1. Information We Collect
1.1 Information You Provide Directly
- Account Information. When you register for an Account, we collect your name, email address, and authentication credentials (including third-party login information such as Google or GitHub accounts).
- Billing Information. When you purchase credits or subscribe to a paid plan, our third-party payment processors collect your payment card details directly. We do not receive or store full card numbers; we only receive limited billing and transaction information (such as the last four digits of your card, billing address, transaction amounts, and payment status) from our payment processors.
- Communications. When you contact our support team, submit feedback, or otherwise communicate with us, we collect the content of your messages, your contact details, and any attachments you provide.
- Enterprise Information. For enterprise customers, we may collect company name, job title, business contact details, and information provided in order forms or service agreements.
1.2 Information Collected Automatically
When you access or use the Service, we automatically collect certain information, including:
- Usage Data. API request logs, token usage, model selection, latency metrics, error rates, and response status codes. This data is essential for billing, observability features, and service optimization.
- Device and Connection Information. IP address, browser type and version, operating system, device identifiers, and general geographic location derived from IP address.
- Website Analytics. Pages visited, time spent on pages, clickstream data, referral URLs, and interaction patterns when you visit our website.
- Log Data. Server logs that record requests made to our Service, including timestamps, request metadata, and system performance data.
1.3 Information from Third Parties
- Authentication Providers. If you sign in using a third-party service (e.g., Google, GitHub), we receive basic profile information (such as name, email, and profile picture) as permitted by your account settings with that provider.
- Payment Processors. We receive transaction confirmations, payment status, and limited billing details from our payment processors.
- Analytics Services. We may receive aggregated analytics data from third-party analytics providers that help us understand usage patterns and improve the Service.
2. How We Use Your Information
We use the information we collect for the following purposes:
| Purpose | Legal Basis (GDPR) |
|---|---|
| Provide, operate, and maintain the Service | Performance of contract |
| Process transactions, bill accurately, and send invoices | Performance of contract |
| Monitor API usage, enforce rate limits, and prevent abuse | Legitimate interest |
| Detect and prevent fraud, security incidents, and unauthorized access | Legitimate interest |
| Send technical notices, security alerts, and service updates | Performance of contract |
| Respond to support requests and communicate with you | Performance of contract / Legitimate interest |
| Analyze usage trends and improve the Service | Legitimate interest |
| Debug and troubleshoot technical issues | Legitimate interest |
| Comply with legal obligations and enforce our Terms of Service | Legal obligation / Legitimate interest |
| Send marketing communications (only with your consent) | Consent |
We will not use your Customer Data (prompts and outputs routed through the Service) to train our own AI models unless you have provided explicit consent.
3. Data Processing with AI Model Providers
3.1 How Routing Works
ModelMax functions as an API gateway that routes your requests to third-party AI Model Providers (such as OpenAI, Anthropic, Google, and others). When you submit a request through our Service, your prompt data is transmitted to the selected Model Provider for processing.
3.2 Our Commitment
- Where available and enabled, we configure our integrations with Model Providers to minimize the retention of your data by those providers.
- We do not sell your Customer Data to any third party.
- We may retain request metadata and limited Content as reasonably necessary for billing, abuse prevention, security monitoring, debugging, and legal compliance, as described in our Terms of Service.
3.3 Model Provider Policies
Each Model Provider has its own privacy policy and data handling practices. We encourage you to review the privacy policies of the Model Providers you access through our Service. We are not responsible for the data practices of third-party Model Providers.
6. Data Retention
6.1 We retain your personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, including:
| Data Type | Retention Period |
|---|---|
| Account information | Duration of your Account plus a reasonable period after deletion |
| Billing and transaction records | As required by applicable tax and financial regulations |
| API usage logs and metadata | A limited period for operational purposes, unless longer retention is required for billing disputes or legal compliance |
| Support communications | A reasonable period after resolution |
| Website analytics data | A reasonable period (aggregated) |
6.2 After the applicable retention period, we will securely delete or anonymize your personal information. Backup copies may be retained for a limited additional period for data recovery purposes.
6.3 We may retain certain information for longer periods where required by law, regulation, or to protect our legal rights (e.g., in connection with ongoing litigation or regulatory investigations).
