Privacy policy
In force from 2026-10-13.
1. Who we are
Zabio (zabio.ai) is operated by THINGS & STUFF, LLC, a Delaware limited liability company, 390 NE 191st St, STE 31817, Miami, FL 33179, United States ("Zabio", "we", "us"). We are the controller of the personal data described in this policy, except for the content you send through the API, as section 3.4 explains.
Privacy contact: privacy@zabio.ai.
EU representative: none appointed yet. Until we appoint one, write to privacy@zabio.ai.
Data protection officer: none appointed. Write to privacy@zabio.ai for anything about your personal data.
2. What this policy covers
This policy explains what personal data we collect when you use Zabio, why, who receives it, how long we keep it, and your rights. It covers the web app at zabio.ai, the API at api.zabio.ai, the zabio command line tool, and the emails we send you.
Zabio is a router: you send requests in the OpenAI API format, we forward each one to a model at one of the vendors in section 5, and we return the answer. Those requests may contain personal data of your own users. For that content you are the controller and we are your processor, under our Data Processing Agreement. This policy covers the data we hold about you as our customer.
3. What we collect
3.1 Your account
Your email address, your name, your preferred language, and a password, which we store only as a hash. If you sign in with an identity provider such as Google or GitHub, we receive your email address, your name and your identifier at that provider, never your password there. From GitHub we receive your numeric user id, your username and your verified primary email address, and nothing about your repositories.
We also keep the organizations you belong to and your role in each, the API keys and command line tokens you create (stored as hashes, never in readable form), and invitations you send or receive until they are accepted or expire.
3.2 Billing
Payments run on Stripe; card numbers never reach Zabio. We keep the amounts you add and every movement on your balance, the billing details you enter (name, address and, if you give it, a tax identifier), and, if you save a card, its brand, last four digits, expiry, issuing country and funding type, and Stripe's fingerprint of the card, which we use to recognize the same card in two accounts.
3.3 Usage records
For every API call we keep a record of the call: the time, the model requested and served, the vendor, token counts, cost and fee, the routing decision, the outcome and latency, and which API key and organization made it. These records do not contain the text of your prompts or answers. Identifiers you choose to send with your requests, such as a session identifier, a batch line's custom identifier, metadata or a file name, are stored as you send them, so we recommend values that do not identify a person.
3.4 The content you send
The prompts you send and the answers you receive pass through our servers to the vendor that serves the request and back. By default we do not store them. We store content only when you use a feature that needs it: body logging on an API key (off by default), stored conversations (/v1/responses and /v1/conversations), and files you upload, including batch files. Stored content is encrypted and kept for the retention period your organization sets, from 1 to 365 days (30 by default), or less if you delete it.
We do not use your content to train any model, and we do not allow our vendors to do so on our behalf.
3.5 Your own vendor keys
If you give us your own key for a model vendor, we store it encrypted, with its last four characters and your label, until you remove it. It is never shown again, logged or returned by the API.
3.6 Security and fraud prevention
To protect your account and stop abuse, we record the IP address and browser details of sign-ups, sign-ins, payments and other security-relevant actions, keep a log of security events (such as failed sign-ins and requests our limits refused), and keep an audit log of important actions in your organization (keys, members, roles, credits and similar), which its owners and admins can read. Addresses that behave like an attack can be blocked at our network edge for a limited time. When you sign up, and before your first payment or a change of card, we also ask MaxMind's fraud screening service for a risk score: it receives a scrambled form of your email address (never the address itself), your IP address, your browser details and, at a payment, the billing address on your account, and answers a score and signals such as a disposable email domain or an anonymous network. Depending on the score we may ask you to confirm a payment card for 0 USD before your free plan starts, ask your bank to authenticate a payment, or decline to open the account or the payment. We keep the score, the band it fell in and the signals on your account. None of these records contain your prompts, answers or secrets.
3.7 Emails
We send transactional emails: sign-in links, verification, password resets, invitations, receipts, and balance and account notices. We send marketing email only with your consent.
3.8 Cookies, analytics and the referral program
We use a session cookie to keep you signed in and cookies that remember preferences such as your language. We do not use advertising or cross-site tracking cookies.
We measure how the web app is used with Google Analytics 4, loaded through Cloudflare Zaraz with IP addresses anonymized, and only after your consent where the law requires it. It receives page views and a few steps such as creating an account or making a first top-up, never your email, name, organization name, API keys, prompts or answers.
If you follow someone's referral link, a cookie remembers the referrer for 30 days. If you take part in the referral program, we keep your referral name, who you referred, and whether each referral qualified; a referral does not qualify when both accounts pay with the same card, which we check by comparing card fingerprints from Stripe, never card numbers.
4. Why we use your data, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Provide the service: route your requests, keep the content you choose to store, run your organization | performance of our contract with you |
| Bill you and keep accounting records | performance of our contract; legal obligation |
| Keep the service secure and prevent fraud and abuse | our legitimate interest in protecting the service and our customers |
| Support you when you write to us | performance of our contract; legitimate interest |
| Comply with the law and defend our rights | legal obligation; legitimate interest |
| Send you marketing email | your consent, which you can withdraw at any time |
Where we rely on legitimate interest, we have weighed it against your rights and limited the data to what the purpose needs. You can object; see section 8.
5. Who receives your data
We run Zabio on our own infrastructure in the United States, operated by our company in OVHcloud's datacenters. Access to production systems is limited to our own staff and is logged.
