Minara Cloud Privacy Policy

Effective Date: 12 September 2026 Last Updated: 12 September 2026

This Privacy Policy explains how Minara Cloud ("we," "us," or "our") handles personal information in connection with our websites at cloud.minara.ai and minara.cloud, API gateway, developer console, billing services, and related features (the "Service").

Privacy Contact: [email protected]

Google User Data (Sign in with Google)

Minara Cloud offers "Sign in with Google" as an optional way to create and access a Minara Cloud account. This section explains exactly what Google user data we access, how we use, store, share, and delete it. This section governs Google user data and takes precedence over any conflicting provision elsewhere in this Policy.

Data We Access

When you choose to sign in with Google, Minara Cloud requests only the following OAuth scopes: openid, email, and profile. Through these scopes we receive:

• Your Google account identifier (a unique user ID);
• Your email address and whether it has been verified by Google;
• Your name and profile picture URL, as made available in your Google profile.

Minara Cloud does not request access to your Gmail, Google Drive, Google Calendar, Google Contacts, or any other Google service data.

How We Use Google User Data

We use this data solely to:

• Create your Minara Cloud account and authenticate you when you sign in;
• Display your name and profile picture in the Minara Cloud console;
• Send you essential service, security, and billing notices to your verified email address.

We do not use Google user data for advertising, marketing profiles, credit decisions, or resale, and we do not use it to develop, train, or improve any artificial intelligence or machine learning model, whether in raw, aggregated, or anonymized form.

Sharing of Google User Data

We do not sell Google user data. We do not share it with third parties, except with infrastructure providers that host and operate the Service on our behalf under confidentiality obligations, or where disclosure is required by law. Google user data is never sent to upstream AI model providers.

Storage, Retention, and Deletion

Google user data is stored encrypted in transit and at rest and is accessible only to authorized personnel who need it to operate the Service. We keep it for as long as your Minara Cloud account is active. If you delete your account, we delete the associated Google user data, except where we are required by law to retain specific records.

You can revoke Minara Cloud's access at any time at myaccount.google.com/permissions, and you can request deletion of your account and associated data by emailing [email protected].

Limited Use Disclosure

Minara Cloud's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Prohibited Content

Minara Cloud does not use Google APIs or Google user data to generate images or any other content. Users of the Service may not use it to create, distribute, or facilitate non-consensual intimate imagery (NCII), including AI-generated NCII, sexual content involving minors, or any other illegal content. Accounts that violate this rule are suspended.

1. Our Role

We determine how personal information is used to operate accounts, administer billing, protect the Service, and communicate with customers. For these activities, we act as a controller or equivalent responsible business under applicable privacy law.

When an organization submits personal information through the API for processing on its behalf, we may act as its processor or service provider, subject to the applicable contract and actual processing arrangement. The organization is responsible for providing its own privacy notices and determining the lawful basis for its use of that information.

If your information was submitted by one of our customers, contact that customer first about requests relating to its application. We will assist the customer as required by our contract and applicable law.

2. Information We Process

Account and Authentication Information

We process information used to create and administer your account, such as your account identifier, email address, profile information, authentication information, and account preferences.

If you sign in through the shared Minara Cloud account system or another supported identity provider, we receive the information that provider makes available for the authorized sign-in, such as an account identifier, email address, or profile details. The exact information depends on the integration and permissions you grant. Signing in does not, by itself, authorize access to unrelated information held by the identity provider.

API Content

We process prompts, messages, files, images, audio, video, tool inputs, metadata, and other content you include in requests, together with the resulting responses, to the extent supported by the feature you use. This information may contain personal information about you or other people.

Minara Cloud processes API request and response bodies transiently to route requests and return results. We do not retain those bodies after processing. Usage and billing metadata are handled separately, as described below and in Section 7.

Usage, Billing, and Transaction Information

We process records such as selected models, request identifiers, timestamps, token or other usage counts, response times, request status, charges, account balances, recharge amounts, promotional credits, and transaction identifiers.

Payment providers process payment information needed to complete transactions. We receive payment confirmations and information needed for billing, refunds, fraud prevention, or reconciliation. We may receive transaction references, payment status, and limited payment-method details made available by the selected provider. The precise fields depend on the payment method.

