Last updated: October 15, 2026 (effective October 22, 2026)
Privacy Policy
1. Introduction
This Privacy Policy describes how AICU Inc. ("we", "us", or "our") handles information when you use the AICU API Platform ("Service") at api.aicu.ai.
The general AICU Privacy Policy covers AICU websites and other AICU services. It does not cover the content we process for you through the API. For the API, this policy applies, and prevails where the two differ.
2. Information We Handle
2.1 Account Information
When you create an account, we collect:
- Email address
- Name (optional)
- GitHub account information and avatar URL (if you sign in with GitHub)
- Settings you choose, such as language and notification preferences
2.2 Usage Records
For each API call we record:
- The endpoint, the model or voice, and the time
- Size, such as the number of characters or tokens, and the length of audio
- The language as inferred from the script of the text
- Client software (User-Agent) and country of origin
- Status and cost
We do not read the content of your requests to make these records; stored requests are kept separately (section 2.4). IP addresses are used while a request is being handled, for example for rate limiting and abuse prevention; usage records keep the country, not the IP address.
2.3 Payment Information
Payments are processed by Stripe. We do not store your card details. We receive from Stripe your transaction history, subscription status and the billing details needed to issue receipts and invoices. In Japan, billing may be provided by AICU Japan K.K. as a reseller.
2.4 Content You Send and Generate
Your requests (prompts, text, audio, images and other materials) are processed to produce the result you asked for. Generated output, such as audio and images, may be stored so that it can be delivered to you again and served from cache.
To improve the Service and to detect and prevent abuse (such as sexual or otherwise prohibited content, deepfakes and impersonation), we keep the content of requests, such as the text you send for speech, for up to 90 days. Stored requests are kept apart from usage records, are accessible only to the personnel who need them, and are not used to train models. A business or team account may agree different handling with us by contract.
Recordings and consent records that you submit to create a voice are kept as described in the Terms of Service.
3. How We Use Information
- To provide, bill and improve the Service
- To process payments and issue receipts and invoices
- To send service-related communications
- To detect and prevent fraud, abuse and violations of the Terms of Service
- To comply with legal obligations and respond to lawful requests
We do not use your content to train models, and we do not sell personal information. The one exception is output that you explicitly make public (for example, an image generated with visibility: public): under section 7.2 of the Terms of Service, AICU may publish it, edit it and use it to train and improve models and services.
4. Caching of Generated Output
Generated output may be cached on our storage (Cloudflare R2) to deliver it again, to improve performance and to reduce cost. An identical request may be answered from the cache. The cache is not a permanent archive: we do not guarantee that output remains available, and cached output may be removed at any time. Keep your own copy of anything you need.
5. Review Where a Violation Is Suspected
Where we reasonably suspect a violation of the Terms of Service, of a third-party provider's terms or policies, or of applicable law, we may review the requests and generated output available to us for the accounts concerned, to the extent necessary for the investigation. Such a review is limited to the personnel who need it, and its results are used only for the investigation, for enforcing the Terms of Service, and where the law requires.
Where we suspect abuse such as unauthorized access, attacks that infringe privacy, duplicate accounts, bots or the farming of free credits, we may go beyond the routine handling described in this policy for the accounts concerned: in particular, we may collect and keep connection information such as IP addresses and the software used, which usage records otherwise do not keep (section 2.2), and compare accounts with each other. As a means of confirmation we may e-mail you, describing a request you made (by a summary or a translation, without sending its full content), and ask you to confirm that the request is yours. We do this only to the extent necessary and within applicable law, as set out in section 7.4 of the Terms of Service.
6. Information Sharing
6.1 Service Providers
We share information with the providers we need to run the Service:
- Cloudflare - hosting, storage, database, security and some model inference
- Stripe - payment processing
- Resend - sending e-mail such as sign-in codes, receipts and notices
- ElevenLabs - speech and voice features
- OpenAI, Google, OpenRouter, Groq, Together AI, fal.ai, Sakura AI Engine and Alibaba Cloud - model inference for text, image, video and transcription
- X - when you use the X lookup endpoints
- AICU Japan K.K. - billing and customer support in Japan
When you call a model, your request and the generated response are processed by the provider of that model. How a provider handles content is governed by that provider's own terms and privacy policy. The current list of providers is in the Terms of Service, and we may change providers.
6.2 Legal Requests and Safety
We may disclose information when:
- Required by law, such as a court order or subpoena
- Necessary to prevent imminent harm
- Necessary to investigate violations of the Terms of Service
6.3 CSAM Reporting
If Child Sexual Abuse Material (CSAM) is detected on the Service, we report it as required, including to:
- National Center for Missing & Exploited Children (NCMEC)
- Internet Hotline Center (IHC) in Japan
- Local law enforcement as required
7. Retention
| Data | How long we keep it |
|---|---|
| Account information | While your account exists, and afterwards as long as the law requires |
| Usage records | They form the billing ledger and are kept for as long as needed for billing, audit and legal obligations |
| Payment records | As long as tax and accounting law requires |
| Stored requests (such as text sent for speech) | Up to 90 days (section 2.4), then deleted |
| Generated output | Temporarily, as a cache (section 4). It is not kept as a permanent archive |
| Records of abuse investigations | As long as needed for legal compliance |
8. Your Rights and Requests
Depending on your jurisdiction, you may have the right to:
- Access your personal data
- Correct inaccurate data
- Delete your data, with some exceptions such as records we must keep by law
- Export your data
- Object to processing
To exercise these rights, to close your account, or to ask us to delete your account information or stored output, write to api@aicu.ai from the e-mail address registered to your account. We may ask you to confirm that the account is yours before we act.
9. Data Security
- Encryption in transit (TLS)
- API keys are stored as hashes (SHA-256), not in plain text
- Access controls for administrative functions
10. International Data Transfers
Your data may be processed in countries outside your own, including Japan and the United States, by us and by the providers listed in section 6.1.
11. Children's Privacy
The Service is not intended for anyone under 18 years of age. We do not knowingly collect personal information from children.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will announce material changes on the news page or by e-mail.
13. Contact
AICU Inc.
- Privacy requests and questions: api@aicu.ai
- General inquiries: https://aicu.ai/contact