Effective Date: September 9, 2026
Last Updated: September 9, 2026

This Privacy Policy explains how LangGenius, Inc. ("Tokener.ai," "Tokener," "we," "us," or "our") collects, uses, discloses, and protects personal information when you visit Tokener.ai, create or use a Tokener account, purchase or use Tokener Credits, access models through our APIs, contact us, or otherwise use our services (collectively, the "Services").

1. Scope and Our Privacy Roles

This Privacy Policy applies when you use Tokener directly or use a Tokener account or API key through a third-party application or plugin. The third-party application's own privacy policy separately applies to its collection and handling of your information.

If Tokener technology is used only as an internal component of a Dify Cloud-managed service and you do not have a separate Tokener account or API key, the Dify Privacy Policy and applicable Dify agreements govern that use.

Tokener acts as a controller or business for information that we use for our own purposes, such as account administration, billing, website operation, security, communications, and legal compliance.

When we process prompts, files, outputs, or other content on behalf of a business customer ("Customer Content"), Tokener generally acts as a processor or service provider and the customer acts as the controller or business. That processing is governed by this Privacy Policy, the Agreement, the customer's documented instructions, and applicable law.

2. Personal Information We Collect

Depending on how you use the Services, we may collect:

• Account and organization information, such as your name, email address, profile information, organization, role, permissions, and authentication information;
• Customer Content, such as prompts, instructions, files, and model outputs that you or your users submit or receive through the Services;
• API and usage information, such as API key identifiers, selected Models and, where applicable, selected model-supply channels, request identifiers, token usage, timestamps, latency, error information, and routing or configuration information;
• Billing and transaction information, such as billing details, Tokener Credits, usage charges, invoices, payment status, refunds, and adjustments. Payment-card information is generally collected directly by our payment provider;
• Device, network, and log information, such as IP address, browser, operating system, approximate location, security events, and diagnostic information;
• Support and communications information, such as messages, attachments, feedback, and support requests; and
• Information from third parties, such as identity providers, payment providers, Model Providers, security providers, and third-party applications you use with Tokener.

3. How We Use Personal Information

We may use personal information to:

• provide, operate, maintain, and support the Services;
• authenticate users and manage accounts, organizations, API keys, and permissions;
• route each request according to the Model and, where offered, the model-supply channel selected for that request, and return the Model output;
• measure usage, administer Tokener Credits, process payments, and maintain transaction records;
• protect the Services, prevent fraud and abuse, investigate incidents, and enforce our terms and policies;
• monitor and improve the reliability, security, and performance of the Services;
• communicate with you about the Services, support, billing, security, legal updates, and, where permitted, marketing; and
• comply with law and protect our rights and the rights of others.

Tokener does not use Customer Content to train AI models or for targeted advertising. Model Provider retention, review, and training-related practices are described in Section 4 and the Subprocessor List.

Where applicable law requires a legal basis and Tokener acts as controller, we rely on performance of a contract, our legitimate interests, compliance with legal obligations, or consent, as appropriate. Where Tokener acts as processor, the customer determines the applicable legal basis.

4. Customer Content and Model Providers

A Tokener API key and general-purpose Credit balance may be used with the Models and model-supply channels then available to your Account. The Services, including the /models endpoint where applicable, identify the available model IDs and any Model Provider or delivery-channel options that Tokener makes selectable. For each request, you select a Model and, where offered, a supply channel using the applicable model ID or other selection method described in the Services or Documentation. A supply-channel choice may be reflected in the model ID or another documented selector and need not use a separate provider parameter. You may select a different available Model or supply channel for a later request. Tokener sends the information necessary to complete the request only to the Model Provider or authorized delivery provider supplying the option you selected. Other Models, channels, and providers do not receive the request merely because they are available. The provider used for the request returns the Output through Tokener.

