AI for Biz MENA

Privacy Policy

How the AI for Biz API gateway (api.aiforbiz.email and direct-api.aiforbiz.email) handles the data you send through it. Last updated October 15, 2026.

In short

We log usage, not conversations

For every call we keep a usage record: when, which key, which model, how many tokens, what it cost. The text of your messages, uploaded files, images and audio, and the model's answers are replaced with a placeholder before the record is saved.

Your content goes to the model provider

To answer a call, the gateway forwards it to the model provider (normally Microsoft Azure OpenAI) and streams the answer back. The provider handles it under its own terms.

No selling, no training

We do not sell your data, use it for advertising, or train models on it. Usage records are used for billing, budgets, rate limits and keeping the service running.

Who we are

The gateway is run by AI for Biz MENA. It is an invite-only, OpenAI-compatible API: each customer receives an API key, and calls made with that key are metered against the customer's budget. The gateway server is hosted by Hetzner in Falkenstein, Germany.

What we store for each API call

Each call creates one usage record in the gateway's database. It contains:

Field	What it holds
Call identity and timing	Request ID, start and end time, duration, success or failure, and which endpoint was called (chat, responses, embeddings, image, audio).
Your key and account	A one-way hash of your API key (never the key itself), the key's name, and the account, project and team it belongs to, including the account's email address.
Model and routing	The model you asked for, the provider and region that served it, retry attempts, and request settings such as streaming, reasoning effort, token limits and image size and quality.
Usage and cost	Input, cached, output and reasoning token counts (or images and audio seconds), the price applied, and the cost charged to your budget.
Network details	Your IP address, the country Cloudflare reports for it, and request headers such as `User-Agent`, `Content-Type` and `Host`. The `Authorization` header (your key) is not stored.
Optional fields you send	If your request includes a `user` value, metadata, tags or a session ID, they are kept with the record.
Errors	For a failed call: the error type, the error message returned by the gateway or the provider, and diagnostic details for troubleshooting.

What we do not store

Your messages and prompts. Message text and input fields are replaced with the placeholder redacted-by-litellm before the record is written.
Model answers. Generated text, images, audio and embeddings are passed back to you and not kept. The record keeps only their size and token counts.
Uploaded files. Audio for transcription and images for editing pass through to the provider and are not saved on the gateway.
Cached answers. The gateway does not cache responses. Our cache (Redis) holds only rate-limit counters and routing state.
Web access logs. The web server in front of the API does not write access logs.

One exception: Responses API settings. When you call POST /v1/responses, the record also keeps the instructions field (your system prompt) and the definitions of the tools and response formats you send (names, descriptions and JSON schemas), because they are part of the call's configuration rather than the conversation. Do not put secrets or personal data in instructions or tool definitions. Message text and answers on this endpoint are redacted like on every other endpoint.

Accounts and keys

For each customer we keep the account email and name, project name, the models the key may call, rate limits, budget, and spend to date. API keys are stored as one-way hashes. The dashboard at /ui shows you your own balance and usage; dashboard passwords are stored hashed.

Who else handles your data

We use these service providers to run the gateway. Each receives only what it needs for its part of the call.

Provider	Role
Microsoft Azure OpenAI	Runs the models. Receives the full content of your calls. Global deployments may be processed in any Azure region; Data Zone deployments stay inside their zone (EU, US or Asia Pacific). See Microsoft's data privacy notice for Azure OpenAI, including its abuse monitoring.
OpenRouter	A fallback model provider, enabled only for specific customers' keys, and used only when Azure cannot serve the call or for models Azure does not offer. Receives the full content of those calls.
Cloudflare	Proxies and protects `api.aiforbiz.email` (TLS, DDoS protection). Calls to `direct-api.aiforbiz.email` skip Cloudflare.
Hetzner	Hosts the gateway server and its database in Germany.

How we use the data

To bill usage and enforce each key's budget and rate limits.
To show you your balance and usage in the dashboard and through GET /key/info.
To detect abuse, investigate errors, and plan capacity.
To reconcile our costs with our model providers.

How long we keep it

Usage records are kept for as long as your account is open and afterwards for as long as we need them for billing, accounting and legal obligations. Account and key details are kept while the account exists. Error logs from the gateway's services stay on the server and are not shared.

Security

All traffic is encrypted with TLS. Keys and passwords are stored only as hashes. Provider credentials are held on the server and are never sent to callers. Access to the server and database is limited to the operator.

Changes

We update this page when what the gateway stores changes. The date at the top shows the latest version.