Privacy Policy

The personal data operator is BASIS AI SYSTEMS, BIN/IIN 950802301411, registered in the Republic of Kazakhstan, Almaty. The full legal name and contact details are provided in the “Operator details” section at the end of this Policy; other registration information is available on request.

Depending on the Service features you use, we may process the following categories of data:

• registration data — username or display name, email address, password stored as a cryptographic hash (we do not know your plain-text password);
• Balance and transaction data — current balance, history of top-ups (date, amount, payment method), history of deductions (Model identifier, token count, cost, time). The Service does not store bank-card details or other payment instrument data — they are processed directly by payment providers;
• Request content — the text of your messages sent to Models, attached files (images, documents), and Model responses. Stored within your Account until you delete them or close the Account;
• technical data — IP address, browser and device type, API request logs (Model identifier, token count, request time), session identifiers;
• referral data — the identifier of the User who invited you to the Service (if you registered via a referral link), the history of referral bonus accruals, aggregated amounts of top-ups by Users you have invited. Used to calculate the referral program tier, apply individual rates, and detect bad-faith conduct (multi-accounts, sham top-ups, other schemes manipulating referral activity);
• referral link data — when you visit the Service via a referral link with the ?aff= URL parameter, the Operator stores the inviter code so that the referral bonus is correctly attributed at registration;
• Telegram authentication data — if you choose to sign in via Telegram (Login Widget or Mini App), we receive from Telegram your Telegram account identifier (user_id), public @username, display name, avatar URL, and authentication metadata (auth_date, hash). This information is stored in encrypted form on the Service side for subsequent re-authentication;
• support correspondence — the content of your communication with support and its attachments. Support is available both via the web form and via the official Service technical support Telegram bot (@cheapai_support_bot). When contacting the bot we receive: your Telegram account ID, public @username, interface language, and the content of the messages you send (including attachments). Messages are forwarded to a closed operator group for subsequent reply. The correspondence content is not stored in the Service database — Telegram owns the message history; only reply-routing metadata remains on our side;
• marketing consent — during registration we ask for your consent to receive marketing email notifications (news, promotions, promo codes, Model catalog updates). Consent is enabled by default; you may withdraw it at any time via the unsubscribe link in any marketing email, by contacting support, or via a settings toggle in the dashboard (once the corresponding settings section becomes available). Opting out of marketing emails does not affect delivery of transactional and service notifications.

The Service is not intended for processing special-category data (medical, biometric, political and similar). Do not submit such data to the Service unless strictly necessary.

We process personal data solely for the purposes listed below:

• registration and authentication in the Service;
• providing access to Service functionality and proxying your requests to the selected Models;
• Balance accounting, top-up and deduction history, request-cost calculation;
• providing technical support, including via the official Service technical support Telegram bot;
• sending transactional and service notifications to the email address you provided (verification codes, password reset, payment receipts, changes to the offer, roadmap notices, critical technical alerts) — on the basis of contract performance;
• sending marketing notifications to the email address (news, promotions, Model catalog and plan updates) — solely subject to your consent expressed via the consent checkbox at registration, with the ability to unsubscribe at any time;
• protecting the Service and users from fraud, abuse and unauthorized access;
• compliance with the laws of the Republic of Kazakhstan, including tax law;
• anonymized analysis of Service usage to improve quality.

The legal bases for processing are:

• your consent given upon registration in the Service (Article 8 of the Law);
• performance of the offer agreement (Terms of Service) concluded between you and the Operator upon registration;
• compliance with obligations imposed on the Operator by the laws of the Republic of Kazakhstan (Article 9 of the Law), including tax law and anti-money-laundering law.

