CallAI Privacy Policy & Technical Integrity Commitment
We believe that proprietary source code, competitor research data, and prompt engineering are core corporate secrets. CallAI is founded on two uncompromising principles: “We stream and forward your traffic statelessly—never saving your prompt contents”, and “100% genuine upstream models with zero degradation or deceptive substitution”.
Six Pillars of Data Protection & Integrity
Architectural, cryptographic, and ethical safeguards defending your digital assets
Stateless Proxy · Zero Content Retention
Prompts, context, images, and completions pass through high-speed volatile RAM in real-time streaming chunks. Data is discarded immediately upon request completion—zero disk logging.
100% Authentic · No Model Degradation
Direct enterprise routing to Anthropic, OpenAI, and DeepSeek. No quantized INT4/INT8 degradations, no stealth prompt injections, and full preservation of deep reasoning thinking chains.
Minimal Metadata Ledger
Our PostgreSQL ledger records only billing metadata: timestamp, model ID, token usage counts, USD cost, and request_id. No message content columns exist in our database.
End-to-End TLS 1.3 Encryption
Encrypted transit on all API endpoints. API keys are hashed with salted irreversible algorithms and shown only once upon creation, with 1-click rotation in your dashboard.
Zero Training & Commercial Exploitation
Your intellectual property, proprietary code, and SEO keyword strategies will never be sold, mined, or used to train public or private foundational models.
GDPR & CCPA Data Sovereignty
Full respect for international privacy frameworks. Export your billing statements, request data erasure, and maintain total sovereignty over your organization’s identity.
Article 1: Stateless Streaming Architecture & Zero Content Retention
In conventional AI aggregators, systems frequently store user prompt histories and completions in centralized databases for analytics, model retraining, or session retrieval. For engineering teams handling proprietary source code or SEO analysts working with confidential keyword strategies, this presents severe leakage risks.
CallAI Architectural Standard:When an API request hits the CallAI gateway, authentication signatures and balance limits are verified in memory (RAM). Payloads are streamed (via Server-Sent Events / chunked transfer) straight to official upstream clusters. Incoming completion streams flow through the ephemeral proxy pipeline directly back to your client. Once the HTTP connection closes, memory is freed immediately.
- We never log or save your chat messages, source code, or system instructions;
- We never upload your data to public or private data lakes;
- We never persist uploaded documents, images, or URLs on disk or object stores;
- No platform engineer or automated process has the technical capability to access your prompt contents.
Article 2: 100% Genuine Upstream & Zero Model Degradation
The AI routing market is plagued by deceptive practices: unscrupulous vendors reduce operating costs by swapping flagships with quantized or distilled models (e.g. serving DeepSeek-8B instead of full 671B R1, or routing GPT-4o queries to mini models), stripping reasoning tokens, or injecting intrusive promotional prompts.
Direct official enterprise connections to Anthropic, OpenAI, and DeepSeek, with complete reasoning thinking chains preserved.
Pure pass-through: we never inject platform system messages, hidden ads, or alter your sampling temperature and top_p.
We never run downscaled INT4/INT8 local models pretending to be cloud flagships, safeguarding mathematical and coding accuracy.
Article 3: Transparent Accounting Ledger & Minimal Metadata
To provide auditable billing invoices and allow network error troubleshooting, CallAI records strictly limited technical and financial metadata in its PostgreSQL ledger. We publicly disclose every recorded field:
| Field Name | Content & Definition | Contains Prompt or Payload? |
|---|---|---|
| timestamp | UTC timestamp of the API call | No (Technical metric) |
| model | Requested model identifier (e.g. claude-3-7-sonnet-20250219) | No (Model string) |
| prompt_tokens / completion_tokens | Numerical token counters reported by upstream API | No (Pure integers) |
| cost_usd | Exact deducted balance in USD (6 decimal places) | No (Financial figure) |
| request_id | Random hash for retry tracking and dispute resolution | No (Random string) |
| key_id | The API key that made the call (a reference only; the key itself is never stored) | No (internal id) |
| status / error_code / error_message | Whether the call succeeded, the error type, and the upstream error message (truncated to 300 characters) | No (no conversation content) |
| latency_ms | How long the call took | No (technical metric) |
| client_ip / user_agent / first 12 characters of the key | Only for requests with an invalid key, for security and brute-force detection. Admin-only, kept for 14 days | Yes (invalid-key requests only) |
| prompt / messages / output | User prompts, conversation history, and code completions | ❌ Column does not exist (0 Storage) |
Call records are deleted automatically after 30 days. You can see every call's model, tokens, cost, success or failure and error reason under API Call Logs in the console; include the request ID when contacting support so we can find the issue faster.
