隐私政策Privacy Policy

01我们收集的信息Information we collect

(a) 您提供的账户信息(a) Account information you provide

• 用户名、电子邮箱与密码(仅以加盐哈希存储——我们无法读取您的密码)。Username, email address, and password (stored only as a salted hash — we cannot read your password).
• 可选的资料字段,以及(若您绑定)第三方标识符。Optional profile fields and, if you link them, third-party identifiers.
• 您购买额度时的计费标识符(如支付处理方的客户引用)。我们不存储您的完整卡号;银行卡支付由我们的支付处理方 Stripe 处理,其处理适用其自身的隐私声明。Billing identifiers when you purchase Credits (e.g., a payment-processor customer reference). We do not store your full card number; card payments are handled by our payment processor, Stripe, whose own privacy notice applies to its processing.

(b) 您使用本服务时我们生成的用量元数据(b) Usage metadata we generate as you use the Service

我们就每个请求记录运营/计费元数据,包括:逻辑模型名、token 计数(提示/补全)、时间戳、请求标识符、来源 IP 地址,以及计费摘要记录。We record operational/billing metadata for each request, including: the logical model name, token counts (prompt/completion), timestamps, request identifiers, source IP address, and a billing-summary record.

(c) 我们不持久存储的内容(c) What we do NOT durably store

我们的控制面(控制台/计费)与推理层均不持久存储您提示词或补全的正文("客户内容"):Neither our control plane (console/billing) nor our inference layer durably stores the body text of your prompts or completions ("Customer Content"):

• 控制面(控制台/计费):仅存储上列用量元数据——无提示词/补全正文。Control plane (console/billing): stores only the usage metadata listed above — no prompt or completion bodies.
• 推理层:仅记录计费/用量元数据(花费、token 计数、模型、密钥);其日志不含提示词/补全正文,且未配置任何外部日志或分析集成。Inference layer: records billing/usage metadata only (spend, token counts, model, key); its logs contain no prompt or completion bodies, and no external logging or analytics integrations are configured.
• 不跨请求或客户缓存内容:我们不为复用而缓存您请求或响应的内容;我们推理层的响应缓存已禁用。No content caching across requests or customers: we do not cache the content of your requests or responses for reuse; our inference-layer response cache is disabled.
• 我们不使用客户内容训练模型,也不出售之。We do not use Customer Content to train models, and we do not sell it.

客户内容仅为履行您的请求而传输至上游提供方;就其执行的处理适用其自身的数据规范。依据我们上游提供方的商用条款,客户内容不用于训练其模型。Customer Content is transmitted to the Upstream Provider(s) solely to fulfill your request; their own data practices apply to the processing they perform. Under our Upstream Provider's commercial terms, Customer Content is not used to train its models.

(d) Cookie / 本地存储(d) Cookies / local storage

本控制台使用严格必要的、用于登录会话与安全的 cookie 与本地存储;不使用广告或第三方分析 cookie。The console uses cookies and local storage that are strictly necessary for login sessions and security; it does not use advertising or third-party analytics cookies.

02我们如何使用信息How we use information

我们将个人信息用于:(a) 提供、保障与运营本服务;(b) 验证您的身份并管理您的账户;(c) 计量用量并就额度计费;(d) 检测、调查与防范滥用、欺诈与安全威胁——包括可能危及我们或我们上游提供方账户的行为;(e) 发送服务与计费通知;以及 (f) 履行法律义务。We use personal information to: (a) provide, secure, and operate the Service; (b) authenticate you and manage your account; (c) meter usage and bill Credits; (d) detect, investigate, and prevent abuse, fraud, and security threats — including conduct that could jeopardize our or our Upstream Providers' accounts; (e) communicate service and billing notices; and (f) comply with legal obligations.

依据 PIPEDA,我们在您知情并同意的情况下收集、使用与披露个人信息,但该法允许或要求的情形除外。同意可为明示或默示,取决于信息的敏感性与目的;您注册并使用本服务,即同意本政策所述、为上述目的对个人信息的收集、使用与披露。我们亦依赖 PIPEDA 规定的例外——例如为调查违约或违法、为检测或防范欺诈,以及为满足法律要求。您可按第 7 条撤回同意,但受法律与合同限制。Under PIPEDA, we collect, use, and disclose personal information with your knowledge and consent, except where the Act permits or requires otherwise. Consent may be express or implied depending on the sensitivity of the information and the purpose; by registering for and using the Service, you consent to the collection, use, and disclosure of personal information as described in this Policy for the purposes set out above. We also rely on the exceptions PIPEDA provides — for example, to investigate a breach of an agreement or a contravention of law, to detect or prevent fraud, and to meet legal requirements. You may withdraw consent as described in §7, subject to legal and contractual limits.