Device, Network, and Security Information

Depending on the feature and security configuration, we process IP addresses, browser or client information, session identifiers, authentication events, and diagnostic information. This helps us maintain sessions, investigate failures, prevent abuse, and protect accounts.

Communications

We process information you provide when contacting support, reporting a problem, responding to a survey, or otherwise communicating with us. Support submissions may include request identifiers, attachments, or content you choose to share.

3. Why We Use Information

We use personal information to:

• Create accounts, authenticate users, and maintain sessions.
• Route API requests, obtain responses, and provide requested features.
• Measure usage, calculate charges, apply credits, and administer payments or refunds.
• Diagnose errors, support users, and improve the reliability and usability of the Service.
• Detect fraud, prevent abuse, investigate security incidents, and enforce applicable service restrictions.
• Send service notices, transaction updates, and other necessary account communications.
• Send optional marketing communications where permitted, subject to your preferences and applicable consent requirements.
• Meet legal obligations, maintain required records, and establish or defend legal claims.

We do not use Customer Content for model training. Operational analysis of usage and billing metadata is separate from training on the content of API requests and responses.

4. Customer Content and Model Training

Requests are sent to the Upstream Providers necessary to provide the selected model or routing feature. Those providers process content to generate responses and may conduct additional processing under their applicable contractual terms, including security or abuse monitoring.

Minara Cloud does not use Customer Content, including prompts, uploaded content, or model outputs, to train or fine-tune AI models. This commitment applies even if that content could be anonymized or aggregated; anonymization does not create an exception to our no-training policy.

Our commitments concerning Minara Cloud's own content retention and training practices do not automatically determine every Upstream Provider's practices. Provider retention, security monitoring, training restrictions, and regional processing may vary by integration and contract. Provider-specific disclosures will identify material differences for the integrations offered. Do not assume that all integrations offer zero retention or a no-training commitment.

For information about the data-handling terms applicable to a particular integration, contact [email protected] before submitting content that requires specific protections.

5. Legal Bases Where Required

Where applicable law requires a legal basis, we rely on:

• Performance of a contract: to provide an individual customer's account, requested features, billing, and support.
• Legitimate interests: to administer business customer relationships, maintain service reliability, prevent fraud, and protect systems, where these interests are not overridden by the individual's rights. These interests include operating a secure service and resolving technical problems.
• Legal obligations: to maintain required financial records and respond to lawful requirements.
• Consent: where required for optional cookies, marketing, or other optional processing.

Where we act as a processor, the customer determines the relevant legal basis and provides processing instructions. Withdrawing consent does not affect the lawfulness of processing performed before withdrawal.

Providing information necessary for authentication, processing, or payment may be required to use the corresponding feature. If you do not provide it, we may be unable to provide that feature. Optional processing is identified as optional.

6. When We Share Information

We share information where necessary with the following recipients:

• Upstream AI providers and delivery partners: to process requests and return results. Routing, retries, and fallback features may involve more than one recipient.
• Infrastructure and operational providers: including hosting, storage, networking, security, monitoring, and support providers that help operate the Service.
• Payment providers: to process purchases, administer refunds, and detect payment fraud.
• Identity providers: to facilitate sign-in when you choose their authentication method.
• Your organization: where you use an organization-managed account, authorized administrators may access information available through the organization's account controls.
• Professional advisers and authorities: where reasonably necessary for legal advice, compliance with law, protection of rights, or handling a dispute.
• Parties to a business transaction: where a merger, financing, acquisition, or asset transfer involves the Service, subject to applicable confidentiality and legal requirements.

Where a recipient processes information on our behalf, we require appropriate contractual protections. Some recipients, such as certain payment or identity providers, may act as independent controllers for their own activities.

We do not sell your personal information. Any use of information for advertising-related sharing or targeted advertising will be subject to the disclosures, choices, and consents required by applicable law.

7. Retention and Deletion

Except for API request and response bodies, which we do not retain after processing, we retain personal information for the period necessary for its stated purpose, subject to applicable legal requirements. Relevant factors include whether an account remains active, the nature of the feature, billing and tax obligations, fraud prevention needs, dispute periods, and backup cycles.

Account information is retained while needed to operate your account and, after closure, only for applicable legal, security, and dispute-resolution purposes. Usage and transaction records are retained to calculate charges, reconcile payments, investigate errors or abuse, meet applicable record-keeping duties, and resolve disputes. Support records are retained while needed to respond to the issue and document its resolution.

