Privacy

SilvaMux Privacy Policy

Introduction

Welcome to the SilvaMux International Platform.

SilvaMux International Platform (hereinafter referred to as "we", "us", or "our") values your privacy and the protection of your Personal Information. This Privacy Policy explains how we collect, use, store, share, transfer, protect, and delete your Personal Information when you visit the website, register an account, log in to the console, create an organization, use APIs, purchase or consume balances, contact us, or otherwise use the Platform, and how you may exercise relevant rights.

Please carefully read and fully understand this Policy before registering, logging in, or using the Platform. If you do not agree to this Policy, please do not register for or use the Platform. Your continued use of the Platform indicates that you understand and agree that we will process your Personal Information in accordance with this Policy.

If you are an individual using the Platform on behalf of a company, organization, or other legal entity, you shall ensure that such entity and its authorized users understand this Policy, and shall ensure that you have obtained the lawful basis, authorizations, notices, and consents necessary to submit Personal Information, customer data, Interaction Data, and other materials to the Platform. If you or the enterprise you represent provides services to your own customers or end users through the Platform, you shall also formulate and fulfill your own privacy, data protection, and AI use notice obligations according to the actual business scenario and applicable law.

For purposes of this Policy, "Personal Information" processed by us refers to Personal Information of enterprise users and their authorized representatives. Sensitive Personal Information under this Policy mainly involves Personal Information provided by user authorized representatives in necessary business scenarios such as identity verification and payment settlement.

The Platform is an AI model aggregation and developer API service platform that integrates capabilities of Third-Party Model Service Providers. When you choose to use a specific third-party model service, that third party may process your Interaction Data during model inference as an independent controller, independent personal information processor, entrusted processor, sub-processor, or other legal role. Such processing activities may be subject to that third party's own terms of service, privacy policy, and data processing rules.

Special Notice: Interaction Data

Prompts, messages, code, images, audio, videos, files, parameters, materials, task results, and other content that you input, upload, process, generate, store, distribute, or download through the Platform or APIs constitute business data of you or the entity you represent (hereinafter referred to as "Interaction Data").

You shall ensure that the source of Interaction Data is lawful and that you have obtained the rights, authorizations, licenses, or consents necessary to process the relevant information. Please do not submit Personal Information, Sensitive Personal Information, information of minors, trade secrets, confidential data, payment card information, passwords, keys, health information, export-controlled information, or other high-risk data that is prohibited by law, that you are not authorized to provide, or that is unrelated to the purpose of use. Your Interaction Data shall also not contain any state secret, work secret, or other sensitive information as determined by a government authority, and shall not infringe any third party's confidentiality rights. If Interaction Data involves minors, Sensitive Personal Information, or regulated data, you have lawfully obtained valid authorization or consent and have taken necessary protective measures.

Your Interaction Data shall not contain any of the following: nudity, obscenity, pornography, or sexually suggestive content; hate speech, threats, insults, or direct attacks against individuals or groups; harassment, infringement, defamation, vulgar content, or content infringing others' privacy; discriminatory content based on gender, race, ethnicity, region, religion, or similar grounds; content promoting self-harm, suicide, or excessive violence; impersonation, identity falsification, or content misleading others about your identity; illegal content or content facilitating or inciting illegal activities; malicious programs, viruses, trojans, or other harmful code; content containing personal sensitive information without the individual's consent; spam, machine-generated bulk content, or other unsolicited harassing information; or other content that violates laws or regulations or is contrary to public order and good morals.

If Interaction Data violates laws or regulations, third-party terms, or these Terms, we reserve the right to delete such Interaction Data, or suspend or terminate the relevant technical services provided to you, without prior notice.

We will process Interaction Data only to complete requests initiated by you, provide technical support, troubleshoot issues, ensure security, complete billing, handle complaints, or fulfill legal obligations. Unless you expressly opt in, or the parties otherwise agree in writing, we will not use your API Interaction Data to train or improve our own models.