7. Data Security
7.1 We implement appropriate technical and organizational security measures designed to protect your personal information against accidental or unlawful destruction, loss, alteration, and unauthorized disclosure or access. These measures include:
- Encryption of data in transit (TLS/SSL);
- Access controls and authentication mechanisms;
- Regular security assessments and monitoring;
- Employee access restrictions on a need-to-know basis.
7.2 While we strive to protect your personal information, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee the absolute security of your information, and you transmit data at your own risk.
7.3 If we become aware of a security breach that affects your personal information, we will notify you and any applicable regulatory authority in accordance with applicable law.
8. International Data Transfers
8.1 Your information may be processed and stored in jurisdictions outside of your country of residence, including Hong Kong, the United States, and other countries where our service providers and Model Providers operate.
8.2 Where we transfer personal information outside of jurisdictions with data protection laws (such as the European Economic Area or the United Kingdom), we ensure that appropriate safeguards are in place, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission;
- Data processing agreements with our service providers;
- Other legally recognized transfer mechanisms.
8.3 By using the Service, you understand that your information may be transferred to and processed in jurisdictions that may have different data protection standards than your own. We will ensure that any such transfer is carried out in accordance with applicable data protection laws and with appropriate safeguards in place.
9. Your Privacy Rights
Depending on your location, you may have the following rights regarding your personal information:
9.1 Rights Under GDPR (EEA / UK Residents)
- Right of Access. Request a copy of the personal information we hold about you.
- Right to Rectification. Request correction of inaccurate or incomplete personal information.
- Right to Erasure. Request deletion of your personal information, subject to legal retention requirements.
- Right to Restrict Processing. Request that we limit our processing of your personal information in certain circumstances.
- Right to Data Portability. Request a machine-readable copy of your personal information.
- Right to Object. Object to processing based on our legitimate interests.
- Right to Withdraw Consent. Where processing is based on consent, you may withdraw consent at any time.
9.2 Rights Under PDPO (Hong Kong Residents)
Under the Personal Data (Privacy) Ordinance (Cap. 486), you have the right to:
- Request access to your personal data;
- Request correction of your personal data;
- Request that we cease using your personal data for direct marketing.
9.3 Rights Under Other Jurisdictions
Residents of certain other jurisdictions (including California under the CCPA/CPRA) may have additional rights. We will comply with applicable local data protection laws.
9.4 How to Exercise Your Rights
You may exercise your rights by:
- Accessing your account dashboard settings;
- Contacting us at support@modelmax.io;
- Specifying the right you wish to exercise and providing sufficient information for us to verify your identity.
We will respond to valid requests within the timeframes required by applicable law (typically within 30 days, or 40 days under the PDPO). We may charge a reasonable fee for requests that are manifestly unfounded, repetitive, or excessive.
10. Children's Privacy
10.1 The Service is designed for business professionals and is not directed at children under the age of 16 (or the applicable age of consent in your jurisdiction).
10.2 We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal information from a child, we will take reasonable steps to delete such information promptly.
10.3 If you believe that a child has provided us with personal information, please contact us at support@modelmax.io so that we can take appropriate action.
11. Third-Party Links and Services
11.1 The Service and our website may contain links to third-party websites, services, or applications that are not operated by us. This Privacy Policy does not apply to those third-party services.
11.2 We are not responsible for the privacy practices of third-party services. We encourage you to review the privacy policies of any third-party services you access through or in connection with our Service.
12. Changes to This Privacy Policy
12.1 We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational reasons. We will post the updated Privacy Policy on our website and update the "Last Updated" date at the top of this page.
12.2 For material changes, we will make reasonable efforts to provide additional notice, such as via email to the address associated with your Account or through a prominent notice on our website.
12.3 We encourage you to review this Privacy Policy periodically. If you continue to use the Service after changes take effect, we will treat your continued use as awareness of the updated practices. If you do not agree with the revised policy, you may discontinue use of the Service and request deletion of your Account.
13. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:
Clink Lab Limited
RM 10D R1, 10/F KIN GA IND BLDG
9 SAN ON ST, TUEN MUN
HONG KONG
Email: support@modelmax.io
For data protection inquiries specifically related to GDPR, you may also contact us using the same email address with the subject line "GDPR Request".