Privacy Policy

**BulkToken · Version 1.2 · Last updated: September 28, 2026**

This Privacy Policy explains how **WINDWAY TECHNOLOGY PTE. LTD**, operating the BulkToken platform ("BulkToken", "we", "us" or "our"), handles information when you use bulktoken.ai, our API, dashboard and related services (the "Service"). It should be read with our [Terms of Service](https://bulktoken.ai/terms).

For questions or privacy requests, contact **[[email protected]](mailto:[email protected])**.

## 1. Our role

Our registered address is **3 GAMBAS CRESCENT, #04-01, NORDCOM ONE, SINGAPORE 757088**. WINDWAY TECHNOLOGY PTE. LTD is responsible for the personal information we process for our own purposes described in this policy. Our privacy contact is [[email protected]](mailto:[email protected]).

BulkToken provides API access, routing, account management and billing for AI models delivered by third-party services. We handle account, billing, support and operational information for the purposes described below.

Where we process personal data in API requests on behalf of a customer, our role depends on the processing and applicable arrangements. Customers remain responsible for having an appropriate basis to submit information about other people. Additional data-processing terms, where required, should be agreed for that use; this policy does not itself establish a separate data-processing agreement.

## 2. Information we handle

| Category | Information and context |
|---|---|
| Account information | Email address, username, password hash and other account details you provide. Where you use a supported third-party sign-in service, we receive the account identifiers and profile information it shares for authentication. |
| Transaction information | Purchase amount, currency, order reference, payment status, Credits and related billing records. Payment providers collect payment details through their payment interfaces. We do not store full payment card numbers or card security codes. |
| API content | Prompts, files and other material sent with a request ("Inputs"), and responses returned for that request ("Outputs"). These may contain personal information if it is included in the content. |
| Usage and technical information | Requested models, timestamps, token or other billing units, response status, latency, usage charges, IP addresses, client or browser information, and operational or security logs. The information available depends on how you access the Service. |
| Support communications | Information you provide when contacting us, including details needed to investigate a question or resolve a problem. |
| Abuse reports and review records | Information supplied in a suspected-content report, related communications, request or task identifiers, relevant usage records and the review outcome. |

Please avoid including passwords, payment card details or other unnecessary sensitive information in API requests or support messages.

## 3. API Inputs and Outputs

BulkToken does not use API Inputs or Outputs to train models, sell their content or use it for advertising.

We process content to route and fulfill requests. Content may also be processed or retained where reasonably needed to troubleshoot a request or service problem, investigate suspected misuse or security incidents, review a report under the [content standards in our Terms](https://bulktoken.ai/terms), or meet legal obligations. For a report, we may examine material supplied by the reporter, relevant account and request records, and related Inputs or Outputs if they are available and reasonably needed. Access is limited to the relevant purpose; we do not routinely have personnel read individual Inputs or Outputs.

Usage and billing records are distinct from the content of a request. Keeping a record of a model name, token count or charge does not mean that we need to retain the full prompt or response for the same period.

Requests are transmitted to the service providers that supply the selected model. Where applicable, routing or fallback may involve another provider supporting that model. Model developers and the providers running a model may be different organizations. Their retention and other data practices may differ from BulkToken's. Our statement about BulkToken's own training practices is not a blanket promise about every provider. Contact us if you need information about the arrangements applicable to a particular model before sending data with specific handling requirements.

## 4. How we use information

We use information to operate and secure accounts; provide API access and responses; calculate usage and apply Credits; process and reconcile purchases; investigate support, billing and suspected-content reports; understand service usage and reliability; prevent fraud or misuse; and meet applicable legal obligations.

Where data protection law requires a legal basis, the basis depends on the activity. It may include performing our contract with you, our legitimate interests in operating and protecting the Service, compliance with legal obligations, or your consent where required. Processing customer API content on their behalf is governed by the applicable customer instructions and arrangements.

Service notices may concern billing, security, availability or policy changes. If we send optional marketing messages, we will provide a way to opt out and obtain consent where required. Opting out of marketing does not stop essential service notices.

We may use aggregated information to understand service performance. Information linked to an account or another identifiable person is not treated as anonymous merely because direct identifiers have been removed.