When you call third-party model services, in addition to the Interaction Data submitted by you, we may transmit to backend Model Service Providers request time, token usage, model version, task identifier, request parameters, necessary call metadata, and other information required to complete inference, task processing, result return, billing, or troubleshooting. The data processing location, retention period, training policy, and processing role of each specific Third-Party Model Service Provider shall be subject to that provider's published rules, agreements between the parties, and the actual technical solution.

For conversational requests, complete inputs and outputs are in principle not stored long-term as routine business data. Request parameters, input files, generated results, and task status required for asynchronous tasks may be retained for the period necessary for task execution and result retrieval. If the Platform provides Zero Data Retention, log disabling, content saving, team sharing, prompt history, task result retention, or similar settings, the actual processing method shall be subject to the corresponding function descriptions and your configuration.

1. Scope of Application

This Policy applies to Personal Information processed by us through the following channels:

SilvaMux website, console, login/registration, model marketplace, developer documentation, online forms, and public pages.
SilvaMux APIs, model gateway, SDKs, projects, API Keys, billing, organization and member management functions.
Customer support, sales communications, legal communications, security incident handling, events, surveys, feedback, or other interactions.
Information processed by us to provide, protect, bill, maintain, and improve the Platform.

This Policy does not apply to websites, products, models, plug-ins, payment pages, open-source projects, cloud services, integrations, or other services independently provided by third parties. Third-party services are independently operated by the relevant third parties, and their privacy and security practices are not governed by this Policy. Before using any specific third-party service, model, or supplier, you should read its privacy policy and terms of service.

Where enterprise customers process their end-user data through the Platform, unless otherwise agreed in writing by the parties, the enterprise customer is usually the controller, business party, or party that determines the purposes and means of processing the relevant Personal Information, and we provide services according to the customer's instructions. Enterprise customers shall be responsible for providing necessary privacy notices, AI use notices, and data processing explanations to their end users, and for obtaining necessary authorizations or consents.

2. How We Collect and Use User Personal Information

2.1 Registration, Login, and Account Security

To help you complete account registration and login, we may process the following information according to the method you choose:

When you register or log in using an enterprise email address, we need to process your enterprise email address, password verification information, email verification code, verification link result, password recovery record, and necessary security logs.
When you use single sign-on, an enterprise identity provider, third-party login, or other login methods made available later, we may process account identifiers, email addresses, nicknames, avatars, authorization status, organization information, and information necessary for login returned by the third party.
When you choose to stay logged in, remember a device, or use similar functions, we will store necessary session status on your device to reduce repeated logins. You may clear such information through browser settings.
To record your choices regarding Terms of Service, Privacy Policy, Cookie settings, data processing settings, or other compliance notices, we may store user identifiers, agreement names and versions, consent time, consent scenario, device, browser, and network information.

To protect account security, we may conduct risk assessments based on email address, IP address, basic device or browser information, verification code sending frequency, verification failure count, login location, abnormal behavior, and API call activity, and may take measures such as graphical verification, human verification, frequency limits, secondary verification, temporary refusal of requests, or credential freezing.

2.2 Accounts, Organizations, Permissions, and Credentials

When an account or organization is first created, we may process the email address, name, organization name, company name, position, country or region, billing contact, tax information, enterprise information, and other necessary information of you or your authorized representative, for purposes of account creation, account type differentiation, enterprise service support, permission management, billing, tax, invoices, compliance review, or customer support.

In the console, we may display the email address, role, permissions, organization member information, projects, API Key names, binding status, billing, and security status of you or your authorized representative. When you add or change login credentials, member permissions, organization settings, or API Keys, we will process the corresponding verification information and security operation records.

We may process API Key names, credential summaries or encrypted information, creation time, last use time, permission scope, call source, affiliated organization, affiliated project, and disabled status, for purposes of verifying access credentials, permission control, usage attribution, security audits, and abnormality troubleshooting. Complete API Keys are usually displayed to you only at creation. Please properly safeguard them and promptly disable leaked keys.

2.3 Balance, Payment, Billing, Bills, and Taxes

When you use balance top-up, purchase credits, subscriptions, post-paid services, or other paid services, we need to process order numbers, product or service types, transaction time, payment amount, currency, taxes, payment status, refund status, chargeback status, billing contact, tax information, invoice or receipt information, and necessary transaction result information returned by payment service providers, for purposes of completing transactions, crediting balances, reconciliation, refunds, fee calculation, tax processing, dispute handling, and financial audits.

