat service. It stores user and assistant messages, conversation settings, and uploaded images so you can reopen a conversation. Uploaded files are stored on service storage and are retrieved through generated file URLs when needed for the conversation.

You can delete an individual conversation from Studio. Deletion removes the active conversation record, but uploaded files, security records, provider records, or backup copies may remain for a limited period until routine cleanup, backup rotation, or a legal-retention requirement is complete. Contact [email protected] if a deletion requires follow-up.

6. Payments and financial records

When you select Flutterwave, Klystrax sends the provider your name, email, payment reference, amount, and currency. When you select Cryptomus, payment identifiers and account email may be included in order or callback data. Bank transfers may be reviewed by an authorized administrator using your account and payment reference.

Klystrax does not request that you send complete card details, private wallet keys, or seed phrases to support. A payment provider may collect additional financial or identity data under its own privacy notice. Klystrax retains payment and wallet records needed for settlement, accounting, fraud prevention, refunds, and disputes.

7. Referrals and promotions

A referral code may be read from the registration URL and submitted with your registration. Klystrax records the relationship between the referring and referred accounts to calculate rewards and detect self-referral or other abuse. The referring user may see the referred user's name and registration date, but not the referred user's email, chats, prompts, API keys, payment credentials, or support messages.

8. Local storage, cookies, and fonts

The customer web application stores the Klystrax bearer token and theme preference in browser local storage. The token keeps you signed in and is sent in the Authorization header to the Klystrax API. Signing out removes the local token and revokes the active server token. You can clear local storage through your browser, but doing so signs you out.

Public customer authentication does not currently depend on an advertising cookie. Administrative systems and infrastructure may use strictly necessary session, security, load-balancing, or fraud-prevention cookies. Fonts are requested from Google Fonts, which may receive IP address and browser-request information. Klystrax does not currently use third-party advertising cookies.

9. Why we process data and our legal bases

We process account, request, Studio, payment, and support data to provide the Service and perform our contract with you; authenticate users; deliver model output; maintain chat history; calculate usage and charges; process payments; administer referrals; and respond to support requests.

We process limited technical, security, usage, and transaction data for legitimate interests in protecting accounts, preventing fraud and abuse, debugging failures, reconciling provider charges, improving reliability, enforcing terms, and defending legal claims. We process data when necessary to comply with tax, accounting, consumer-protection, law-enforcement, or other legal obligations. Where applicable law requires consent, we rely on consent and allow it to be withdrawn without affecting prior lawful processing.

10. When we share data

We share only the data reasonably needed for the relevant purpose with categories of recipients such as model gateways and compute providers; hosting, storage, content-delivery, traffic-protection, and monitoring services; email-delivery services; Google Fonts; payment providers including Flutterwave and Cryptomus; banking partners for transfers; professional advisers; and public authorities when legally required.

Service providers are expected to process data under appropriate instructions, confidentiality, and security obligations. We may also transfer data in a merger, financing, reorganization, or sale of the Service, subject to confidentiality and applicable notice requirements. We do not sell personal data or share it for cross-context behavioral advertising.

11. International transfers

Klystrax and its providers may process data in countries other than yours. Where data-protection law requires it, we use an available lawful transfer mechanism and appropriate safeguards, such as contractual protections, and assess provider security and confidentiality. You may request information about applicable safeguards at [email protected].

12. Retention

We keep personal data only as long as reasonably needed for the purposes described above, considering account activity, the sensitivity of the data, security and fraud risk, dispute periods, provider reconciliation, and legal accounting or reporting requirements.

• Account and authentication records are generally retained while the account is active and for a limited period after closure where needed for security, disputes, or legal compliance.
• One-time codes and reset authorizations expire after their short validity period, although limited challenge and security records may remain to prevent abuse.
• Studio conversations remain until you delete them or close the account, subject to temporary file, log, and backup retention.
• API request, response, usage, IP, and error records are retained for billing, reconciliation, support, security, and audit needs, then deleted or de-identified under Klystrax's retention schedule.
• Payment, wallet, refund, and referral records may be retained for the legally required accounting period and while a charge, claim, or investigation remains open.
• Support records are retained for follow-up, quality, security, and dispute handling, then deleted when no longer needed.

13. Security

Klystrax uses administrative, technical, and organizational measures designed for the nature and risk of the data, including access controls, hashed passwords and customer API keys, encryption for selected sensitive records, credential revocation, monitoring, rate limits, and secure transport. No online system is completely secure, so you should use a unique password, protect API keys, keep client software updated, and avoid submitting unnecessary sensitive data.

If a personal-data incident creates a notification obligation, Klystrax will notify affected users and the appropriate authority as required by applicable law.

14. Your privacy rights

Depending on where you live, you may have rights to be informed; request access to or a copy of your data; correct inaccurate data; request deletion or restriction; object to certain processing; receive portable data; withdraw consent; and ask for human review of qualifying automated decisions. You may also complain to the Nigeria Data Protection Commission or another competent supervisory authority.

Send a request to [email protected] with your account email and the right you want to exercise. We may request proportionate information to verify your identity and protect the account. We will respond within the period required by applicable law. Some requests may be limited where retention or processing is required for payment records, security, legal claims, or another lawful exception.

15. Children

The Service is not directed to children or anyone under 18. Klystrax does not knowingly create accounts for children. If you believe a child has provided personal data, contact [email protected] so we can investigate and take appropriate action.

16. Automated processing

Automated systems authorize requests, estimate and settle usage charges, apply rate limits, detect suspicious activity, and may temporarily restrict activity. These controls are used to deliver and secure the Service. Contact support to request human review of a restriction or billing outcome that materially affects you.

17. Policy changes

We may update this Policy when the Service, providers, law, or data practices change. The current version and last-updated date will remain on this page. We will provide additional notice of material changes when required and will request consent if a new use legally requires it.

18. Contact and complaints

Email privacy questions, rights requests, or complaints to [email protected]. You may also call +234 704 852 3145, but email is preferred for identity verification and a written record. Never send your password, full API key, one-time code, seed phrase, private wallet key, or complete payment-card details.