Privacy Policy

1. Introduction and Scope

Fibonacci Ventures ("we", "us", or "our") operates asAi (the "Service"), an API gateway that connects users with third-party artificial intelligence infrastructure. This Privacy Policy explains how we handle personal information in connection with the Service, including our website, account dashboard, API access, payment administration, and customer support.

This Policy distinguishes information held by us for account administration and billing from content transmitted to third-party infrastructure to fulfil an AI request. It should be read together with our Terms of Service, which explain the contractual conditions for using the Service.

This Policy does not govern websites, applications, banking services, or other products operated independently by third parties. If you access asAi through an application supplied by someone else, that application's operator may also collect and process information under its own privacy notice.

2. Responsibility for Personal Information

Fibonacci Ventures is responsible for personal information that it collects and uses for its own account management, billing, support, and service-administration purposes. You may contact us at the address or email above with questions about that processing.

If you submit personal information about another person, you are responsible for having the authority and any notices or permissions required to submit that information. This does not remove our own obligations under applicable law. Business customers should assess whether their intended use requires a separate data-processing agreement or additional safeguards before transmitting personal information through the Service; this Policy is not such an agreement.

3. Information You Provide

3.1 Account and identity information

When you register or maintain an account, we process your email address, account identifier, verification status, and relevant account settings. If you register using Google OAuth, we receive information provided through that sign-in flow, which may include your name and email address. We do not receive your Google account password through OAuth.

For email-and-password registration, passwords are stored in hashed form rather than as readable plaintext. Account information is used to recognise you, administer access, and support account recovery or verification where available.

3.2 Payments and credit administration

We process information necessary to reconcile prepaid top-ups and maintain credit records. This may include the selected purchase quantity, top-up amount, applicable coupon, transaction total, payment reference, confirmation status, and any payment evidence you provide.

QR transfers are initiated through your own banking application. We do not directly collect your banking password, PIN, or one-time banking authentication code. If you send a receipt or screenshot, it may contain names, account details, or other personal information. Please remove unrelated information before sending it, while retaining the details needed to identify your payment.

3.3 Support and correspondence

We process the information you choose to include in support requests, complaints, billing enquiries, or other correspondence. This may include your contact details, account reference, description of an issue, and attachments. Do not include passwords, complete API keys, or unnecessary personal information in an ordinary support message.

Information voluntarily included in a support attachment is handled as support correspondence. The request-processing limitations described below do not mean that a prompt copied into an email or screenshot will automatically disappear when the associated API request finishes.

4. API Credentials and Usage Records

4.1 API keys

API keys are credentials that permit access to the Service. We maintain key-related records, such as identifiers, labels, ownership, creation information, and revocation status. Key material is stored encrypted at rest, and authentication uses a derived key hash.

Encryption does not mean that a key can never be retrieved. The Service supports authenticated retrieval of eligible keys by the account holder and restricted administrative retrieval. Administrative key-reveal actions are audit-logged. You should therefore protect both your API credentials and the account session through which key-management functions can be accessed.

4.2 Usage and billing metadata

We retain usage metadata to administer the Service and account for consumption. These records may include request timestamps, account and key identifiers, selected model alias, request status, token quantities, calculated cost, credit debits, and billing adjustments.

Usage metadata is distinct from the text of a prompt or response. However, it can still reveal when and how frequently an account uses the Service and is treated as account-related information rather than anonymous data.

5. Prompts, Outputs, and Request Processing

To fulfil an API request, we receive the content and parameters you submit and transmit the relevant information to third-party AI infrastructure. Request content may include prompts, conversation context, attachments, or other supported inputs. The resulting output is returned through the Service to the requesting application.

Our gateway's request-processing policy is not to persist prompt or Output content after the processing needed to fulfil and return a request. This is not a promise that no computer temporarily handles the content: processing necessarily involves transmission and temporary handling by the systems involved. We retain the usage and billing metadata described in Section 4.