Payment-sensitive information such as payment card numbers, payment account passwords, and bank account information is usually independently processed by Stripe, PayPal, banks, or other third-party payment service providers on their pages or systems. Unless otherwise stated, the Platform in principle does not directly store complete payment card numbers or payment account passwords. If you do not provide information necessary to complete a transaction, you will be unable to use the corresponding paid services.

2.4 AI Models and API Services

When you call models or use task services involving images, audio, videos, files, or similar materials, we may process the model and supplier selected by you, request time, token usage, call duration, response status, error codes, task identifiers, request IDs, upstream request IDs, IP address, project, organization, API Key identifier, and other necessary call logs to complete model inference, task scheduling, result return, token billing, troubleshooting, and system security.

For Interaction Data submitted by you through APIs or pages, we process it only as an underlying computing and technical platform within the scope necessary to complete the current request and generate or retrieve task results. For conversational requests, complete inputs and outputs are in principle not stored long-term as routine business data. Task-based services may store necessary input files, parameters, and generated results during task execution and result retrieval. Specific retention periods, optional data regions, and third-party model processing methods shall be subject to rules published at launch, developer documentation, model pages, console settings, or written agreements between the parties.

If you use APIs to provide services to end users, you shall ensure that the source of Interaction Data is lawful and fulfill notice, consent, opt-out, or other compliance obligations to end users in accordance with law.

2.5 Platform Security, Risk Control, and Logs

To ensure normal Platform operation and network security, and to prevent attacks, fraud, bulk registration, credential abuse, malicious requests, and illegal or non-compliant use, we may process IP addresses, access times, request paths, device or browser types, system versions, login and operation records, API call frequency, concurrency, abnormal requests, error logs, security incident records, verification code results, rate-limit records, and audit logs.

2.6 Inquiries, Complaints, Sales, and Necessary Notices

When you communicate with us through "Contact Us", email, tickets, meetings, sales channels, or other methods, we may process the name, email address, telephone number, company, position, country or region, issue description, communication records, and attachments voluntarily submitted by you or your authorized representative, for purposes of responding to inquiries, handling complaints, verifying rights requests, providing technical support, conducting legal communications, or following up on sales.

We may use your bound email address, organization contact, or billing contact to send verification codes, security reminders, bills, service changes, price changes, maintenance notices, agreement updates, and other necessary notices. Without your separate consent or another basis permitted by applicable law, we will not send commercial marketing information unrelated to the services solely because you registered an account. You may unsubscribe from non-essential marketing information through the methods provided in emails or the console.

2.7 Circumstances Where Separate Consent Is Not Required

In accordance with applicable law, where necessary for entering into or performing a contract to which you are a party, necessary for fulfilling legal obligations, necessary to respond to emergencies to protect the life, health, and property safety of natural persons, within a reasonable scope to process information you have publicly disclosed or other information lawfully made public, necessary to protect network security and service security, necessary to handle disputes, or in other circumstances provided by applicable law, we may lawfully process necessary information without separately obtaining consent.

If we intend to use Personal Information for purposes not described in this Policy, or change the original processing purpose, we will provide separate notice in accordance with law and obtain your consent or rely on another lawful basis where necessary.

3. Cookies and Similar Technologies

When you use the Platform, we may use Cookies, localStorage, sessionStorage, pixel tags, logs, or similar technologies to store login sessions, maintain login status, interface and language preferences, agreement versions consented to on the device, Cookie settings, anti-CSRF identifiers, security random identifiers, website analytics identifiers, and performance monitoring information.

Necessary Cookies are indispensable for login, security, and basic functions. Non-essential analytics or marketing Cookies will be subject to choices or opt-out methods according to applicable law. You may clear or block relevant data through browser settings. After clearing, you may need to log in again, reconfirm agreements, restore page settings, or may be unable to use certain functions normally.

If a future function needs to access camera, microphone, files, clipboard, notifications, or other device permissions, we will separately explain and request authorization before access, unless otherwise provided by law.

