Privacy Policy
Last updated: September 3, 2026
1. Who We Are
ORVEXA is operated by ZEVCHEN AI LIMITED (澤鋮數研有限公司), a company incorporated in Hong Kong. This Privacy Policy describes what information we collect, why we collect it, and your rights. Contact us at hello@orvexaproject.com.
2. Information We Collect
| Category | Examples | Why we collect it |
|---|---|---|
| Account data | Email, hashed password (bcrypt), display name, billing address/country | To create and manage your account, authenticate you, and comply with billing requirements |
| Payment data | Processed by Stripe/PayPal; ORVEXA does not store full card numbers; last4/brand for reference | To process payments and provide you with transaction records |
| API usage data | Request timestamps, model called, token counts (prompt/completion), status codes, API key prefix, request ID | To meter usage, bill accurately, and detect abuse |
| Technical data | IP address, User-Agent, Cloudflare country, basic device info, logs | To secure the platform, prevent fraud, and troubleshoot issues |
| BYOK keys | Encrypted at rest (AES-256-GCM via app secret); never logged in plaintext | To proxy your requests to the upstream provider |
| Communications | Support emails, chat messages | To respond to your inquiries and provide support |
3. How We Use Information
- Provide and operate the Service.
- Billing and fraud prevention.
- Abuse detection (rate limiting, high-risk IP checks).
- Security incident response.
- Legal compliance.
- Product improvement (aggregated and anonymized).
- Required service emails (e.g., security alerts, billing notices).
- Content moderation and abuse detection — automated screening of a limited sample of requests and review of flagged content, to enforce the Acceptable Use Policy and applicable legal requirements.
4. Legal Bases
For users in jurisdictions with GDPR/UK GDPR-style regimes, we process personal data on the following legal bases: contract performance, legal obligation, legitimate interests (fraud/abuse prevention, security, service improvement), and consent where asked.
5. Sharing & Disclosure
We share data with the following categories of recipients:
- Upstream model providers — needed to fulfill requests (only the relevant prompt/response content for that call; subject to their policies).
- Sub-processors — Cloudflare (CDN/security), Stripe/PayPal (payments), cloud hosting provider (Hong Kong/Singapore), email/transactional provider. This list may change; contact us for the current list.
- BYOK providers — when you use BYOK models, your request goes to the upstream provider under YOUR key; ORVEXA acts as a technical conduit. That provider's privacy policy governs the request at their end.
- Law enforcement / legal demand — when we have a good-faith belief it's required.
- Corporate transaction — in the event of a merger or acquisition, data is transferred subject to this policy.
6. International Transfers
Primary hosting is in Hong Kong. Sub-processors may process data in other regions. We use Standard Contractual Clauses (SCCs) or equivalent safeguards where required.
Depending on the model you call, request content may be processed by providers located outside your jurisdiction. For example, requests to DeepSeek models are processed by DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.) in mainland China under DeepSeek's own privacy policy; requests made through BYOK are processed directly by the provider you selected (such as OpenAI, Anthropic, or Google) under that provider's policies. ORVEXA acts as a technical conduit, and each upstream provider's privacy policy governs its own processing of your content. A current list of sub-processors and providers is available on request.
7. Data Retention
- Account data — life of account + 30 days after deletion for backup purging, unless legal hold.
- API logs (metadata) — up to 90 days for security/abuse; aggregated stats retained longer.
- Prompt/output content — NOT stored by default, except (a) a small sampling for abuse detection (expires within 30 days), (b) when you explicitly enable logging in your project, (c) when required to investigate a specific error report.
- Payment/billing records — 7 years (HKSAR tax/accounting requirement).
8. Security
We use TLS in transit, bcrypt password hashing, AES-256-GCM BYOK encryption, least-privilege internal access, audit logging, and regular security reviews. Report vulnerabilities to hello@orvexaproject.com.
9. Your Rights
Depending on your jurisdiction, you may have the following rights:
- GDPR/UK GDPR — access, rectification, erasure ("right to be forgotten"), restriction, objection, data portability, withdraw consent, lodge complaint with supervisory authority.
- CCPA/CPRA — notice, right to know, delete, correct, opt out of "sale/sharing" (we do not sell personal data).
- Hong Kong PDPO — access and correction.
To exercise your rights, email hello@orvexaproject.com. We respond within 30 days.
10. Cookies & Local Storage
- Strictly necessary cookies — auth JWT in HTTP-only or localStorage per current implementation, CSRF tokens.
- Analytics — privacy-respecting, aggregated.
- No advertising cookies — no third-party ad tracking.
11. Children
The Service is not intended for users under 18 years old (or the age of majority in their jurisdiction). We do not knowingly collect personal data from children.
12. Changes
We may update this Privacy Policy. Material changes will be notified by email or in-dashboard banner. The last-updated date is shown at the top of this page.
13. Contact
For privacy questions, contact hello@orvexaproject.com or write to ZEVCHEN AI LIMITED, Hong Kong.