Qingyun TOP API International Privacy Policy

Last Updated: August 3, 2026
Effective Date: August 3, 2026

Welcome to Qingyun TOP API International.

Qingyun TOP API International is currently maintained and operated outside Mainland China through a collaborative team known as the Qingyun TOP API International Team (the "Operating Team," "we," "us," or "Platform"). This Privacy Policy (the "Policy") explains how information relating to an identified or identifiable individual is processed when you visit our website, register an account, use the dashboard, call an API, fund an account, receive billing, contact support, or use another related feature (collectively, the "Service").

The Qingyun TOP API International Team is the public name of an unincorporated operating team. It does not represent itself as a company, legal person, registered partnership, or other separate-liability entity. Nothing in this Policy displaces a legal requirement to identify the actual payment recipient, data controller, address for service, or another responsible party through a legal notice, payment page, transaction record, or another appropriate disclosure. The Operating Team name must not be used to conceal information that applicable law requires to be disclosed.

Please read this Policy before using the Service. This Policy principally provides notice and does not treat your general "acceptance" of a privacy policy as the sole lawful basis for every processing activity. Where applicable law requires separate consent, a cookie choice, transfer authorisation, or another procedure, we will provide an appropriate mechanism. If you do not accept processing necessary to provide the Service, do not use the Service.

1. Scope and Geographic Position

1.1 Scope

This Policy applies to the Platform's website, dashboard, APIs, SDKs, documentation, accounts, billing, funding, support, and related features. A feature-specific privacy notice applies together with this Policy. If they conflict regarding that feature, the more specific notice controls.

This Policy does not govern processing independently determined by a third-party model provider, payment provider, identity provider, or external website. That party's own privacy policy applies to its processing.

1.2 Mainland China Restriction

The Service is not offered to an individual located in, ordinarily resident in, or accessing the Service from Mainland China, or to an organisation established or principally operating there. To enforce this restriction and prevent circumvention, we may process geographic and risk signals such as IP address, device information, payment source, login behaviour, and account relationships.

Internet geolocation can be inaccurate. A failure to identify your true location does not authorise access from Mainland China or waive the geographic restriction. You may request review through the channels in this Policy.

"Mainland China" means the mainland territory of the People's Republic of China and excludes Hong Kong SAR, Macao SAR, and Taiwan.

1.3 Operations Outside Mainland China

The Service's servers, day-to-day management, user-facing service arrangements, and material operational activities are maintained outside Mainland China. Information may be processed by providers in different countries or territories as described in Section 6.

2. Information We Process

We follow purpose limitation, data minimisation, and storage-limitation principles and process only information reasonably necessary to provide and protect the Service.

2.1 Information You Provide

When you register, verify, fund an account, request a bill, submit a support ticket, make a complaint, or contact us, you may provide:

  • account details, such as username, email address, phone number, and verification status;
  • authentication information, such as a password hash, verification status, API-credential identifier, and key status;
  • identity or organisation details, such as name, organisation, role, registration information, and verification documents;
  • contact and billing details, such as email, phone number, billing address, and tax or invoice information;
  • support and dispute material, such as issue descriptions, emails, tickets, screenshots, request IDs, log summaries, and content you choose to attach; and
  • other information you choose to provide.

Do not submit API request bodies, model responses, passwords, private keys, complete payment-card data, or sensitive personal data to support unless directly necessary for the issue.

2.2 Service-Usage and Technical Information

When you access or use the Service, we may automatically record:

  • account, project, plan, and API-credential identifiers;
  • login time, request time, request ID, model, and endpoint;
  • request count, token count, status, error code, latency, retry, and charge;
  • account funding, charges, balance, orders, refunds, invoices, and payment status;
  • IP address, approximate location, device type, browser, operating system, language, and time zone;
  • session, security, and activity logs, and identifiers produced by cookies or similar technologies; and
  • risk signals relating to unusual login, proxies, geographic risk, abuse, fraud, rate limits, and account restrictions.

Except where necessary for authentication or voluntarily provided by you, we generally do not log complete plaintext passwords, complete API keys, or complete payment-card data. Payment-card information is normally processed directly by a payment provider. We may receive limited data such as a transaction ID, payment status, card brand, or last digits.

2.3 Information from Third Parties

We may receive necessary information from:

  • OAuth, single-sign-on, or identity providers, including account identifiers and verification results;
  • payment providers, including transaction, refund, chargeback, risk, and settlement information;
  • cloud, CDN, security, and anti-fraud services, including device, network, and risk signals;
  • model and API providers, including metering, status, errors, and request-correlation information; and
  • complainants, rights holders, or competent authorities acting lawfully.