Minara Cloud does not persist API request or response bodies in content logs, diagnostic records, caches, or backups. Transient processing and buffering necessary to transmit a request or return its response do not constitute retention after processing. We may retain operational metadata, such as model names, request identifiers, timestamps, usage counts, request status, and charges, without retaining the request or response body.

Content you separately choose to send to our support team is handled as a support communication, not as a retained API body. Backup retention applies only to information we otherwise retain, such as account, transaction, and support records; it does not create an exception to the API-body non-retention commitment.

When information is no longer needed, we delete it or irreversibly anonymize it. We may retain particular records longer where required by law or necessary for an identified dispute or security investigation. Closing an account does not require us to delete records we must lawfully retain.

Upstream Providers' retention is governed by their applicable arrangements. We will assist with deletion requests where required and within our contractual and technical control.

8. Cookies and Similar Technologies

The Service uses cookies or similar storage for functions such as authentication, security, session continuity, and preferences. Because cloud.minara.ai and minara.cloud are separate domains, their browser storage and sign-in sessions may be managed separately.

Optional analytics or other non-essential technologies, if used, must be identified in the applicable cookie disclosures, including their providers, purposes, and lifetimes.

Where required, optional technologies are activated only after consent. You may change optional preferences through the available consent controls and use browser controls to remove or block cookies. Blocking essential storage may prevent sign-in or other core features from working.

9. International Processing

The Service and its providers may process information in countries other than the country where you live. Processing locations depend on the infrastructure and model integration used. Contact [email protected] for information about the locations relevant to your use. These countries may have different privacy laws.

Where a transfer requires safeguards, we will put the required safeguards in place before making that transfer. Depending on the applicable law and arrangement, this may involve an adequacy decision, approved contractual terms, or another lawful mechanism. You may request information about applicable safeguards at [email protected].

10. Security

We use measures designed to protect personal information against unauthorized access, disclosure, alteration, and loss. These include access restrictions, authentication controls, and safeguards for transmitting information.

No system can guarantee absolute security. Protect your credentials, limit access to API keys, and avoid placing secrets in prompts or support messages. Report suspected security issues to [email protected]. We will provide incident notifications where required by applicable law or contract.

11. Your Rights and Choices

Depending on your location and the law that applies, you may have rights to request access to, correction of, deletion of, or a portable copy of your personal information; restrict or object to certain processing; withdraw consent; or opt out of certain data uses. These rights may be subject to lawful exceptions.

Contact [email protected] to make a request. We may ask for information reasonably necessary to verify your identity and authority. Authorized agents may submit requests where permitted by law. We will respond within the period required by applicable law and explain any refusal and available review or appeal process. We will not unlawfully discriminate against you for exercising a privacy right.

You can unsubscribe from optional marketing through the provided unsubscribe mechanism. Necessary service and billing notices may continue while you use the Service.

You may complain to the privacy regulator in your jurisdiction. Where a data protection officer or regional representative is required, their contact details will be provided with this Policy.

If your information is controlled by one of our customers, direct your request to that customer as described in Section 1.

12. Automated Processing

We use automated systems to route requests, measure usage, and support security and fraud detection. AI-generated responses are produced automatically in response to submitted content.

If an automated account restriction affects you, contact [email protected] to request review. If we implement solely automated decision-making with legal or similarly significant effects, we will provide the required information about its operation and consequences and the applicable review and challenge rights.

Our customers are responsible for explaining decisions they make through their own applications and for meeting their obligations to the people affected.

13. Children

The Service is intended for adults and is not directed to children under 18. If you believe a child has provided personal information directly to us, contact [email protected] so that we can investigate and take appropriate action.

Customers must not use the Service to process children's personal information unless they have established a lawful basis and appropriate safeguards and the use is expressly permitted under the applicable service arrangements.

14. Changes to This Policy

We may update this Privacy Policy as our practices, features, or legal obligations change. We will publish an updated effective date and provide additional notice of material changes where required.

If a new use requires consent or another legal step, we will complete that step before beginning the use. A policy update alone does not authorize processing that would otherwise be unlawful.

15. Contact Us

Privacy Requests: [email protected]
General Support: [email protected]