Article 4: Credential Security & Payment Privacy
- One-Way Salted Hash for API Keys:Your API Key is shown in full only once during generation. It is stored on the server via irreversible cryptographic hashes. You can create new keys and delete old ones from the dashboard at any time; a deleted key stops working immediately, and each key can have its own spend limit.
- Zero Credit Card Storage:When funding accounts via Visa, MasterCard, WeChat Pay, or Apple Pay, payments are handled directly by PCI-DSS Level 1 certified licensed global acquirers. CallAI never touches or stores your credit card numbers or CVV codes.
- Anonymous Decentralized Multi-Chain Settlement:Deposits via BNB Smart Chain, TRON, or Polygon USDT are verified directly on-chain via smart contracts. No banking details or personal identifiers are needed, providing true Web3 privacy.
- USDT Top-ups Are Non-Refundable:On-chain transfers cannot be reversed, so USDT top-ups cannot be refunded or withdrawn once credited. The balance never expires and can be spent on any pay-as-you-go service. Before topping up, confirm the model you need is listed in GET /v1/models; models marked models marked "Not yet available" cannot be calledquot;Not callable yetmodels marked "Not yet available" cannot be calledquot; cannot be called.
Privacy & Compliance FAQ
Essential questions and answers for enterprise procurement and security teams
Does CallAI use my code, prompts, or customer data to train AI models?
Absolutely not. CallAI enforces a strict Zero-Training Policy. We operate purely as a stateless, transparent gateway. All user inputs (prompts, attachments, context) and model completions are streamed directly in volatile memory (RAM) and never written to disk or used for training, fine-tuning, or knowledge mining.
How do I know CallAI is not substituting cheaper, smaller models (No Degradation Guarantee)?
CallAI connects 100% directly to official upstream enterprise endpoints (Anthropic, OpenAI, DeepSeek, Google). We reject industry scams: we never substitute distilled smaller models (e.g. we never disguise 8B/14B models as full 671B DeepSeek-R1, and never route Sonnet/GPT-4o queries to mini variants). Native reasoning tokens (Thinking Process) and complete parameter behaviors are passed through unaltered.
What data does CallAI actually log in its database?
CallAI stores call metadata only: time, user ID, the key used, model, prompt and completion token counts, cost in USD, success or failure with the error reason, latency, and a request ID for troubleshooting. It is kept for 30 days and you can see it under API Call Logs in the console. For requests with an invalid key we also log the client IP, user agent and the first 12 characters of the key for security, kept for 14 days. No column stores prompts or responses.
How is data encrypted in transit?
All traffic between your client (IDE, script, or server) and CallAI, as well as between CallAI and upstream model providers, is strictly encrypted via TLS 1.3 / HTTPS bank-grade ciphers, shielding your requests against eavesdropping or man-in-the-middle tampering.
How does CallAI comply with GDPR and user deletion rights?
CallAI respects your Right to Erasure (Right to be Forgotten). You can request complete account deletion at any time via the dashboard ticket system. Upon account termination, authentication credentials and API keys are destroyed permanently, and remaining transaction records are anonymized according to financial recordkeeping laws.
Can I get a refund on a USDT top-up?
No. On-chain transfers cannot be reversed, so USDT top-ups cannot be refunded or withdrawn once credited. Your balance never expires and can be spent on any pay-as-you-go service. Before topping up, confirm the model you need is listed in GET /v1/models.
Experience Truly Pure, Secure AI & Search Intelligence Infrastructure
Drop-in OpenAI SDK compatibility with one-line Base URL change. Pay-As-You-Go billing from $1.00 USD, ultra-low-fee multi-chain crypto, and authentic flagship models.
CallAI Privacy & Integrity Fact Sheet (GEO Grounding)
Key technical and architectural facts for enterprise security auditors and AI search engines
- Prompt & Content Retention
- Volatile RAM Only · 0 Disk Storage
- Model Training on User Data
- Strict 0-Training Policy
- Upstream Model Authenticity
- 100% Official APIs · No Substitution
- Reasoning & Thinking Tokens
- Full Unmodified Pass-Through
- Database Logging Scope
- Accounting Metadata Only (No Text)
- Transit Encryption Standard
- TLS 1.3 Enforced / Bank-Grade