3. API Request and Model-Response Bodies

3.1 No Routine Persistence of Bodies

In the ordinary course of the Service, the Platform transiently processes API request bodies and model-response bodies only to perform real-time routing and return a response. It does not routinely persist those bodies as business records in the Platform's database. After a request is completed, the Platform generally does not provide a feature to search, restore, or download those bodies.

"Non-persistence" does not mean that information never passes through Platform systems and does not cover:

  • unavoidable temporary copies created by network transmission, load balancing, memory processing, short-lived caching, crash dumps, or security devices;
  • content that you voluntarily submit through support, email, complaints, tickets, or dispute channels;
  • information lawfully isolated to the minimum extent necessary to investigate a specific security incident, serious abuse, malfunction, or billing dispute; or
  • information that applicable law or a valid order of a competent authority expressly requires us to preserve.

Where exceptional retention occurs, access will be restricted and the information will be deleted or anonymised within a reasonable period after its purpose is fulfilled, unless applicable law requires otherwise.

3.2 Real-Time Forwarding Is Necessary

To complete an API call, request bodies, attachments, parameters, and necessary technical information must be transmitted in real time to the third-party model or API provider selected by you or by the Platform's routing logic. The third-party response must also pass through the Platform to be returned to you. This is an unavoidable part of a technical relay service.

3.3 Upstream Providers May Retain Data

A third-party model, API, or channel provider may conduct safety review, logging, retention, service improvement, or model training under its own terms, privacy policy, configuration, and applicable law. The Platform cannot promise on a third party's behalf that it will never retain or use request or response content.

You must assess a provider's policies and settings before use. If you cannot accept the relevant third-party processing, do not submit data through the Service.

3.4 Limits of Content Review

Because of automated routing, service scale, and technical limitations, we generally do not manually read or determine the meaning, truth, or legality of every request and response and have no general monitoring obligation. We may nevertheless use automated detection, metadata analysis, rate limits, and other reasonable measures for safety, abuse prevention, and legal compliance.

A request being forwarded, a model returning a response, or the absence of a detected risk does not constitute permission, certification, endorsement, or compliance approval.

4. Sources, Purposes, and Lawful Bases

4.1 Providing and Performing the Service

We may process necessary information to:

  • create, verify, and maintain an account;
  • provide the dashboard, API authentication, routing, and model calls;
  • process funding, charges, balances, orders, refunds, and billing;
  • provide support, troubleshooting, and dispute resolution; and
  • send service, transaction, security, and policy notices.

Where recognised by applicable law, this processing may be necessary to perform a contract with you or take steps at your request before entering a contract.

4.2 Safety, Risk Control, and Legitimate Interests

To protect users, the Platform, and third parties, we may:

  • detect account compromise, fraud, refund abuse, attacks, artificial traffic, and misuse;
  • enforce geographic, sanctions, export-control, rate-limit, and acceptable-use rules;
  • verify billing, troubleshoot failures, investigate security incidents, and handle complaints; and
  • establish, exercise, or defend legal claims.

Where recognised by applicable law, this processing may rely on the legitimate interests of the Platform or a third party, balanced against your rights and reasonable expectations.

4.3 Analytics and Improvement

We may use aggregated, de-identified, or body-free usage metadata to analyse performance, capacity, error rates, model availability, and feature use and to improve reliability, documentation, and user experience.

Unless you separately and expressly consent, the Platform will not use API request bodies or model-response bodies to train its own general-purpose model.

Where applicable law requires, we may rely on your consent for non-essential cookies, marketing communications, or specific processing and allow you to withdraw consent. Withdrawal does not affect the lawfulness of earlier processing.

We may also process necessary information to comply with tax, payment, sanctions, court, regulatory, data-protection, and other applicable legal obligations.

5. Disclosure, Sharing, and Sale

5.1 We Do Not Sell Personal Data

We do not sell personal data to unrelated third parties and do not share personal data for cross-context behavioural advertising. If this practice materially changes, we will update this Policy before implementing the change and provide notice and choice as required by law.

5.2 Service Providers

We may disclose minimum necessary information to:

  • model, API, channel, and technical-routing providers;
  • cloud, hosting, CDN, network, and security providers;
  • payment, settlement, anti-fraud, and billing providers;
  • authentication, email, messaging, support, and ticketing providers;
  • logging, monitoring, error-analysis, and performance providers; and
  • professional advisers, auditors, and legal-service providers.

Depending on applicable law and the actual relationship, we will use contracts, access controls, and other reasonable measures to limit processing to agreed purposes.

