Privacy Policy

Last Updated: April 21, 2026

Effective Date: April 14, 2026

1. What Data We Collect

1.1 Information You Provide

• Account Information: Email address, username, display name, avatar, and timezone
• Authentication Credentials: Password (stored as a bcrypt hash, never in plaintext), two-factor authentication secrets (encrypted)
• OAuth Tokens: Access and refresh tokens from connected third-party services (encrypted with AES-256-GCM before storage)
• API Keys and Tokens: Master tokens, access tokens, and vault tokens you create (hashed or encrypted)
• AI Persona Content: Persona configurations, system prompts ("soul content"), and persona settings
• Knowledge Base Documents: Documents and files you upload for AI context (up to 50MB per upload)
• Conversation Data: Messages exchanged in AI conversations, including prompts and responses
• Skills and Code: Custom skill packages, code, and configurations you create or install
• Marketplace Content: Listings, descriptions, ratings, and reviews you publish
• Payment Information: Billing details processed through Stripe (we store only Stripe customer and subscription IDs, not full payment card details)
• Communication Data: Workspace invitations, email preferences, and notification settings

1.2 Information Automatically Collected

• IP Address: Logged with every API request for security and rate limiting
• Device Information: User agent string, browser type, and device fingerprint hash (SHA-256) for device approval
• Usage Data: API call counts, endpoints accessed, HTTP methods, and response status codes
• Authentication Events: Login timestamps, failed attempts, 2FA verification events, and session activity
• Audit Trail: Actions performed, including token creation/revocation, data modifications, and administrative operations

1.3 Cookies and Local Storage

We use a minimal set of cookies essential for the Service to function:

Cookie Name	Purpose	Type	Duration
myapi.sid	Session authentication	Essential (HttpOnly, Secure)	7 days
myapi_master_token	Persistent API authentication	Functional	7 days
myapi_user	User display information	Functional	7 days

You can configure cookie preferences (essential only, all, or none) through the cookie consent banner or Settings page. We also use browser localStorage to store your authentication token and workspace selection for a seamless experience.

2. How We Use Your Data

• Provide the Service: Authenticate your identity, manage your sessions, and deliver Service features
• AI Processing: Route your prompts, persona configurations, and relevant knowledge base context to one or more AI model providers (including Anthropic, OpenAI, Google Gemini, xAI/Grok, GitHub Copilot, OpenRouter, and/or local self-hosted models) via the OpenClaw proxy infrastructure or direct API connections, to generate AI responses. The specific provider depends on the AI model configured for your persona or selected in your request.
• OAuth Integration: Use encrypted tokens to connect and interact with your authorized third-party services
• Security and Fraud Prevention: Detect unauthorized access, enforce rate limits, manage device approvals, and maintain audit logs
• Billing: Process subscription payments through Stripe, track usage against plan limits, and manage invoices
• Notifications: Send security alerts, device approval requests, workspace invitations, and system updates
• Service Improvement: Analyze usage patterns (in aggregate) to improve reliability and features
• Legal Compliance: Fulfill legal obligations, respond to lawful requests, and enforce our Terms of Service

3. Data Sharing and Third-Party Processors

We share your data only in the following limited circumstances:

3.1 Service Providers (Data Processors)

Provider	Purpose	Data Shared
Stripe	Payment processing	Billing email, subscription plan, payment method (handled directly by Stripe)
SMTP / SendGrid	Email delivery	Recipient email address, email subject and body content
Anthropic	Claude model inference (direct API and via OpenClaw proxy)	Conversation prompts, system prompts, persona context, knowledge base excerpts. Anthropic Privacy Policy
OpenAI (via OpenClaw proxy)	GPT model inference	Conversation prompts, system prompts, persona context. OpenAI Privacy Policy
Google (Gemini)	Gemini model inference (direct API and via proxy)	Conversation prompts, system prompts, persona context. Google Privacy Policy
xAI (via OpenClaw proxy)	Grok model inference	Conversation prompts routed through OpenClaw proxy. xAI Privacy Policy
GitHub (Copilot)	Code generation	Code context and prompts you authorize. GitHub Privacy Statement
OpenRouter (fallback)	Fallback AI routing	Conversation prompts routed to underlying providers. OpenRouter Privacy Policy
OpenClaw Proxy	AI routing and orchestration intermediary	All prompts and responses to cloud AI providers pass through this layer. OpenClaw is operated by Agentic Integration LLC (the same legal entity as MyApi) and is subject to this Privacy Policy. Request metadata (model, token counts, latency) may be logged for operational monitoring. Prompt content is not retained beyond request processing.
Local / Self-Hosted Models (Ollama: Gemma, Qwen, StarCoder, Llama, etc.)	Local AI inference (privacy-preserving)	No data transmitted externally. All inference occurs on the server where the Service is installed.
OAuth Providers (Google, GitHub, Slack, etc.)	Third-party service integration	OAuth authorization codes and tokens (to maintain your connected accounts)