For Tokener-managed model access, we use commercial or API offerings and apply the available data controls under the applicable provider contracts, configurations, technical requirements, and usage policies. Tokener does not opt in to or otherwise authorize a Model Provider to use Customer Content to train or improve general-purpose models unless the customer expressly authorizes that use and any notice or consent required by law has been provided or obtained. A Model Provider may process, retain, or review limited request data for service delivery, abuse monitoring, security, troubleshooting, or legal compliance, as permitted by the applicable contract, configuration, and law.

The Model Provider or authorized delivery provider associated with each Model or model-supply channel is displayed in the model catalog, model-selection interface, Documentation, or Subprocessor List. If the same Model is available through more than one selectable provider or delivery channel, the available options will be identified there, and you may select or switch among them as made available by Tokener. Only the provider supplying the option selected for a request receives that request. If a selected option uses more than one disclosed supporting provider or infrastructure component, only the providers or components actually used for the request process the relevant information. Providers may have different processing locations, retention periods, abuse-monitoring practices, and model-training commitments. A provider entry applies to you only when a request uses an option supplied through that provider.

Sensitive Data or Special Categories of Data. Customers are prohibited from including sensitive personal data or special categories of personal data in Customer Content submitted to the Services.

5. How We Disclose Personal Information

We may disclose personal information to:

• Model Providers that process requests and generate outputs;
• hosting, infrastructure, security, observability, communications, identity, support, analytics, and payment providers that help us operate the Services;
• our affiliates, professional advisers, auditors, insurers, and transaction counterparties where appropriate; and
• authorities or other parties where required by law or necessary to protect rights, safety, security, and service integrity.

We may also disclose information at your direction or with your consent.

We do not sell personal information for money or share personal information for cross-context behavioral advertising as those terms are defined under applicable U.S. privacy laws.

6. Data Retention

Under Tokener’s current standard configuration, Tokener retains copies of full prompts and model outputs in systems under its control for up to seven days, unless a different setting or contractual period applies. This seven-day period applies only to Tokener’s own retention. For each request, the Model Provider or authorized delivery provider supplying the selected Model and any selected supply channel for that request also processes the relevant prompt and output and may retain limited request data for a different period, subject to the applicable provider agreement, service configuration, and law. See Section 4 and the Subprocessor List for more information.

We retain account, usage, security, support, billing, and transaction information for as long as reasonably necessary to provide the Services, maintain security and business records, comply with law, resolve disputes, and enforce our agreements. Backups may remain for a limited period before deletion or overwrite.

Model Providers and third-party applications may apply their own retention periods. When information is no longer required, we delete or de-identify it or securely isolate it until deletion is possible.

7. International Data Transfers

Tokener and its service providers may process personal information outside the country where you are located. Processing locations may depend on our infrastructure and on the Model Provider or authorized delivery provider supplying the selected Model and any selected supply channel for a request. Current subprocessors and their processing locations are identified in the Subprocessor List.

Where required, we use recognized transfer mechanisms, such as adequacy decisions, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum or Agreement, or other lawful safeguards.

8. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information, including measures relating to access control, encryption, monitoring, incident response, and vendor management. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

You are responsible for protecting your account, API keys, applications, and systems and for selecting Models and any model-supply channel options that are appropriate for your use.

9. Your Choices and Privacy Rights

Depending on your location, you may have rights to access, correct, delete, restrict, or obtain a copy of your personal information; object to certain processing; withdraw consent; opt out of certain marketing or other processing; and complain to a supervisory authority.

Individuals in the EEA may submit a request through our Data Request Portal. Individuals in other locations may email [email protected]. We may verify your identity or authority before completing a request.

If your request concerns Customer Content processed on behalf of a Tokener business customer, please contact that customer first. We will assist the customer as required by applicable law and our agreements with the customer.

10. United States Privacy Disclosures

Depending on applicable U.S. state law, you may have rights to know and access personal information, obtain a portable copy, request deletion or correction, opt out of certain sale, sharing, targeted advertising, or profiling, limit certain uses of sensitive personal information, and appeal a denied request.

The categories of personal information we may collect include identifiers, customer records, commercial information, internet or electronic network activity, approximate geolocation, professional information, and audio, visual, or other information that you submit as Customer Content. We collect this information from the sources described in Section 2, use it for the purposes described in Section 3, and disclose it to the recipients described in Section 5.