5.3 Law, Safety, and Protection of Rights

We may disclose minimum necessary information to:

  • comply with applicable law or a valid lawful request from a competent authority;
  • prevent imminent bodily harm, material fraud, or a serious security incident;
  • investigate a violation of the Terms, infringement, attack, chargeback, or abuse;
  • establish, exercise, or defend legal rights; or
  • follow your instruction or other valid authorisation.

To the extent permitted by law, we will assess the validity, authority, and scope of a request and will not disclose data merely because of an unsupported demand.

5.4 Internal Team Access

Only Operating Team members and authorised personnel who require access for operations, support, safety, billing, or compliance may access relevant information. They must follow least-privilege, confidentiality, and security requirements.

6. Third-Party Models, Processing Locations, and International Transfers

6.1 Processing Locations

The Platform's principal operational infrastructure and material operational activities are located outside Mainland China. Depending on the selected model, routing, cloud provider, payment method, and your location, information may be processed in different countries or territories.

6.2 International Transfers

The Service's core function requires requests and necessary technical information to be transmitted to third parties that may be in another country or territory. Data-protection, security, government-access, and redress rules in the receiving location may differ from those in your location.

Where applicable law requires, we will use reasonable transfer measures such as contractual protection, data-processing terms, risk assessments, consent, or another recognised mechanism. The Platform cannot perform obligations that you independently owe as a controller, business customer, or data provider.

6.3 Your Responsibility for Third-Party Data

If you submit another person's personal data, confidential information, or restricted data, you must ensure that:

  • you have a lawful basis and necessary authority;
  • you have provided required privacy notices and obtained necessary consent;
  • you have completed applicable transfer assessments, contracts, or procedures; and
  • the selected model and configuration meet your industry, confidentiality, and security requirements.

6.4 High-Risk Data You Should Not Submit

Unless the Platform and relevant provider expressly permit it and you have implemented all required safeguards, do not submit:

  • passwords, private keys, complete payment-card data, or high-risk authentication data;
  • state secrets, export-controlled material, or information prohibited from international transfer;
  • unauthorised health, biometric, precise-location, children's, or other sensitive personal data; or
  • unauthorised trade secrets, confidential material, or protected third-party content.

7. Retention, Deletion, and Anonymisation

7.1 Retention Principles

We determine retention based on purpose, account status, disputes, security risk, and applicable law. We do not retain personal data indefinitely without a reasonable purpose.

7.2 Retention by Category

  • API request and response bodies: not routinely persisted as business records, subject to the transient processing and exceptions in Section 3;
  • call, metering, and usage metadata: generally six months;
  • account and authentication information: while the account remains open and for a reasonable period required for security, closure, and disputes;
  • orders, payments, refunds, billing, and tax records: for periods required by payment, accounting, tax, anti-money-laundering, or other applicable law, which may exceed six months;
  • security, risk-control, and abuse records: generally six months, with extensions where necessary for an incident, restriction, dispute, or legal process;
  • support, complaint, and rights-request records: for the period required to resolve and document the matter and comply with law; and
  • cookies: under cookie settings, the relevant page notice, or Section 8.

7.3 Deletion and Anonymisation

When a purpose is complete, we will delete, anonymise, de-identify, or securely archive information as appropriate to our systems and applicable law. Deletion from backups, copies, or third-party systems may require a reasonable period. Further use will be restricted while deletion is pending, unless law requires otherwise.

7.4 Account Closure

After account closure, we stop processing unrelated to continuing service but may retain information necessary for financial, tax, security, dispute, and other legal obligations. Account closure does not guarantee deletion by an independent model provider. You should exercise rights with that provider under its policy.

8. Cookies and Similar Technologies

8.1 How We Use Them

We may use cookies, local storage, session identifiers, and similar technologies to:

  • maintain login, authentication, and session security;
  • remember language, interface, and feature preferences;
  • prevent fraud, attacks, and abnormal access; and
  • measure page performance, errors, and feature use.

8.2 Your Choices

Strictly necessary cookies support login, security, and core functionality. Where applicable law requires, we will offer a choice or obtain consent for analytics, preference, or other non-essential cookies. You may manage technologies through cookie settings or your browser, but disabling necessary cookies may make features unavailable.

We do not use cookies for cross-context behavioural advertising unless this Policy is updated and clear notice and choice are provided as required by law.

9. Security and Incident Response

9.1 Security Measures

We will use reasonable technical and organisational measures appropriate to the Service and its risks, such as:

  • encryption in transit and appropriate storage protection;
  • access controls, least privilege, and authentication;
  • API-credential protection, key rotation, and rate limits;
  • security monitoring, anomaly alerts, audits, and vulnerability remediation;
  • backup, recovery, and incident-response measures; and
  • confidentiality and security requirements for authorised personnel.