3.2 Other Circumstances

• Legal Requirements: When required by law, regulation, legal process, or governmental request
• Safety: To protect the rights, property, or safety of MyApi, our users, or the public
• Business Transfer: In connection with a merger, acquisition, or sale of assets (you will be notified of any change in data handling)
• With Your Consent: When you explicitly authorize sharing (e.g., publishing content to the Marketplace)

3.3 Workspace and Team Data

When you participate in a workspace, other workspace members with appropriate roles may access shared resources including personas, skills, knowledge base documents, and activity logs within that workspace. Workspace administrators can manage members, view audit logs, and configure workspace settings. Data you create within a workspace is accessible according to the workspace's role-based access control settings.

4. Data Security

We implement multiple layers of security to protect your data:

4.1 Encryption

• In Transit: All data transmitted over HTTPS with TLS 1.2+ (enforced via Cloudflare)
• At Rest: Sensitive data encrypted with AES-256-GCM authenticated encryption
• Key Derivation: PBKDF2 with 600,000 iterations and SHA-256 (compliant with NIST SP 800-132)
• Passwords: Hashed with bcrypt (never stored in plaintext or reversible form)
• Random Nonces: Unique 96-bit nonce per encryption operation to prevent IV reuse

4.2 Access Controls

• Multi-factor authentication (TOTP-based 2FA with backup codes)
• Scoped API tokens with granular permissions (e.g., services:read, admin:*)
• Device fingerprinting with manual approval workflow
• Role-based access control (RBAC) within workspaces
• Session management with automatic expiration

4.3 Infrastructure

• Security headers via Helmet.js (HSTS, CSP, X-Content-Type-Options, Referrer-Policy)
• Rate limiting at multiple levels (per-IP, per-user, per-endpoint, per-workspace)
• CORS restrictions to authorized origins only
• Immutable compliance audit logs that cannot be modified or deleted
• Automated session cleanup and OAuth state token expiration

5. Data Retention

Data Type	Default Retention Period	Notes
Account Information	Until account deletion	Deleted immediately and permanently upon request
OAuth Tokens	Until disconnected or account deleted	Encrypted at rest; revoked upon disconnection
Session Data	7 days	Cleaned up automatically every 15 minutes
Conversations & Messages	Until account deletion	Deleted when account is deleted; can be individually deleted
Notifications	60 days	Automatically expired after 60 days
Audit Logs	Up to 365 days	Audit logs are append-only (tamper-evident) and retained for up to 365 days, then permanently purged. On account deletion, your name and email are removed immediately, so any audit rows remaining within the retention window reference only an internal identifier — no direct personal identifiers — and are purged as they age out.
Compliance Audit Logs	Append-only (immutable)	Append-only for tamper-evidence and security. After account deletion these reference only an internal id whose associated personal data (name, email) has been removed — no direct personal identifiers remain.
Backups	30 days	Configurable; maximum 50 backups retained
OAuth State Tokens	Cleaned hourly	Temporary tokens expired and removed automatically
Rate Limit Records	24 hours	Cleaned up automatically every hour
Pending Device Approvals	7 days	Expired approvals are automatically removed

Workspace administrators can configure custom retention policies for notifications, audit logs, and activity logs through the Settings page. Custom policies may shorten (but are subject to minimum compliance requirements) or extend default retention periods.

