Privacy Policy

TokenRex operates tokenrex.ai and its API. For personal data processed to run the service, we act as the data fiduciary under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”). Contact: privacy@tokenrex.ai.

• Account: name (if given), email, sign-in method (email/password or Google), two-step verification settings and security codes.
• Wallet and payments: top-up amounts, payment IDs and status from Razorpay, UPI Autopay mandate status, coupons, referrals and invoices. We do not receive full card or bank login details.
• API keys: a secure hash, a short visible prefix, limits and permissions. The full key is shown to you once and not stored in readable form.
• Usage records: time, model, token or unit counts, cost, status and error details for each request.
• Playground: saved conversations, uploaded files, assistant settings and memories you create. Temporary chats are not saved.
• Support: live chat and email messages you send us.
• Device and visit data: IP address, browser, pages visited and referring site, used for security, fraud prevention and simple first-party site statistics.

Content sent through the API is passed to the selected model provider to generate a response. We do not use your prompts or outputs to train models, and we do not keep API request bodies as conversation history. Short error details may be recorded when a request fails, so we can investigate problems.

• To create and secure your account and verify sign-ins.
• To process requests, bill your wallet, issue invoices and handle refunds.
• To send service emails such as receipts, security codes and balance alerts you enable.
• To prevent fraud, abuse and key misuse, and to keep the service reliable.
• To meet tax, accounting and other legal obligations.

We process personal data with your consent when you sign up and use the service, and for legitimate uses allowed by the DPDP Act, such as meeting legal obligations and preventing fraud. You can withdraw consent at any time; we may then be unable to keep providing the service.

• AI model providers (such as OpenAI, Google and Anthropic) — the content of your requests, to generate responses.
• Payment partners — Razorpay, to process payments, mandates and refunds.
• Hosting, database, authentication and email providers that run the service for us.
• Authorities — when required by law or a valid legal order.

We do not sell personal data and we do not show advertising.

Some providers process data outside India. We only use providers that apply appropriate security, and transfers follow the DPDP Act and any restrictions notified by the Government of India.

• Account and usage data: while your account is active.
• Playground conversations and memories: until you delete them or your account.
• Payment and invoice records: as long as tax and accounting law requires (generally up to 8 years).
• Security and fraud records: as long as needed to protect the service and meet legal duties.

You have the right to:

• get a summary of the personal data we hold about you;
• correct or update inaccurate data;
• delete your data, subject to legal retention duties;
• withdraw consent;
• nominate another person to exercise your rights in case of death or incapacity;
• raise a grievance with us, and then with the Data Protection Board of India.

Email privacy@tokenrex.ai from your account email. We reply within 30 days. See Contact & Grievances.

Data is encrypted in transit, access is restricted to each account owner, API keys are stored as hashes, and two-step verification is available. No system is perfectly secure; if a breach affects you, we will notify you and the authorities as the law requires.

We use essential cookies and browser storage for sign-in and preferences, plus first-party statistics. No advertising trackers. See the Cookie Policy.

TokenRex is not intended for anyone under 18, and we do not knowingly collect their data.

We may update this policy. Material changes will be announced on the website or by email.