To provide the Service, some data may be disclosed to the following categories of recipients:

• Model Providers — the content of your Request (message text and attached files) and the identifier of the selected Model are transmitted to the Model’s Provider (Anthropic, OpenAI, Google and others) to execute the Request. The list of Models and their Providers is available at /models. Data processing on the Providers’ side is governed by their own policies;
• Search engines — when you enable the "Web search" feature (🌐 icon) in the chat playground, the content of your search query is transmitted to the selected model system (Anthropic web_search, Google Gemini Grounding) which then queries Google Search for open-source answers. Search results are returned to the model and then to you in the response. The Service does not keep a separate log of these search queries, but the request content becomes part of your regular chat history (see Section 2). The feature is disabled by default;
• Payment providers — payment details are transmitted to the payment provider you select to process Balance top-ups. Current providers: Lava.top (international Visa/Mastercard cards, PayPal) and FreeKassa (Russian bank cards, SBP, SberPay, USDT TRC20 and Bitcoin);
• Telegram — when you use Telegram Login Widget or Telegram Mini App, authentication data is transmitted to Telegram FZ-LLC for signature verification. Processing terms are published on the provider’s website;
• Cloud file storage — images, documents and other files attached to chat-playground conversations may be stored in Cloudflare R2 object storage (Cloudflare, Inc., USA). Files are stored encrypted on the server side for the period stated in Section 7;
• Email delivery service — to deliver verification codes and password-reset links, the Operator uses Resend (Resend Inc., USA). Your email address and email body (with the code kept out of the preview) are transmitted to Resend to the extent necessary for delivery;
• Hosting and infrastructure providers — data is stored and processed on the servers and object storage we use;
• Authorized government bodies — upon a duly justified request in accordance with the laws of the Republic of Kazakhstan.

We do not share your personal data for the advertising or marketing purposes of third parties and we do not sell it.

Model Providers and hosting providers may be located outside the Republic of Kazakhstan (including in the United States, the European Union and other jurisdictions). Transfers to such recipients are carried out in accordance with Article 16 of the Law and on the basis of the consent you gave at registration, to the extent necessary to execute the relevant Request.

The retention period depends on the data category:

• registration data — for the period the Account is active and up to 30 (thirty) calendar days after its deletion;
• Request history and attached files — until you delete them or close the Account; after Account deletion, the data is removed automatically;
• Chat playground history (/chat) — until you delete it via the dashboard. Message content is encrypted at the application level (AES-256-GCM, encryption at rest) before being written to the database. Files (when cloud storage is enabled) — up to 30 days from upload or until the dialog is deleted;
• Telegram account bindings — for the duration of the Account; upon Account deletion or upon unlinking Telegram via the dashboard, they are removed automatically;
• financial transactions and primary accounting documents (Balance top-ups, refunds) — at least 5 (five) years in accordance with the Tax Code of the Republic of Kazakhstan;
• technical logs — up to 12 (twelve) months;
• backups — up to 90 (ninety) days, then auto-deleted.

We apply organizational and technical measures to protect personal data, in particular:

• all data exchanged between your device and the Service is transmitted over secure channels using TLS/HTTPS;
• user passwords are stored as cryptographic hashes;
• employee access to data is restricted on a least-privilege basis;
• regular backups are performed and infrastructure access is controlled.

No service can guarantee the absolute security of information transmitted over the internet; by accepting this Policy you acknowledge this.

In accordance with Articles 24–25 of the Law of the Republic of Kazakhstan “On Personal Data and Their Protection”, you have the right to:

• obtain information about the presence of your personal data with us, its composition and processing purposes;
• require correction or supplementation of your data;
• require the blocking or destruction of your data upon withdrawal of consent or once the purposes of processing have been achieved;
• withdraw your previously given consent to processing (in which case we must cease processing, except where expressly provided by law);
• file a complaint with the authorized body of the Republic of Kazakhstan in the area of personal-data protection.

Send requests regarding the exercise of these rights to the email address listed in the “Operator details” section. The review period is 10 (ten) business days.

The Service uses strictly necessary cookies to identify the session and ensure the interface works correctly. Without them the Service cannot function.

When the relevant settings are enabled, the Operator may integrate third-party analytics services (e.g. Yandex.Metrica or Google Analytics) for anonymized analysis of Service usage. You can manage analytics services in your browser settings; opting out does not limit Service functionality.

The Service is not intended for persons under the age of 18 (eighteen). Registration and use of the Service by persons under this age is permitted only with the consent of their legal representatives and under their responsibility.

The Operator may amend this Policy. The current version and its effective date are always available on this page. Material changes are additionally notified to the email address provided at registration.