6. AI Data Processing

• Conversation prompts and context are transmitted to AI model providers (Anthropic, OpenAI, Google Gemini, xAI, GitHub Copilot, OpenRouter, or local models — see Section 3.1 for the full list) to generate responses
• Requests to cloud AI providers are routed through the OpenClaw proxy layer before reaching the external provider
• AI providers may process your data according to their own privacy policies and terms
• We store conversation history (prompts and AI responses) locally in your account for your reference
• Token usage (the number of tokens processed per message) is tracked for billing and usage reporting
• You can delete individual conversations or all conversation data at any time
• Messages flagged as "private" are excluded from data exports

6.1 Data Flow Architecture

When you use AI features, your data flows through the following layers (in order):

1. Your Client (browser, API client, or agent) sends a request to the Service API
2. MyApi Service processes the request, retrieves relevant persona context and knowledge base excerpts, and constructs an AI prompt
3. OpenClaw Proxy (if applicable): The constructed prompt is routed through an AI routing proxy, which may add system-level context, apply routing logic, and log request metadata before forwarding to the external AI provider
4. External AI Provider (Anthropic, OpenAI, Google, etc.) receives and processes the prompt, returning a response
5. The response travels back through the same layers, and MyApi stores the conversation in your account

For local models (Ollama), steps 3 and 4 occur on the same server as the Service — your prompt data does not leave the server.

6.2 Agent and Third-Party Platform Access

When you access the Service via a third-party AI agent or platform (such as a ChatGPT GPT, an MCP client, an OpenAPI-based automation, or the Hermes platform), the following applies:

• The third-party platform hosting the agent will receive the OAuth or API token used to authenticate to the Service and will transmit your requests on your behalf
• The third-party platform processes your conversational content according to its own privacy policy before forwarding actions to the Service API
• Data you share with the agent may be stored by the third-party platform per their policies, in addition to being stored in your MyApi account
• We recommend reviewing the privacy policy of any third-party agent platform before using it to access the Service

6.3 AI Provider Training Practices

7. Google API Services — Limited Use Disclosure

Specifically, with respect to data obtained through Google APIs:

• We use Google user data only to provide and improve the features the user explicitly requests through the Service (such as connecting your Google account to enable AI-assisted access to Gmail, Calendar, Drive, or other Google services you authorize)
• We do not transfer Google user data to third parties except as strictly necessary to provide the Service to you, as required by applicable law, or with your explicit consent
• We do not use Google user data for advertising, to build user profiles for advertising, or to train AI models
• We do not allow humans to read Google user data unless: (a) you have given us explicit permission to do so; (b) it is necessary for security purposes (e.g., investigating abuse); or (c) it is required by law
• Google OAuth tokens are encrypted with AES-256-GCM before storage and are used only to fulfill your authorized integration requests
• You may disconnect your Google account and revoke access at any time through Settings → Connected Services, or via your Google Account permissions page

7a. Gmail API Data Use

In addition to the general Google API Limited Use commitments above, the following applies specifically to Gmail data:

• MyApi may, with your explicit authorization and instruction, read selected Gmail messages needed to carry out the workflow you request
• MyApi may draft and send emails on your behalf when you explicitly request an email action
• MyApi may modify Gmail data — including applying or removing labels and moving messages to Trash — only to fulfill actions you specifically request
• Gmail data is never used for advertising, user profiling, or AI model training
• Gmail data is retained only as long as needed to provide the requested feature or maintain user-visible history and settings; you can revoke Gmail OAuth access at any time through Settings → Connected Services or via your Google Account permissions page

8. GDPR — Lawful Basis for Processing

Under Article 6 of the GDPR, we process your personal data on the following lawful bases:

Processing Activity	Lawful Basis	Details
Account creation and authentication	Contract performance (Art. 6(1)(b))	Necessary to provide the Service you signed up for
OAuth token storage and integration	Contract performance (Art. 6(1)(b))	Required to connect and operate your third-party service integrations
AI conversation processing	Contract performance (Art. 6(1)(b))	Necessary to deliver AI features you explicitly use
Billing and payment processing	Contract performance (Art. 6(1)(b))	Required to manage your subscription and invoicing
Security monitoring, audit logs, rate limiting	Legitimate interests (Art. 6(1)(f))	Protecting the integrity and security of the Service and all users
Device fingerprinting and approval	Legitimate interests (Art. 6(1)(f))	Preventing unauthorized account access; less intrusive than alternatives
Aggregate usage analytics	Legitimate interests (Art. 6(1)(f))	Improving Service reliability and features; data used only in aggregate
Email notifications (security alerts, device approvals)	Legitimate interests (Art. 6(1)(f))	Necessary to keep you informed of security-relevant events on your account
Marketing or non-essential notifications	Consent (Art. 6(1)(a))	Only sent where you have opted in; withdrawable at any time via Settings
Compliance audit log retention	Legal obligation (Art. 6(1)(c))	Retained to comply with applicable legal and regulatory requirements
Responding to legal requests	Legal obligation (Art. 6(1)(c))	Required by law, regulation, or lawful governmental request

Where processing is based on consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing before withdrawal. Where processing is based on legitimate interests, you have the right to object (see Section 11).

