NovaNovaAPI Privacy Policy
What we collect
- Account data. The email address you sign up with, and a password. Nothing else is required to create an account — no phone number, no ID document.
- Billing data. Your prepaid balance, your top-up orders, and the payment reference we matched each one against. For USDT that reference is the on-chain transaction hash.
- Usage data. Requests, token counts and cost, recorded per API key and per day. This is the same data your usage page shows you.
What we do not do
- We do not sell your data and we do not share it with advertisers.
- We do not use the content of your requests for anything other than serving them and preventing abuse.
Abuse screening, and what it means for your data
To keep the service usable and to comply with the upstream provider's terms, requests are screened for prohibited content before they are forwarded. Be aware of three things:
- Every request is screened (not sampled) through an automated moderation API.
- That screening sends your request text to a third party — OpenAI's moderation endpoint (
omni-moderation-latest), which OpenAI states is not used to train or improve its models. See the next section. - If a request is flagged, we keep an excerpt of it for 30 days. Requests that are not flagged are not stored as content. We are telling you this because "we don't log your prompts" is not true, and we would rather you know.
Practical consequence: the screening is automated and applies to every request. Only flagged requests are recorded, and only as a short excerpt with secrets redacted.
Third parties involved in serving you
- DeepSeek — your requests are forwarded to DeepSeek's official API to be answered. How DeepSeek handles that data is governed by DeepSeek's own terms, not ours. Your prompt reaches DeepSeek exactly as it would if you called DeepSeek yourself; what differs is who you pay and who screens first.
- OpenAI — request text is sent to OpenAI's moderation endpoint for abuse screening before it is forwarded upstream. OpenAI states that data sent to its API is not used to train or improve its models. See "Abuse screening" above.
- PayPal — if you top up by PayPal, that transaction is processed by PayPal under their terms.
- USDT on TRC20 (via our payment processor, BEpusdt) — a USDT transfer is public on-chain by nature. The amount, the sending and receiving addresses and the transaction hash are visible to anyone. We use the transaction hash to match your order. This is a property of the network, not a choice we make.
Your controls
- You can revoke any API key yourself, at any time, from the console.
- To ask about or request deletion of your account data, email service@lbase.com.