The short version: we never log or store your prompts or completions. We collect the minimum needed to run an API business — your account, your billing, and metering metadata.
| data | kept? | why |
|---|---|---|
| Email, account credentials | yes | your account and login |
| Token counts, model, timestamps, key id | yes | billing and capacity planning |
| Payment transactions | yes, via Stripe | top-ups, invoices, tax records |
| Prompt and completion content | never | — |
| IP addresses (ephemeral) | rate-limit window only | abuse prevention, not retained |
Card numbers never touch our servers — Stripe collects and processes all card data under its own PCI-DSS compliance.
We are an Australian company. Some service providers we use (Stripe for payments, cloud hosting, email delivery) process data in other countries, including the United States and Singapore. Where your API traffic is routed across upstream compute providers, prompt content transits encrypted connections and is not retained by us. By using the Service you consent to these transfers; we take reasonable steps to ensure recipients handle data consistently with this policy.
TLS everywhere, encrypted storage, least-privilege access, no content logs to leak in the first place. If a data breach is likely to result in serious harm, we notify affected users and the OAIC as required by the Notifiable Data Breaches scheme.
The Service is not directed at anyone under 18, and we do not knowingly collect their data.
We post updates here and email you before material changes take effect.
Wallaby Data Pty Ltd (trading as Wallaby Token) · privacy contact: support@wallabytoken.com