9. Device Fingerprinting

To protect your account security, we generate a SHA-256 hash of your device characteristics (such as browser type, screen attributes, and IP address) to create a unique device fingerprint. This fingerprint is used to:

• Identify new or unrecognized devices accessing your account
• Require explicit approval before granting access from new devices
• Alert you when a new device attempts to access your account
• Maintain a list of your approved devices for ongoing authentication

Device fingerprints are stored as irreversible hashes and cannot be used to reconstruct your device information. You can view and revoke approved devices at any time through your account settings.

The device fingerprint hash incorporates your IP address as one input factor. Because IP addresses can indicate approximate geographic location, the device approval system implicitly processes location data as part of this security function. We do not use this data for tracking, profiling, or any purpose beyond device approval authentication.

10. Privacy Controls

You have control over your privacy settings through the Service dashboard:

• Cookie Preferences: Choose between "All cookies", "Essential only", or "None" (note: disabling essential cookies while authenticated is not permitted)
• Data Sharing: Toggle whether your usage data may be used for aggregate service improvement
• API Logging: Control whether detailed API activity is logged for your account
• Data Retention Policies: Workspace administrators can set custom retention periods for different data types
• Notification Preferences: Configure which notifications you receive and how they are delivered

11. Your Rights

12. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at [email protected]. If we become aware that we have collected personal data from a child under 18, we will take steps to delete that information promptly.

13. International Data Transfers

MyApi is a self-hosted platform. Your data is stored on the server where the Service is deployed. If you access the Service from outside the jurisdiction where the server is located, your data may be transferred across borders. We implement appropriate safeguards (including encryption in transit and at rest) to protect your data during any such transfer in accordance with applicable data protection laws.

When AI features are used, your data is additionally subject to international transfer to the extent that the AI provider receiving your request is located in a different jurisdiction. Requests routed to Anthropic, OpenAI, or Google are processed on servers in the United States. Requests to xAI and other providers are processed per those providers' infrastructure policies.

For EU/EEA users, we rely on the following transfer mechanisms for personal data transferred to AI providers:

• Where the AI provider has executed Standard Contractual Clauses (SCCs) with its API customers, those SCCs govern the transfer
• Where the provider operates under an EU adequacy decision or equivalent framework, that framework governs
• For all other cases, transfer is based on your informed consent given when you configured and use the AI provider features of the Service

We recommend reviewing each AI provider's data transfer mechanisms, which are disclosed in their respective privacy policies linked in Section 3.1.

14. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms:

• We will notify the relevant supervisory authority within 72 hours of becoming aware of the breach (GDPR Art. 33)
• We will notify affected users without undue delay if the breach is likely to result in a high risk to their rights
• Notification will include: the nature of the breach, data affected, likely consequences, and measures taken to mitigate the breach
• All breach events are recorded in the immutable compliance audit log

15. Exercise Your Rights

To exercise any of your privacy rights:

• Email: [email protected]
• Subject Line: "Privacy Request: [Your Request Type]"
• Self-Service: Many rights can be exercised directly through the Service (data export, account deletion, privacy settings)

Response Times:

• GDPR requests: Within 30 days (extendable by 60 days for complex requests, with notification)
• CCPA requests: Within 45 days (extendable by an additional 45 days, with notification)

We may verify your identity before processing a request to protect against fraudulent requests.

16. Contact Us

• Legal Entity: Agentic Integration LLC, 5900 Balcones Drive, STE 100, Austin, TX 78731, USA
• Privacy Questions: [email protected]
• Security Issues: [email protected]
• General Support & Community: Join our Discord server
• Data Protection Concerns: If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority. For EU/EEA users, supervisory authority contacts are listed at edpb.europa.eu.

17. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes:

• We will update the "Last Updated" date at the top of this page
• For significant changes, we will notify you via email or in-app notification
• We will provide a summary of what changed

Your continued use of the Service after changes take effect constitutes acceptance of the revised policy. We encourage you to review this policy periodically.