Studio conversations are a separate persisted feature. When you use Studio chat, prompts and assistant replies are stored in our account database so that the conversation can be reopened across sessions and devices. Studio generated images may be retained in private storage for up to 15 days and are linked to the conversation until you delete the conversation or the retention period ends. Each account has a 100 MB retained-image quota. These limits and the deletion path are described in the Studio interface and may be subject to the account controls shown there.

Deleting a Studio conversation deletes its stored messages and linked retained images, subject to temporary technical copies and lawful retention requirements. An inline image uploaded for editing is processed for that request and is not retained as a separate source image after processing. Do not upload information you are not authorised to process.

This gateway policy does not apply to copies independently stored by your own application, your device, an integration you use, or an upstream provider. It also does not apply to content you separately send us as support correspondence, as explained in Section 3.3.

Studio document uploads are stored in private temporary storage while they are processed. Uploaded bytes and extracted text are deleted after 24 hours, and earlier when you delete the document, delete its thread, or delete your account, subject to temporary technical copies and lawful retention requirements. Document excerpts are sent to the selected third-party AI provider when you press Send. We do not retain raw document content in ordinary logs. Do not upload information you are not authorised to process.

Document scanning and parser controls reduce risk but are not guaranteed against malware or prompt injection. Treat extracted text as untrusted content and review model output before relying on it. This feature does not create a promise that every upstream provider has zero retention or identical controls.

Studio document handles are private, owner- and thread-bound references. They are not public download links. Deleting a document revokes its handle and removes its private temporary content when cleanup runs.

6. Technical Information and Website Storage

Operating an online service involves handling technical information needed to establish connections, authenticate sessions, route traffic, and diagnose failures. This may include connection information, request headers, session identifiers, timestamps, and error or security-event information.

The gateway's content-retention policy should not be read as a claim that hosting, network, proxy, security, or upstream services never process or retain IP addresses or operational logs. Their handling of technical information may differ from the gateway's handling of prompt and output content.

Authentication and account features may rely on cookies or similar browser storage. Browser settings can restrict or clear that storage, but doing so may sign you out or prevent account features from working.

We maintain an aggregate page-view counter for the homepage and sign-in page. It records the page category, date, count, and update time only. The counter does not store your IP address, email address, account identity, user agent, or a persistent visitor identifier.

7. Purposes for Which We Use Information

We use relevant information for the following service-related purposes:

• Creating, verifying, maintaining, and securing accounts.
• Authenticating API requests and administering key issuance, retrieval, rotation, and revocation.
• Routing requests and returning generated responses.
• Calculating consumption, applying credit debits, reconciling top-ups, and investigating billing discrepancies.
• Applying rate and concurrency limits and maintaining service stability.
• Answering support enquiries, investigating reported failures, and maintaining accountability for administrative actions.
• Detecting and responding to suspected fraud, unauthorised access, abuse, and breaches of the Terms of Service.
• Sending account-verification messages, payment information, security notices, and material service updates.
• Maintaining records reasonably needed for accounting, disputes, and compliance with applicable legal obligations.

We seek to limit the information used for each purpose to what is relevant to that purpose. Where applicable law requires consent or another condition before particular processing may take place, that requirement continues to apply; the publication of this Policy does not replace it.

8. Third-Party Infrastructure and Disclosures

We do not sell your personal information. We disclose information where reasonably necessary for the purposes described in this Policy, including to the following categories of recipients:

AI infrastructure providers. Relevant request content and parameters are transmitted to infrastructure that generates the requested response. Model aliases are service-facing labels and do not necessarily identify the organisation processing a request.

Operational service providers. Hosting, network, communications, and other service providers may handle information needed to deliver their part of the Service. Access should be limited to the purpose for which the provider is engaged, subject to applicable contractual and legal requirements. This Policy does not certify that every provider has identical safeguards.