## 5. When information is shared

We do not sell personal information or share it for cross-context behavioral advertising. Information may be shared in the following circumstances:

- **Model and inference services:** to process API requests and return responses, as described in Section 3.
- **Payment services:** with the provider identified at checkout, including WAFFO where offered, to initiate or reconcile a transaction, prevent fraud and handle billing questions. Where Waffo Pancake acts as merchant of record, it handles relevant transaction, tax, billing and fraud information for its own payment-related responsibilities under its notices. See [WAFFO's Privacy Policy](https://www.waffo.ai/privacy).
- **Infrastructure and support services:** with hosting, network security, delivery, communications and analytics providers to the extent needed for their services. The data shared depends on their function.
- **Legal and security purposes:** where required by applicable law or valid legal process, or reasonably necessary to address fraud, security incidents or enforceable rights.
- **Business changes:** as reasonably necessary in a business transfer or reorganization, subject to applicable confidentiality and data protection requirements. We will provide any notice required for a material change in how your information is handled.
- **Your instructions or consent:** where you request a disclosure or separately authorize it.

Third parties' roles depend on their actual activities. Some act on our behalf; payment providers and other services may also process information for their own legal responsibilities. Links to their notices do not remove BulkToken's responsibilities for its own processing.

## 6. Cookies and analytics

The Service uses cookies or similar browser storage for functions such as authentication, security and saved preferences. Blocking necessary storage may prevent some features from working.

We use OpenPanel for product analytics where enabled. Analytics may include page or feature activity and service events associated with an account identifier. This helps us understand use and reliability; it is separate from using API content to train models. See [OpenPanel's Privacy Policy](https://openpanel.dev/privacy).

You can manage browser storage through your browser settings and contact us about applicable analytics choices or objections. Where consent is required for a particular tracking use, we will obtain it; where a permitted exception applies, we will provide the information and controls required by that exception.

## 7. Retention

We keep information for the period needed for its stated purpose, taking account of account activity, support needs, security, disputes and applicable legal requirements. Different information has different retention needs:

| Information | Retention approach |
|---|---|
| Account information | Retained to maintain the account and address closure, security or outstanding obligations. Information no longer needed is deleted or de-identified, subject to applicable retention requirements. |
| Transaction and accounting records | Retained for applicable accounting, tax, dispute and payment-record requirements. These requirements do not mean all API content must be kept for the same period. |
| API Inputs and Outputs | Processed to fulfill requests, with any further retention limited to the support, security or legal purposes described in Section 3. |
| Usage, operational and security records | Retained as needed for usage history, billing checks, service operation, incident investigation and disputes. |
| Support messages | Retained as needed to resolve and follow up on the matter, including related disputes or legal obligations. |
| Abuse reports and review records | Retained as needed to investigate, document and follow up on a report or related action, including any dispute or legal obligation. |

Closing an account does not necessarily erase all transaction or security records immediately. Backup copies may remain until their normal replacement cycle, with access limited to recovery or other necessary purposes. You can contact us about retention or request deletion; we will consider the request under applicable law and explain any relevant exceptions.

## 8. Security

We use measures appropriate to the information and processing, including encrypted connections, password hashing and access controls. We take reasonable steps to protect information, although no service can guarantee that every security incident will be prevented.

If a personal data breach requires notification, we will notify affected individuals and authorities in accordance with applicable law. Please protect your own credentials and contact us promptly if you suspect an account compromise.

## 9. International processing

Information may be processed in jurisdictions where BulkToken's infrastructure, payment partners and model or other service providers operate. Data protection laws may differ between those jurisdictions.

Where applicable law requires safeguards for an international transfer, the transfer must be supported by an appropriate arrangement, such as a recognized adequacy decision or applicable contractual safeguards. The arrangement depends on the parties, processing and relevant law. Contact us for information about relevant arrangements or available safeguards.

## 10. Your rights and choices

Depending on the law that applies to you, you may be entitled to access, correct, delete or obtain a copy of personal information; object to or restrict certain processing; or withdraw consent for processing based on consent. These rights may be subject to legal conditions and exceptions. Withdrawing consent does not affect processing already lawfully carried out.

Send requests to [[email protected]](mailto:[email protected]). We may ask for information reasonably needed to verify your identity and locate the relevant records. We will respond within the period required by applicable law and explain any permitted extension. You may also raise concerns with the relevant data protection authority. We will not penalize you for exercising rights protected by law.

Where we process information on behalf of a customer, we may refer a request to that customer or assist them in responding, as appropriate.

## 11. Age requirement

Accounts are intended for businesses and developers aged 18 or older. We do not knowingly offer accounts to children. If you believe a child has provided personal information through an account, contact us so we can investigate and take appropriate action.

## 12. Policy updates and contact

We may update this policy to reflect changes to the Service or our handling of information. We will update the date above and provide reasonable notice through the Service or by email of material changes. Where a change requires your consent, we will request it separately; continued use alone does not replace consent required by law.

For privacy, service, payment or other questions, contact **[[email protected]](mailto:[email protected])**.

**Operator:** WINDWAY TECHNOLOGY PTE. LTD

**Registered address:** 3 GAMBAS CRESCENT, #04-01, NORDCOM ONE, SINGAPORE 757088