Legal

Privacy Policy

Last updated: April 27, 2026

1. Introduction

MoxToken Inc. ("we", "us", "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, API, and website at [moxtoken.com](http://moxtoken.com) (the "Service").

This policy is designed to comply with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable data protection laws.

2. Data Controller

MoxToken Inc. is the data controller for the personal data described in this policy. Contact us at privacy@moxtoken.com for any privacy-related questions.

3. Information We Collect

3.1 Account information (provided by you or third-party login providers)

When you create an account, we collect the following information depending on your chosen authentication method:

  • Google OAuth: email address, profile photo URL, and display name from your Google account.
  • GitHub OAuth: email address (may require additional permission if set to private), profile photo URL, and display name or username from your GitHub account.
  • Email verification code: email address only.

We do not collect passwords. Authentication is handled entirely through OAuth providers or one-time verification codes.

3.2 Payment information

Payment processing is handled by Stripe. We do not store your credit card numbers or full payment details on our servers. Stripe may collect and store your payment method details, billing address, and tax information in accordance with its own privacy policy.

We receive from Stripe: a payment method identifier (fingerprint), transaction amounts, transaction status, and invoice references. The payment method fingerprint is used to prevent abuse in our referral program (see Section 4).

3.3 API usage metadata

When you make API requests through the Service, we log the following metadata for billing, analytics, and debugging purposes:

  • Timestamp of the request
  • Model name and model ID
  • API key used (stored in masked form)
  • Input and output token counts
  • Cost of the request
  • Response speed (tokens per second)
  • Completion status (e.g., stop, length, error)
  • Latency

We do not store or log API request content (prompts) or response content (completions). Your prompts and completions pass through our gateway to the upstream model provider and are not retained by us.

3.4 Technical data

We automatically collect certain technical information when you access the Service:

  • IP address
  • Browser type and version
  • Device information
  • Referring URL
  • Pages visited and interactions on our website
  • Language preference (detected from your browser's Accept-Language header on first visit)

3.5 Webhook configuration

If you configure a webhook, we store:

  • Your webhook endpoint URL
  • Your webhook secret (if provided), stored in encrypted form
  • Your event subscription preferences

This data is used solely to deliver event notifications to your specified endpoint.

3.6 Referral program data

When you participate in our referral program, we process:

  • Your unique referral link (which contains your user ID)
  • The email address of invited users (stored in masked form in your referral history)
  • Payment method fingerprints (from Stripe) to detect duplicate accounts
  • IP addresses at the time of registration to detect coordinated sign-ups

This data is used to administer rewards and prevent abuse. IP-based detection is performed silently and does not result in user-facing notifications.

3.7 Support communications

Messages you send to our support team, including email content and any attachments.

4. Information We Do NOT Collect

  • We do NOT store or log API request/response content (prompts and completions).
  • We do NOT use your data to train AI models.
  • We do NOT sell your personal data to third parties.

5. How We Use Your Information

We use the information we collect for the following purposes:

  • To provide and maintain the Service, including routing API requests and processing billing.
  • To process payments and manage your account balance, including manual and automatic top-ups.
  • To send transactional communications: registration confirmation emails, payment receipts and notifications (sent via Stripe), and low-balance alerts (via email or webhook).
  • To detect and prevent fraud, abuse, and security incidents, including referral program abuse detection.
  • To deliver webhook event notifications to your configured endpoint.
  • To improve the Service and develop new features based on aggregated, anonymized usage data.
  • To comply with legal obligations, including tax and accounting requirements.

We do not send marketing emails unless you explicitly opt in.

6. Legal Basis for Processing (GDPR)

We process your personal data under the following legal bases:

  • Contract: processing necessary to perform our contract with you (providing the Service, processing payments, managing your account).
  • Legitimate interest: improving the Service, preventing fraud, securing our systems, administering the referral program.
  • Consent: marketing communications (you can opt out at any time).
  • Legal obligation: compliance with tax, accounting, and regulatory requirements.

7. Data Sharing

We share your data only with the following categories of third parties:

  • AI model providers: API request content is forwarded to upstream providers (such as OpenAI, Anthropic, and Google) to fulfill your requests. Each provider processes this data under its own privacy policy. We do not control how providers handle your request content after it is forwarded.
  • Payment processor: Stripe, for payment processing, invoicing, and payment method verification.
  • Infrastructure providers: cloud hosting services used to operate the Service.
  • Law enforcement: when required by law or valid legal process.

We do not sell, rent, or trade your personal information.

8. Your Rights (GDPR)

If you are in the EU/EEA, you have the right to:

  • Access: request a copy of your personal data.
  • Rectification: correct inaccurate data.
  • Erasure: request deletion of your data ("right to be forgotten").
  • Portability: receive your data in a structured, machine-readable format.
  • Restriction: request limited processing of your data.
  • Objection: object to processing based on legitimate interest.
  • Withdraw consent: withdraw consent at any time for consent-based processing.

To exercise these rights, email privacy@moxtoken.com. We will respond within 30 days.

9. Your Rights (CCPA)

If you are a California resident, you have the right to:

  • Know what personal information we collect and how it is used.
  • Request deletion of your personal information.
  • Opt out of the sale of personal information (we do not sell personal data).
  • Non-discrimination for exercising your privacy rights.

Contact privacy@moxtoken.com to exercise these rights.

10. Data Retention

We retain your data according to the following schedule:

  • Account data (email, display name, avatar): retained for as long as your account is active.
  • API usage metadata: retained for 90 days for billing and analytics purposes.
  • Payment and transaction records: retained as required by applicable tax law (typically 7 years).
  • Webhook configuration: retained for as long as your account is active.
  • Referral history: retained for as long as your account is active.

When you delete your account through the Console, we permanently erase your account data, API keys, and usage logs. Payment records retained for legal compliance are anonymized where possible. Stripe-side billing arrangements (such as saved payment methods and auto top-up configurations) are cancelled at the time of account deletion.

You can request data deletion at any time by contacting privacy@moxtoken.com or by deleting your account directly in the Console.

11. Data Security

We implement security measures to protect your data, including:

  • TLS encryption for all API traffic and website connections.
  • Encryption at rest for stored data.
  • API key hashing (we never store plaintext keys after initial creation).
  • Role-based access control for internal systems.
  • Webhook secrets stored in encrypted form.

While we take reasonable steps to protect your information, no method of transmission or storage is completely secure. We cannot guarantee absolute security.

12. International Data Transfers

Your data may be transferred to and processed in the United States. For EU/EEA users, we rely on Standard Contractual Clauses (SCCs) to ensure adequate data protection for international transfers.

13. Cookies

We use the following types of cookies:

  • Authentication cookies: used to maintain your login session across subdomains (www.moxtoken.com, console.moxtoken.com, ops.moxtoken.com). These are essential for the Service to function and cannot be disabled.
  • Language preference cookie: stores your selected language (English or Japanese) and is shared between the Marketing Site and Console. This cookie persists until you manually change your language preference.
  • Analytics cookies (opt-in only): used to understand how users interact with our website. These are only placed with your explicit consent.

You can control non-essential cookies through your browser settings or our cookie consent interface.

14. Local Storage

The Playground feature stores conversation history and settings in your browser's local storage only. This data is not uploaded to our servers. Clearing your browser data or switching devices will result in permanent loss of Playground data. We have no ability to recover this data.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service. The "Last updated" date at the top reflects the most recent revision.

16. Contact Us

For privacy questions, data requests, or concerns, please contact us at privacy@moxtoken.com.