California residents and authorized agents may submit requests by emailing [email protected]. We may take reasonable steps to verify the request and the agent’s authority. You will not be discriminated against for exercising an applicable privacy right.

11. Japan Privacy Disclosures

Where Japan's Act on the Protection of Personal Information applies, you may request disclosure of retained personal data and third-party provision records, correction, addition, deletion, suspension of use, erasure, or suspension of third-party provision, subject to applicable conditions and exceptions.

We may provide personal information to recipients outside Japan. Information concerning destination countries, recipients, and safeguards will be made available through this Privacy Policy, our Subprocessor List, or upon request, as required by law.

Requests may be submitted to [email protected]. The Japan contact for privacy inquiries is:

LangGenius K.K. (LangGenius株式会社)
Nihonbashi Front 1F
3-6-2 Nihonbashi, Chuo-ku
Tokyo, Japan
Representative Director and President: Kiji Marudan

12. Third-Party Sign-In

If you sign in through Google, Dify, or another identity provider, we receive the account and authentication information made available under the permissions displayed to you. We use this information to authenticate you, link or create your account, administer access, and protect the Services.

We do not access content from Gmail, Google Drive, Calendar, or other third-party services unless a feature separately requests access and you authorize it. You may revoke access through the applicable provider’s account settings. Revoking access does not automatically delete your Tokener account; you may request account deletion by emailing [email protected].

13. Cookies and Similar Technologies

We may use cookies or similar technologies that are necessary for authentication, security, session management, and operation of the Services. If we use non-essential analytics, advertising, or similar technologies where consent is required, we will provide appropriate notice and choices.

You may control cookies through your browser settings. Disabling necessary cookies may affect the Services.

14. Children

The Services are not directed to children under 18, and we do not knowingly collect personal information from children under 18. If you believe that a child has provided personal information, please contact us.

15. Third-Party Services

The Services may link to or integrate with third-party services. Their independent privacy practices are governed by their own notices and terms. We encourage you to review those notices before enabling or using a third-party service.

16. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our Services, processing activities, or applicable law. We will post the updated version and revise the date above. We will provide additional notice where required.

17. Contact Us

The entity responsible for this Privacy Policy is:

LangGenius, Inc.
Delaware registered company (File No. 7358523), USA
Privacy inquiries and requests: [email protected]
EEA Data Request Portal: https://langgeniusinc.gdprlocal.com/eu

EU Representative
Instant EU GDPR Representative Ltd
Contact: Adam Brogden
Office 2, 12A Lower Main Street
Lucan, Co. Dublin, K78 X5P8, Ireland
Email: [email protected]
Telephone: +353 15 549 700

Tokener.ai Subprocessor List

Last Updated: September 9, 2026

Tokener.ai uses the subprocessors and service providers listed below to provide, secure, monitor, and support the Services.

For each request, Customer Content is sent only to the Model Provider or authorized delivery provider supplying the selected Model and any selected supply channel for that request. Other Models, channels, and providers listed below do not receive that request merely because they are available through Tokener. If the same Model is offered through more than one selectable provider or delivery channel, only the provider supplying the option selected for the request receives it. If a selected option uses more than one disclosed supporting provider or infrastructure component, only those actually used for the request process the relevant Customer Content.

Tokener does not use Customer Content to train AI models. For Tokener-managed model access, Tokener does not opt in to or otherwise authorize Model Providers to use Customer Content to train or improve their general-purpose models unless the customer expressly authorizes that use and any notice or consent required by law has been provided or obtained. Model Providers may process or retain limited request data as permitted by the applicable contract, configuration, and law for service delivery, abuse monitoring, security, troubleshooting, or legal compliance.

Redis and similar software components operated within Tokener's own cloud environment are not listed separately because using the software does not by itself disclose Customer Content to a separate external provider.

Tokener may update this list when providers or processing locations change. Where required by an applicable agreement or law, Tokener will provide notice of material changes.