These companies process personal data for us, each only for the purpose shown:
| Company | Purpose | Data | Location |
|---|---|---|---|
| Anthropic, OpenAI, Google, xAI | serve the requests routed to their models | the content of those requests and answers | United States |
| Mistral AI | serve the requests routed to its models | the content of those requests and answers | not fixed: Mistral AI does not commit to an inference location |
| DeepSeek | serve the requests routed to DeepSeek's own API, shown as "DeepSeek (China)" | the content of those requests and answers | China |
| Together AI | serve the requests routed to open-weight models, and to DeepSeek models shown as "via Together AI" | the content of those requests and answers | North America |
| Alibaba Cloud, shown as "Alibaba Cloud (US)" | serve the requests routed to the models with ids ending in @alibaba-us, through its Virginia workspace with the US deployment scope |
the content of those requests and answers | United States (Virginia): data stored and processed only in the United States |
| Alibaba Cloud, shown as "Alibaba Cloud (International)" | serve the requests routed to the Qwen models with plain ids and to the models with ids ending in @alibaba-intl, through its Singapore workspace |
the content of those requests and answers | data stored in Singapore and processed anywhere outside mainland China |
| TypeSafe AI | serve requests that name its Jev model; help Zabio choose a model for auto requests |
for Jev requests, their content; for auto requests, an excerpt Zabio's router reads (never whole conversations, images or answers) |
United States |
| OVHcloud | the datacenters where our servers and encrypted backups run | all data we store | United States |
| Stripe | payments, saved cards, fraud screening | payment and billing details | United States |
| MaxMind | fraud screening at sign-up and payment | a scrambled form of the email address, the IP address, browser details and the billing address | United States |
| Cloudflare | network edge, traffic protection, bot checks, loading analytics | traffic in transit, IP addresses | United States |
| Google (Google Analytics 4) | usage measurement, with consent where required | the analytics data in section 3.8 | United States |
A model vendor receives only the requests routed to it, without your account details. Every vendor is enabled by default; your organization's owners and admins can switch vendors and models off, and an API key can restrict the vendors a request may use.
We do not sell personal data or share it with advertisers. We may disclose data when the law requires it, to protect our rights or others' safety, or in a merger or acquisition, in which case this policy continues to apply.
6. International transfers
We store data in the United States, and we process it there, except where a request is routed to a vendor that processes elsewhere (section 5). Requests routed to DeepSeek are processed in China, and requests routed to Mistral AI may be processed in any region Mistral AI uses. The European Commission has not found that China protects personal data adequately; if you send personal data protected by the GDPR or a similar law, you can keep it away from these vendors by switching them off for your organization or restricting the vendors an API key may use. If you are in the European Union, the United Kingdom, Switzerland or another country with transfer rules, your data crosses to the United States when you use the service. For transfers from the EU we rely on the European Commission's standard contractual clauses, with the UK Addendum and the Swiss amendments for transfers from the United Kingdom and Switzerland. Our Data Processing Agreement contains the clauses for the content you send us as a controller.
7. How long we keep it
Our rule is simple: when something is deleted, it is gone within 30 days, with two exceptions.
- Content you store (logged bodies, conversations, files): for your organization's retention period, or until you delete it. Deleted content is gone within 30 days, including from backups, where it becomes unreadable once its encryption key is destroyed.
- Usage records: 24 months.
- Your account, your organizations, security records and the audit log: while the account or organization exists, and deleted within 30 days after you delete it.
- Server logs: 30 days.
- Emails: we keep a record that an email was sent; its content is deleted shortly after delivery.
The two exceptions:
- The law. Billing records (payments, the ledger and the billing details printed on receipts) are kept for 7 years, as accounting law requires.
- Abuse. If we suspend an account for fraud or abuse, we keep the evidence (such as IP addresses, security events and the audit log) for 2 years, and a scrambled fingerprint of the email address, and of the card where there is one, so the same person cannot simply sign up again.
8. Your rights
Depending on where you live, you have the right to access your personal data, correct it, delete it (subject to the exceptions in section 7), restrict or object to processing based on our legitimate interest, receive a copy in a portable format, withdraw consent at any time, and complain to a data protection authority, in particular in the EU country where you live or work.
You can do most of this yourself in the web app: edit your profile, end sessions, revoke keys and tokens, delete stored content, download your data, and delete your organization or your account from Settings. For anything else, write to privacy@zabio.ai. We answer within one month and may first ask you to confirm your identity.
9. Deleting your account or organization
An owner can delete an organization from Settings: its API keys stop working at once and its stored content is deleted at once. You can delete your personal account from Settings once you no longer own an organization that has other members or a balance. In both cases everything else is deleted within 30 days, except the billing records and abuse evidence described in section 7.
10. Security
- Stored content is encrypted at rest under a key unique to your organization, and your vendor keys are encrypted too.
- Connections from your browser and software to Zabio, and from our application to its database, are encrypted with TLS.
- Passwords are hashed, and API keys and tokens are stored as hashes. Secrets never appear in logs.
- Access to production systems is limited to our staff, protected by key-based authentication, and logged.
- Backups are encrypted.
No system is perfectly secure. If a breach affects your personal data, we will tell you without undue delay and as the law requires.
11. Children
Zabio is not for children. You must be at least 18 to create an account, and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, write to privacy@zabio.ai and we will delete it.
12. Changes to this policy
We may update this policy. We change the date at the top and, for changes that matter to you, tell you by email or in the web app before they take effect. The current version is always at zabio.ai/privacy.
13. Contact
THINGS & STUFF, LLC 390 NE 191st St, STE 31817, Miami, FL 33179, United States privacy@zabio.ai
Governing law and venue for disputes about this policy: the laws of the State of Florida, United States, and the state and federal courts located in Miami-Dade County, Florida, without prejudice to your right to complain to a data protection authority or to go to court where you live.