Privacy Policy

Last updated: October 22, 2026

This Privacy Policy explains how Omnimodel Technology Limited, a company incorporated in Hong Kong ("A2Agent," "we," "us," or "our"), collects, uses, shares, and protects personal data when you use https://a2agent.me, our dashboard, our documentation, and our API gateway (together, the "Service"). Capitalized terms not defined here have the meaning given in our Terms of Service.

We are the data controller (or "data user" under Hong Kong's Personal Data (Privacy) Ordinance) for the personal data described in this policy. This policy does not cover how Model Providers or other third-party services handle data under their own policies.

Summary

We do not sell your personal data.
We do not use your prompts or model outputs to train any model.
We do not store request or response bodies for ordinary API traffic, except in the limited cases described in Section 2.
Our servers and cloud service providers are located in the United States, and we do not give any government direct access to our systems.
To answer your requests, your Inputs are sent to the Model Provider that serves the Model you choose, which handles your data under its own terms.

1. Information We Collect

1.1 Information you provide

Account information: email address, username, password (stored in hashed form), and, if you sign in with a third-party provider, the basic profile information that provider shares with us.
Billing information: purchase history, amounts, currency, and payment status. Payments are processed by Stripe and other payment processors; we receive limited details such as the card brand, last four digits, and billing country, but never your full card number.
Communications: messages you send to our support team, on our community channels, or through surveys, and records of that correspondence.
Affiliate information: if you join our Affiliate Program, referral links, referred-account relationships, and the details needed to pay rewards.

1.2 Information collected when you use the API

Usage metadata: request timestamps, Model name, token counts, cost, latency, status and error codes, API Key identifier, and the IP address of the request. We need this for metering, billing, rate limiting, fraud prevention, reliability, and support.
Inputs and Outputs: the content of your requests and responses passes through our systems so that we can deliver them. How we handle this content is explained in Section 2.

1.3 Sign-up and sign-in records

When you sign up, and each time you or anyone else tries to sign in to the Service, including failed attempts, we record the IP address, browser user agent, sign-in method, the result, and the email address entered if it is a valid email address. The IP address and user agent recorded at sign-up are kept with your account information. We also keep a daily summary of the IP addresses your API requests come from.
We look up the country and network operator (autonomous system) of these IP addresses using IP geolocation data from DB-IP. We use these records to protect accounts and to detect bulk sign-ups, shared or resold accounts, stolen API Keys, and credential stuffing.

1.4 Information collected automatically on our website

Device and connection data such as IP address, browser type, operating system, language, and time zone.
Pages viewed, links clicked, referring pages, and similar interaction data, collected through cookies and similar technologies (see Section 7).

2. How We Handle Prompts and Outputs

2.1 Routing to Model Providers. When you send a request, we forward your Inputs to the Model Provider that serves the Model you selected and return its Output to you. Model Providers include model developers' official platforms and cloud model platforms. Each Model Provider processes your data under its own terms and privacy policy, which may allow it to retain your data, use it for safety review, or use it to improve its models. Model Providers operate under the laws of the jurisdictions in which they are established, and we do not control how they process your data once it reaches them. We list the Models and Model Providers at https://a2agent.me/models. Please review the relevant Model Provider's terms before sending personal or sensitive data.

2.2 No storage by default. We do not store the bodies of your requests or responses for ordinary API traffic. Content is held only in memory or temporary storage for as long as needed to process and deliver the request.

2.3 Limited exceptions. We may keep request or response content for a limited time only when (a) you ask us to investigate a specific request and provide it or authorize us to access it, (b) we need to investigate suspected abuse, fraud, or a violation of our Terms, or to secure the Service, or (c) the law requires it. Such content is accessible only to authorized personnel and is deleted once it is no longer needed for that purpose.

2.4 No training. We do not use your Inputs or Outputs to train, fine-tune, or evaluate any model, and we do not sell or license them to others.

2.5 Other people's data. If your Inputs include personal data about other people (including images or voice recordings), you are responsible for having a lawful basis and any required notice or consent to share it with us and with the Model Provider.

3. How We Use Personal Data

We use personal data to:

create and manage your account and authenticate you;
provide the Service, route requests, and meter usage;
process payments, top-up bonuses, refunds, and affiliate rewards;
provide customer support and respond to your requests;
send service messages, such as receipts, security alerts, low-balance notices, and notices of changes to our Terms or this policy;
send product news and promotional emails, where permitted by law (you can opt out at any time);
monitor and improve reliability, performance, and features, mainly using usage metadata and aggregated statistics;
detect and prevent fraud, abuse, multiple-account abuse, security incidents, and violations of our Terms or Model Terms;
comply with legal, tax, accounting, and regulatory obligations and respond to lawful requests; and
establish, exercise, or defend legal claims.

We may create aggregated or de-identified statistics (for example, total token usage by Model) that do not identify you, and use them for any lawful purpose, including publishing usage trends.

Automated decision-making. We may use automated tools to detect and prevent fraud, abuse, multiple-account abuse, and security incidents, using data such as usage metadata and IP addresses. These tools may automatically apply rate limits or flag accounts for review. Measures against your account, such as a rate limit or suspension, that are based on suspected abuse are generally subject to human review, and you may contact us at support@a2agent.me at any time to contest a decision and request that a person review it.