4. How We Entrust Processing, Share, Transfer, and Publicly Disclose User Personal Information

We do not sell Users' Personal Information. We use your Personal Information only in accordance with this Policy and our agreements with customers. Except where we have obtained your consent, perform a contract, fulfill legal obligations, provide services actively selected by you, protect Platform security, or in other circumstances permitted by applicable law, we in principle will not share your Personal Information with other companies, organizations, or individuals.

4.1 Entrusted Processing and Service Providers

To provide email, verification code, human verification, cloud computing, storage, security protection, logging, monitoring, customer support, payment, tax, analytics, and operations and maintenance services, we may entrust partners to process necessary Personal Information. We will agree with entrusted parties on processing purposes, periods, methods, information types, protective measures, and responsibilities of both parties in accordance with applicable law, and will reasonably supervise their processing activities.

4.2 Categories of Third-Party Services

To implement functions such as login verification, identity authentication, payment settlement, model calls, and Platform security protection, we may provide the minimum necessary information to the following categories of third parties, or entrust them to process necessary information. Specific third-party names, contact information, processing roles, processing locations, and privacy policy links shall be subject to third-party lists, console descriptions, model pages, orders, or data processing agreements at launch.

Email service providers: used to send email verification codes, verification links, password recovery emails, bills, and necessary service notices. This may involve email addresses, email subjects and content, sending time, sending status, and necessary logs.
Verification code, human verification, and anti-fraud service providers: used to identify machine operations, bulk registration, malicious requests, credential abuse, and abnormal risks. This may involve verification parameters, verification results, IP addresses, device or browser information, operation time, and necessary risk identification information.
Payment service providers: used to complete top-ups, payments, refunds, transaction status inquiries, chargeback handling, and reconciliation. This may involve Platform order numbers, transaction amounts, descriptions of goods or services, payment status, refund information, and information necessary to complete payment.
Cloud service providers, object storage, CDN, database, queue, logging, and monitoring service providers: used to host the Platform, store files, transmit content, process tasks, and ensure availability and security. This may involve account information, call metadata, task files, logs, error information, and necessary operational data.
Model Service Providers and AI technology service providers: used to complete model inference, image, audio, video, multimodal task processing, status inquiry, and result return that you actively select or that is routed by the Platform. This may involve prompts, messages, images, audio, videos, files, model parameters, task identifiers, request time, generated results, token usage, and necessary call information.
Customer support, CRM, sales, and collaboration tool service providers: used to respond to inquiries, handle tickets, conduct sales communications, and provide customer success services. This may involve contacts, companies, positions, communication records, issue descriptions, and attachments.
Analytics and performance monitoring service providers: used to understand website use, troubleshoot errors, improve product experience, and plan capacity. This may involve page visits, clicks, device information, browser information, approximate geographic location, error logs, and de-identified statistical information.
Legal, tax, audit, and professional advisers: used for contracts, disputes, compliance, tax, audit, and corporate transactions. This may involve account, order, bill, transaction, organization, and communication information.

For third-party personal information processors or controllers that independently determine processing purposes and methods, we will, where required by applicable law, inform you of their names, contact information, processing purposes, processing methods, and categories of Personal Information, and obtain necessary consent or rely on another lawful basis. Personal Information processing activities of third-party payment, model, login, cloud, or other services independently provided by third parties are also governed by such third parties' own privacy policies or related rules.

You may choose not to use functions that require provision of Personal Information to third parties, and you may withdraw consent-based authorization through methods provided by the Platform. Withdrawal of consent does not affect processing activities conducted before withdrawal based on your consent. For information necessary to provide corresponding functions, if you refuse to provide it or withdraw authorization, we may be unable to continue providing the corresponding functions to you, but this will not affect your use of other services that do not rely on such information.

4.3 Organization Administrators and Members

If you are an authorized representative of an organization, organization administrators may view or manage information related to the organization's use, including member email addresses, roles, projects, API Key names, usage, bills, balances, audit records, task records, and other content accessible under organization settings. Organization administrators shall grant access only to verified enterprise members.