03信息的披露Disclosure of information

我们仅在下列情形披露个人信息:We disclose personal information only as follows:

• 上游提供方——您的请求(客户内容与必要元数据)被传输至履行请求的上游提供方,受其自身隐私规范约束;依其商用条款,客户内容不用于训练其模型。Upstream Providers — your requests (Customer Content and necessary metadata) are transmitted to the Upstream Provider(s) that fulfill them, subject to their own privacy practices; under their commercial terms, Customer Content is not used to train their models.
• 服务提供商 / 处理方——例如我们的支付处理方(Stripe)与邮件提供方(Resend,入站路由经 Cloudflare),且受合同限制其仅为向我们提供服务而使用。Service providers / processors — e.g., our payment processor (Stripe) and email provider (Resend, with inbound routing via Cloudflare), under contracts limiting their use to providing services to us.
• 法律——在法律要求时,或为保护权利、安全与本服务的完整性。Legal — where required by law, or to protect rights, safety, and the integrity of the Service.
• 业务转移——在合并、收购或资产出售的情形下,并予以通知。Business transfer — in connection with a merger, acquisition, or asset sale, with notice.
• 我们不出售您的个人信息或客户内容。We do not sell your personal information or Customer Content.

04跨境传输Cross-border transfers

个人信息与客户内容可能在加拿大境外处理,包括由位于美国及其他地区的我们上游提供方与服务提供商处理(例如,我们的支付处理方 Stripe、邮件提供方 Resend、基础设施提供方 Cloudflare,以及我们的上游提供方在美国处理数据)。该等信息可能受这些司法管辖区法律的约束,包括其法院、执法与国家安全机关的合法访问。我们以合同要求服务提供商以与适用加拿大法律所要求相当的水平保护个人信息,并仅为向我们提供服务而使用之。您使用本服务,即确认您的信息将在这些司法管辖区处理。Personal information and Customer Content may be processed outside Canada, including by our Upstream Provider(s) and service providers located in the United States and elsewhere (for example, our payment processor Stripe, email provider Resend, infrastructure provider Cloudflare, and our Upstream Provider(s) process data in the United States). Such information may be subject to the laws of those jurisdictions, including lawful access by their courts, law enforcement, and national-security authorities. We require our service providers, by contract, to protect personal information at a level comparable to that required under applicable Canadian law and to use it only to provide services to us. By using the Service you acknowledge that your information will be processed in these jurisdictions.

05留存Retention

我们在您账户存续期间保留账户信息,并在其后为法律、税务与审计目的按需保留。用量元数据为计费、安全与分析目的最长保留二十四 (24) 个月,之后删除或聚合;账户与交易记录可在法律、税务与审计要求时保留更长时间。We retain account information for the life of your account and as needed for legal, tax, and audit purposes thereafter. Usage metadata is retained for up to twenty-four (24) months for billing, security, and analytics, then deleted or aggregated; account and transaction records may be retained longer where required for legal, tax, and audit purposes.

06安全Security

我们采用与信息敏感性相称的合理管理、技术与物理保障措施,包括传输加密(TLS)、访问控制、受限凭据与监控。任何传输或存储方法都并非完全安全;我们无法保证绝对安全。若安全保障的失陷造成重大伤害的真实风险,我们将依 PIPEDA 通知受影响个人及加拿大隐私专员公署(OPC),并保存失陷记录。We use reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including encryption in transit (TLS), access controls, restricted credentials, and monitoring. No method of transmission or storage is fully secure; we cannot guarantee absolute security. If a breach of security safeguards creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada, and maintain records of breaches, as required by PIPEDA.

07您的权利Your rights

在 PIPEDA 及适用法律的范围内,您可访问与更正您的个人信息,请求删除(受我们法律、税务与审计留存义务及任何技术限制约束),撤回同意(可能限制或终止您使用本服务的能力),以及向我们或加拿大隐私专员公署投诉。请联系 service@solunarai.com;我们将在法律要求的时限内回应。Subject to PIPEDA and applicable law, you may access and correct your personal information, request deletion (subject to our legal, tax, and audit retention obligations and any technical limits), withdraw consent (which may limit or end your ability to use the Service), and complain to us or to the Office of the Privacy Commissioner of Canada. Contact service@solunarai.com; we will respond within the time required by law.

08未成年人Children

本服务不面向儿童,旨在供成人与机构用户使用。若机构客户(如高校)为可能是未成年人的最终用户启用访问,则该客户负责取得所需的任何额外同意(包括适用法律要求时可验证的父母或监护人同意),且此类使用可能需要单独的数据处理安排。The Service is not directed to children and is intended for use by adults and institutional users. Where an institutional customer (e.g., a university) enables access for end users who may be minors, the customer is responsible for obtaining any additional consents required (including verifiable parental or guardian consent where applicable law requires it), and such use may require a separate data-processing arrangement.

09变更Changes

我们可更新本政策;重大变更将在控制台内公告和/或通过邮件告知,并自通知所述之时生效。We may update this Policy; material changes will be posted in the console and/or emailed, effective as stated in the notice.

10联系方式Contact

隐私相关问题:请联系我们的隐私官(Privacy Officer),邮箱 service@solunarai.com — Solunar AI Inc.,加拿大不列颠哥伦比亚省。Privacy questions: our Privacy Officer at service@solunarai.com — Solunar AI Inc., British Columbia, Canada.