Privacy Policy
Last updated 16 October 2026
apmix.ai is operated by Nomvel (nomvel.com), which is the data controller for everything described here; write to support@apmix.ai for anything about your data. We collect what is needed to run an API subscription and nothing more. This page explains exactly what that is, and what happens to the text you send through the API.
01What we collect
We collect information in three ways: from your sign-in provider, from how you use the API, and from payments.
- Account: your email address, and the name and avatar shared by Google or GitHub if you sign in with them.
- API keys: created by you in the dashboard. We store a one-way hash of each key, never the key itself, so we can authenticate your requests without being able to read them back.
- Usage metering: for every request, the model, the number of input and output tokens, the weighted total, a timestamp, the key that was used, and the tool that made the call as it identifies itself in its own request headers.
- Support tickets: the subject and messages you write, plus anything you add such as a page name or a request id.
- Analytics: page views, clicks and product events, and recordings of how pages are used, collected with PostHog. Once you sign in they are linked to your account id — never your email or name. Text you type into fields, API keys and email addresses shown on screen are masked and never recorded.
- Billing: your plan, invoices and payment status. Card details are handled by our payment processor and never touch our servers.
- Business applications: if you apply for a business account, the company and contact details you enter and the documents you upload, such as a registration certificate. The documents are private: only you and the apmix team can open them.
- Technical logs: IP address, request status and timing, kept briefly for security and debugging.
02Your prompts and completions
The content you send (prompts, files, tool calls) is transmitted to the upstream infrastructure that serves the model you selected so it can produce the answer, and the answer is streamed back to you. Depending on the model, that is either the model's own vendor or an intermediary we buy capacity from; either way it is processed under an API agreement that excludes training on the traffic we send.
apmix does not use your content to train models, does not sell it, and does not keep it beyond what is needed to complete the request. Only metering data described above is retained.
03How we use the data
- To run the service: authenticate keys, route requests, count usage and enforce plan allowances.
- To bill you and send receipts, sign-in links and important account emails. Product updates — new models, features, price changes — go only to accounts that ticked the updates box at sign-in; every such email carries an unsubscribe link that works with one click, and we record when a message was opened or a link in it was clicked so we know what is worth sending. Buttons in account emails, such as a usage alert or the notice that your allowance is used up, also go through apmix, so we can count which ones are clicked and whether a plan was bought afterwards.
- To keep the service safe: detect abuse, multiple accounts, leaked keys and attacks.
- To help you when you contact support.
06How long we keep it
- Account data: while your account exists. Deleting your account removes it immediately, along with your keys, usage history and support tickets.
- Free allowance after deletion: for 12 months after you delete your account, we keep how much of the free allowance it had used, filed under a one-way fingerprint of your email address and sign-in accounts — never the address itself — so that signing up again does not grant the free allowance twice.
- Usage metering: 12 months, so you can review past periods and we can resolve billing questions. Older records are deleted automatically.
- Support tickets: kept while your account exists, so the history stays readable after a ticket is closed.
- Billing records: as long as tax law requires.
- Business applications and their documents: while the application or the company account exists, and afterwards only as long as the law requires us to keep verification records.
- Technical logs: up to 30 days.
07Your rights
You can see, correct, export or delete your data. Most of it is available in the dashboard; for anything else, email support@apmix.ai and we will respond within 30 days. If you are in the EU, UK or a region with similar law, you also have the right to complain to your data protection authority.
08Security
All traffic is encrypted in transit. Access to production data is limited to the people who need it to run the service. API keys are shown in full only once, when created, and can be revoked at any time.
09Changes
If we change this policy in a way that matters, we will tell you by email or in the dashboard before it takes effect. The date at the top shows the current version.