4.4 Sharing or Integration Functions Enabled by You

If you actively share outputs, public links, model configurations, projects, applications, logs, feedback, or connect third-party integrations, relevant information may be accessed, copied, saved, or further shared by recipients. Please use public sharing functions with caution.

4.5 Transfer

In principle, we will not transfer your Personal Information. If transfer is required due to merger, division, reorganization, financing, asset transfer, bankruptcy, or similar transactions, we will inform you in accordance with law of the recipient's name and contact information and require the recipient to continue fulfilling Personal Information protection obligations. If the processing purpose or method changes, we will obtain your consent again or rely on another lawful basis in accordance with law.

4.6 Public Disclosure

In principle, we will not publicly disclose your Personal Information. Where public disclosure is necessary, we will explain the purpose, information type, and possible impact to you, and obtain consent or rely on another lawful basis in accordance with law, unless otherwise provided by laws and regulations.

4.7 Legal, Compliance, and Security Disclosures

We may disclose information in the following circumstances: to comply with laws and regulations, court orders, arbitration, regulatory requirements, or law enforcement requests; to enforce Terms of Service; to protect the rights, property, and safety of us, Users, partners, or the public; or to investigate fraud, abuse, security incidents, illegal conduct, or violations of third-party rights.

5. Cross-Border Transfers and Storage Regions

SilvaMux provides services to international Users. Your information may be accessed, processed, stored, or transferred in countries or regions outside your country or region, including locations where we, our affiliates, suppliers, Model Service Providers, cloud service providers, or support teams are located.

We will take reasonable measures to protect information transferred across borders in accordance with applicable law, including signing data processing agreements or standard contractual clauses, adopting encryption and access controls, limiting processing purposes, and obtaining your consent or relying on other lawful transfer mechanisms where necessary.

Specific default storage regions, optional data regions, cross-border transfer mechanisms, third-party model processing locations, and enterprise customer data processing arrangements shall be subject to console descriptions, model pages, orders, data processing agreements, or written agreements between the parties at launch. If you have specific requirements regarding data regions, supplier regions, or cross-border transfers, please confirm whether Platform configurations and contractual arrangements meet those requirements before using the relevant models or services.

6. Storage and Retention of Personal Information

We retain your information only for the shortest period necessary to achieve the processing purposes, unless a longer retention period is required or permitted by law. Retention periods may vary for different types of information:

Account, organization, permission, order, tax, and billing information is usually retained during the existence of the account or organization, and retained for necessary periods after account closure for compliance, audit, tax, dispute, and security purposes.
API call metadata, usage, fees, errors, rate limits, security logs, and audit logs will be retained for the period necessary to provide services, troubleshoot issues, conduct risk control, protect network security, and comply with legal requirements.
Complete inputs and outputs submitted through conversational APIs are in principle not stored long-term as routine business data, unless you enable relevant functions, the task type requires storage, you submit them for customer support troubleshooting, security or compliance needs arise, or the parties otherwise agree.
Images, audio, videos, files, asynchronous task results, and materials will be retained according to task execution, result retrieval, account settings, storage policies, developer documentation, or order agreements.
Network operation and security logs will be stored in accordance with applicable legal requirements.
Information in backup systems may not be deleted immediately. We will isolate it and delete or anonymize it when backups are updated, rotated, or expire.
We retain your information only for the shortest period necessary to achieve the processing purposes. Except for the specific circumstances set forth in this section or as otherwise required by laws and regulations, the routine retention period for each category of data is six (6) months, after which we will delete or anonymize the data in accordance with law.

When the retention purpose no longer exists or the retention period expires, we will delete, anonymize, or take other reasonable measures with respect to the relevant information, unless otherwise required by law. After account cancellation, we will stop providing account services and delete or anonymize information no longer needed in accordance with law, except for transaction, tax, billing, network log, security, and dispute handling records that must be retained by law.

7. How We Protect User Personal Information

We will adopt technical and managerial measures appropriate to the business and risks to protect User Personal Information, including encrypted transmission, secure password storage, credential masking, access controls, least privilege, security audits, risk monitoring, rate limiting, backups, supplier management, and emergency response.

