Privacy Policy

Effective 2026-09-09 · Applies to the ShinLinkAI API gateway, website and console.

1 · Overview

ShinLinkAI is an independently operated AI API gateway. We collect only the minimum data needed to run the service, meter usage and prevent abuse — nothing more. This policy sets out exactly what that means.

2 · What we collect

  • Account information — the email address or username you register with, and your password in hashed form. We never store plaintext passwords.
  • API request metadata — timestamps, model name, token counts (input / output / cached / reasoning), status codes and the originating API Key. This is what produces your billing and usage charts.
  • Payment records — the order number, payment transaction ID and amount of each top-up, used to credit your balance and handle disputes.
  • Support correspondence — messages you send us on WeChat or by email, so that we can reply.
  • Basic site preferences — theme and language choice, stored only locally in your browser.

3 · What we do not collect

  • Your prompts and model replies are not logged or stored (beyond the transient in-memory processing needed to complete the request). We do not build training sets from your traffic.
  • We run no advertising trackers, and we never sell or rent personal data.

4 · How we use it

  • To authenticate you and operate your account, Keys and limits.
  • To meter usage and keep your balance accurate.
  • To detect and stop abuse, fraud, leaked Keys and abnormal traffic.
  • To provide support and respond to your requests.
  • To tell you about service changes, outages or security incidents that affect your account.

5 · Data sharing

To complete a request, prompts and replies are forwarded to the upstream model vendor — that forwarding is the service itself. Beyond that, data is shared only with: the payment provider that processes WeChat Pay / Alipay top-ups; the infrastructure provider hosting the gateway; and law-enforcement authorities where legally required. Aggregated, non-identifying statistics may be used for internal capacity planning.

6 · Data retention

  • Request metadata — up to 180 days, then deleted or aggregated.
  • Account data — kept while your account is open; deleted when you ask us to close it (except records we must keep for accounting or legal reasons).
  • Payment records — kept for as long as is needed for dispute handling and legal obligations.

7 · Security

Traffic to the gateway and console is encrypted in transit. API Keys are stored in hashed form wherever possible and can be rotated or revoked at any time in the console. Access to production systems is restricted and credential-protected. If we discover a security incident affecting your data, we will notify the affected accounts as soon as possible.

8 · Your rights

You can request a copy of your account data, ask for a correction, or ask us to close your account — contact support@shinloo.com or email support@shinloo.com. We will respond within a reasonable period, and may verify your identity first. Closing your account forfeits any unused balance, which is not refundable except where the law requires it.

9 · Cookies and local storage

The website uses browser localStorage to remember display preferences (dark/light theme, language); the console uses a session cookie to keep you signed in. We use no third-party advertising cookies.

10 · Changes to this policy

If this policy changes materially we will update the effective date shown above; significant changes will also be announced to account holders. Continuing to use the service after a change means you accept the updated policy.

11 · Faces and voices (biometric data)

When you use face swap, digital-human generation or voice-cloning features we process your facial images and voice recording — sensitive personal information (biometric data). We process them only when you start a task, never collect them on our own initiative, and never use them for identification or security verification (added 2026-10-05).

  • Separate consent — we ask for your separate consent before processing; where another person's face or voice is involved, you must obtain that person's separate consent.
  • Retention — task assets and outputs are kept 30 days by default (unless you save them); consent and activity records are kept for at least 6 months.
  • Sharing — generation calls upstream model providers, so your input is transmitted to them for processing; we require them not to use it for other purposes.
  • Withdrawal — you can withdraw consent on the relevant feature page, after which we stop further processing. If you believe your rights are infringed, contact us through the reporting channel.

12 · Contact us

Privacy questions: email support@shinloo.com, in English or Chinese.