4. Legal Bases (EEA, UK, and Similar Laws)

Where the GDPR or similar laws apply, we rely on the following legal bases:

Performance of a contract: to provide the Service, process payments, and provide support.
Legitimate interests: to secure the Service, prevent fraud and abuse, improve the Service using usage metadata, and send certain service-related communications. We balance these interests against your rights.
Consent: for non-essential cookies and, where required, marketing emails. You can withdraw consent at any time.
Legal obligation: to keep financial records and respond to lawful requests.

5. How We Share Personal Data

We share personal data only as described below:

Model Providers: your Inputs and the technical data needed to fulfill each request, as described in Section 2.1. We do not send your account email or payment details to Model Providers.
Service providers: companies that process data on our behalf under contract, including cloud hosting and infrastructure (Google Cloud), payment processing (Stripe), email delivery (Amazon Web Services), website analytics and ad conversion measurement (Google Analytics, Google Ads), and bot protection (Cloudflare Turnstile). They may use personal data only to provide services to us.
Legal and safety: where required by law, court order, or other legal process, or where we believe in good faith that disclosure is needed to protect the rights, property, or safety of you, our users, us, or others, or to prevent fraud or abuse.
Business transfers: to a buyer or successor in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to this Privacy Policy or protections at least as strong.
With your consent or at your direction.

We do not sell personal data and do not share it for cross-context behavioral advertising, as those terms are defined under U.S. state privacy laws.

6. International Data Transfers

Omnimodel Technology Limited is incorporated in Hong Kong. Our servers and the cloud service providers that host the Service are located in the United States, and the personal data we store — account data, billing records, and usage metadata — is processed in the United States. We do not give any government direct access to our systems, and we disclose personal data to government authorities only in the circumstances described in Section 5 (Legal and safety).

When you use a Model, your Inputs are transmitted to the Model Provider that serves it. That Model Provider may operate in a jurisdiction other than your own, which may not provide the same level of data protection as your home country. Where the law of your country requires it (for example, for transfers from the EEA or UK), we use appropriate safeguards such as the European Commission's Standard Contractual Clauses with our service providers. For requests routed to a Model Provider you select, the transfer is necessary to perform our contract with you. If you do not want your Inputs processed in a particular jurisdiction, choose Models served by Model Providers located elsewhere, or do not include personal data in your Inputs.

7. Cookies and Similar Technologies

We use:

Strictly necessary cookies to keep you signed in, protect forms from bots, and keep the Service secure. These cannot be turned off.
Preference cookies to remember settings such as language.
Analytics and ad measurement cookies (Google Analytics, Google Ads) to understand how visitors use our website and to measure whether our Google ads lead to sign-ups and purchases, only with your consent where the law requires it.

We do not use cookies for personalized advertising or remarketing. You can change your choices at any time through Cookie Settings in the website footer, and you can also block or delete cookies in your browser. Google provides an opt-out add-on at https://tools.google.com/dlpage/gaoptout.

8. Data Retention

We keep personal data only as long as needed for the purposes in this policy:

Account information: while your account is active, and for a short period after closure to handle final billing, refunds, and disputes.
Payment and transaction records: at least seven (7) years, as required by Hong Kong tax and accounting rules.
Usage metadata: for as long as needed for billing, support, security, and dispute handling, and then deleted or aggregated.
Sign-in records and daily IP summaries: 180 days, then deleted.
Request and response content: not stored for ordinary traffic; where kept under Section 2.3, deleted once the investigation or legal requirement ends.
Support communications: for as long as needed to resolve your request and keep a reasonable record of it.

When data is no longer needed, we delete it or make it anonymous.

9. Security

We use administrative, technical, and organizational measures designed to protect personal data, including encryption in transit (HTTPS/TLS), hashed passwords, access controls limited to authorized personnel, and monitoring for suspicious activity. You can rotate or revoke API Keys at any time in the dashboard. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a data breach that affects your personal data, we will notify you and the relevant authorities as required by law.

10. Your Rights and Choices

Depending on where you live, you may have the right to:

access the personal data we hold about you and receive a copy of it;
correct inaccurate personal data;
delete your personal data, subject to legal retention requirements;
object to or restrict certain processing;
data portability, receiving certain data in a structured, machine-readable format;
withdraw consent where processing is based on consent, without affecting earlier processing; and
opt out of marketing emails.

Under Hong Kong's Personal Data (Privacy) Ordinance, you may request access to and correction of your personal data; we may charge a fee that is not excessive for a data access request, as permitted by law. Residents of California and other U.S. states with privacy laws have the rights to know, delete, and correct, and the right not to be discriminated against for exercising these rights.

You can update some account details directly in the dashboard. To make any other request, email support@a2agent.me from the email address registered to your account. We may need to verify your identity before responding, and we will respond within the time required by applicable law. You may also lodge a complaint with your local data protection authority, including Hong Kong's Office of the Privacy Commissioner for Personal Data.

Marketing emails: you can unsubscribe using the link in any marketing email. We will still send service messages such as receipts and security alerts.

11. Children

The Service is intended only for users who are at least 18 years old. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact us and we will delete it.

12. Third-Party Links and Integrations

The Service may link to or work with third-party websites, tools, and integrations, such as coding assistants, sign-in providers, and community platforms (for example, Discord and GitHub). Their privacy practices are governed by their own policies, not this one.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and change the "Last updated" date. If we make material changes to how we collect, use, or share personal data, we will notify account holders by email or in the dashboard before the changes take effect.

14. Contact Us

Omnimodel Technology Limited
Unit 903, 9/F., Cameron Comm Centre, 458-468 Hennessy Road, Causeway Bay, Hong Kong
Email: support@a2agent.me