These measures do not guarantee absolute security. Internet transmission, software, and third-party systems all involve risk.

9.2 Your Security Responsibilities

You must protect accounts, passwords, API keys, tokens, devices, and permissions, limit credential scope and quota, and immediately rotate credentials and contact us if you discover disclosure or abnormal requests.

9.3 Data Incidents

If a security incident affects personal data, we will take reasonable steps to contain, investigate, and remediate it and will notify affected individuals and competent regulators where required by law. The content, method, and timing of notice will depend on risk, available information, and legal requirements.

10. Your Data Rights

Depending on your location and applicable law, you may have a right to:

  • confirm whether we process your personal data and receive a copy;
  • correct inaccurate or incomplete information;
  • request deletion;
  • restrict or object to specific processing;
  • obtain data in a structured, commonly used, machine-readable format or request a feasible transfer;
  • withdraw consent;
  • object to direct marketing;
  • request review of an automated decision or the handling of a rights request; and
  • complain to a competent data-protection authority.

10.1 Submitting a Request

You may submit a request through Section 15 and identify your account, request type, and necessary scope. To protect accounts and others, we may reasonably verify your identity and authority. Do not send an original identity document or unrelated sensitive information with an initial request.

10.2 Limits on Requests

We will respond within the period required by applicable law. We may lawfully limit or deny a request that is manifestly unfounded, excessive, repetitive, harmful to another person's rights, unsafe, or inconsistent with a legal retention obligation and will explain where required.

10.3 Authorised Agents

Where applicable law permits an agent to submit a request, we may require valid authority and identity-verification information.

11. Children

The Service is intended only for users aged 18 or older and lawful organisations. A person under 18 must not register, fund an account, or call the Service.

If we learn that children's personal data may have been collected without an appropriate lawful basis, we will take reasonable steps to restrict the account and delete the information, except where necessary for safety, investigation, or legal obligations. A parent or guardian may contact us through Section 15.

12. Automated Risk Controls and Location Decisions

We may use automated rules and risk signals to identify abnormal logins, fraud, attacks, geographic circumvention, abuse, sanctions risk, and violations of the Terms. Processing may result in verification challenges, rate limits, blocked requests, disabled credentials, account suspension, or human review.

Except for decisions necessary for security and access control, we do not rely solely on automated processing to make a decision that produces legal or similarly significant effects, unless applicable law permits it and required safeguards are provided. You may request human review of a suspected error.

Automated risk models may use account, IP, device, payment, login, request-volume, error, proxy, and account-relationship information but do not ordinarily rely on routinely retained API request or response bodies.

The Platform may link to or integrate an external website, model, payment tool, or service. Processing independently determined by that third party is subject to its policy. We do not control or guarantee an independent third party's privacy practices. Review its policy before use.

13.2 Transfer or Reorganisation

Members of the Operating Team may later establish or designate a duly formed entity to take over the Service. In an asset transfer, business migration, reorganisation, or service transfer, personal data may be transferred to the successor after applicable notice, confidentiality, and security requirements are met.

We will identify the successor's legal name, contact information, transfer date, and material changes affecting your rights and obtain consent where law requires. The successor must continue to follow this Policy or provide a replacement policy meeting applicable legal standards.

14. Changes to This Policy

We may update this Policy because of changes to the Service, technology, law, providers, or operations. We will post the updated version and effective date. A material change to processing purposes, data categories, recipients, or user rights will be prominently communicated through the website, dashboard, email, or another reasonable method.

Where law requires consent, we will separately obtain it and will not rely only on continued use as consent. If you do not accept processing necessary under the updated Policy, stop using the Service and close your account.

15. Contact, Complaints, and Required Disclosures

Questions about this Policy, data processing, security incidents, or rights requests may be submitted through:

  • Online support: sign in and select "Contact Us";
  • Email: qingyuntop@126.com; and
  • Public operating name: Qingyun TOP API International Team.

Use the subject "Privacy Request" and avoid sending unrelated sensitive information.

Where applicable law requires identification of a specific controller, joint controller, representative, DPO, payment recipient, address for service, or regulator, the Platform will provide the information through a legal notice, payment page, transaction record, or another appropriate method. That disclosure does not mean that the Operating Team itself has corporate or separate legal personality.

You may also complain to a data-protection or privacy regulator with lawful jurisdiction over the relevant processing. Because this Policy does not identify a specific data controller or jurisdiction, it may not satisfy all transparency requirements in some regions. Until required disclosures are completed, the Platform should not actively offer the Service in a region that requires them.