The Internet environment is not absolutely secure. Please properly safeguard passwords, verification codes, login devices, API Keys, Access Keys, Secret Keys, and other access credentials. Do not provide them to others through untrusted channels, and do not submit unnecessary sensitive information in requests. If you discover a security vulnerability, credential leakage, or abnormal call activity, please immediately revoke the relevant credentials and contact us.

If a User Personal Information leakage, tampering, loss, or similar security incident occurs or may occur, we will promptly take remedial measures and notify you and relevant competent authorities in accordance with applicable law. Where individual notice is difficult, we may issue notices through announcements or other reasonable methods.

The security measures in this Policy apply only to the Platform. When you leave the Platform and use third-party websites, applications, or services, you should also pay attention to the corresponding third party's privacy and security rules.

8. Your Rights and Responsibilities

You have the right to manage organization settings, member permissions, API Keys, and billing information under your account through the console. If you have questions about processing of submitted data, you should contact us through your enterprise administrator or the contact method specified in this Policy.
If your end users submit rights requests regarding data processing, including access, correction, deletion, restriction of processing, or similar requests, you as the data controller shall independently respond to and handle such requests. Upon receiving your written instructions, we will provide reasonable assistance to the extent permitted by applicable law.
Your authorized representatives, including without limitation administrators, developers, and finance contacts, have the right to exercise data subject rights granted by applicable law with respect to their own Personal Information processed by the Platform, including access, correction, deletion, restriction of processing, or obtaining copies. To exercise the foregoing rights, please submit a request to us through the contact method specified in this Policy. To protect enterprise account and data security, we may require you to verify your identity and enterprise authorization.

Please note that the data subject rights of authorized representatives are limited to their personal identity information, such as name, work email address, and work telephone number, and do not involve Interaction Data, business data, or API call data submitted by the enterprise. If you need to operate on Interaction Data or business data, you should do so through enterprise account management permissions or contact the enterprise administrator.

If you wish to cancel your account, you must first complete all outstanding matters within the organization, including clearing balances, settling invoices, and removing members, and independently back up data that needs to be retained before cancellation. After cancellation, we will delete or anonymize Personal Information no longer required to be retained in accordance with law.
For requests to delete or export data, if such data must be retained by law or agreement, such as transaction records, tax records, or security logs, we will retain it in accordance with law.

If you have previously given authorization or consent for a specific Personal Information processing activity, you have the right to submit a withdrawal request to us at any time through the "Contact Us" entry specified in this Policy. Upon receiving your withdrawal request, we will immediately stop the relevant processing activities based on that consent and delete or anonymize the corresponding Personal Information already collected, unless otherwise required by laws and regulations.

Please note that withdrawal of consent does not affect the lawfulness of processing conducted before withdrawal based on your consent. After consent is withdrawn, if the corresponding information is necessary to provide a certain service, you may be unable to continue using functions that depend on such consent, but this will not affect your use of other services that do not depend on such consent.

9. Eligibility

The Platform is intended only for enterprise Users. You undertake that all personnel authorized by you to use the Platform are at least 18 years old and have full civil capacity. If we discover that any person who does not meet the foregoing conditions uses the Platform, we reserve the right to immediately stop providing services and process the relevant account and information in accordance with law.

10. Policy Updates

We may update this Policy due to changes in laws and regulations, Platform functions, Personal Information processing activities, suppliers, data regions, or business models. Without your express consent or another basis permitted by applicable law, we will not unreasonably reduce the rights you enjoy under law through updates to this Policy.

For material changes to processing purposes, processing methods, categories of Personal Information, major sharing recipients, cross-border transfer arrangements, or methods for exercising your rights, we will explain them to you through page notices, pop-ups, console notices, emails, or other prominent methods, and will obtain consent again where required by law. Each version will indicate the update and effective date.

If you do not agree to the updates, you should stop using the Platform. Your continued use of the Platform after the updates take effect indicates that you understand the updated Policy.

11. Contact Us

If you have any questions, comments, or complaints regarding this Policy, Personal Information processing, data security, or rights requests, please contact us through the "Contact Us" entry on the Platform website.

To process your request, we may need to verify your identity, account, organization permissions, or request content. Please do not send unnecessary sensitive information, passwords, or complete API Keys in emails.