Authentication and payment-related services. Google processes information when you use its sign-in service. Your bank or payment application processes a QR transfer under its own terms and privacy arrangements. We receive the account or payment information needed for our part of the transaction.

Legal and protective disclosures. We may disclose information where required by applicable law or a valid legal process, or where permitted by law and reasonably necessary to investigate fraud, protect rights or safety, or establish, exercise, or defend a legal claim.

Specific upstream relationships are treated as confidential commercial information. That confidentiality does not override any disclosure, transparency, or other obligation imposed by applicable law. Contact us before using the Service if your compliance requirements depend on knowing a specific processing party or obtaining contractual assurances that are not provided here.

9. Processing Outside Malaysia

The Service relies on interconnected third-party infrastructure. Depending on the routing and providers involved, information may be transmitted to or processed in countries other than Malaysia. We do not promise that all information remains in Malaysia or within a location selected by a customer.

Other countries may have different data-protection requirements and rules concerning access by public authorities. Applicable requirements for international transfers must be considered where they apply. If your use requires a particular hosting region, transfer mechanism, or geographic restriction, obtain written confirmation that we can meet it before submitting the relevant information.

10. Security and Confidential Information

We use technical and organisational safeguards intended to reduce the risk of unauthorised access, disclosure, alteration, or loss. These include hashed passwords, encryption of stored API key material, access restrictions, and audit records for administrative key retrieval.

No online service, encryption method, or access-control system can guarantee complete security. Our safeguards do not eliminate risks arising from compromised devices, exposed keys, unsafe integrations, or independent third-party systems.

Use an appropriate password, protect signed-in devices, and revoke or rotate a key promptly if you believe it has been exposed. Contact us about suspected account compromise without including the compromised secret in your message. Where a security incident creates notification or other duties under applicable law, those duties are not excluded by this Policy.

Before submitting sensitive, confidential, or regulated information, consider whether the Service and its upstream processing are appropriate for that information. We do not recommend submitting information you would not want processed by third-party infrastructure. This caution does not waive rights or responsibilities that applicable law makes mandatory.

11. Retention and Deletion

Account information is generally retained while the account remains active. Billing, transaction, usage, support, and administrative records may need to remain available afterward for accounting, reconciliation, security investigations, legal compliance, or dispute resolution.

Studio conversations are stored until you delete the conversation or the account, subject to the same technical and lawful-retention limits. Linked retained images are normally deleted with the conversation or automatically after up to 15 days. Retained Studio images count toward a 100 MB per-account quota. Inline edit source images are not retained as separate source artifacts after the request is processed.

Retention depends on the type of record, the purpose for which it is needed, unresolved issues, and applicable legal requirements. We do not promise a single deletion period for every category or an immediate removal from every backup following an account-closure request. Information retained after closure should remain subject to appropriate restrictions and should not be kept indefinitely without a continuing reason.

Prompt and output handling is described separately in Section 5. Deleting an asAi account does not automatically delete copies independently held by your own application or third parties.

You may request account closure and deletion by contacting us. We may need to verify your identity and identify records that must remain. Where we cannot fulfil a deletion request in full, we will explain the relevant limitation, subject to any lawful restriction on disclosure.

12. Your Requests and Choices

Subject to applicable law, you may contact us to request access to personal information we hold about you, correction of inaccurate or incomplete information, deletion where available, or information about our handling of your data. You may also ask about withdrawing consent where processing relies on consent, or raise an objection or concern about particular processing.

The availability and scope of a right depend on the applicable law and circumstances. We do not promise rights that apply only in a particular jurisdiction to every user worldwide. We will assess requests under the requirements that apply and explain relevant limitations.

Send requests to [email protected] using the email associated with your account where possible. Describe the request and include enough non-secret information to identify the account. We may ask for proportionate verification to avoid disclosing or deleting information at the request of an unauthorised person. We will respond within any applicable statutory timeframe; this Policy does not introduce a separate guaranteed response period.

You can choose not to provide optional information. However, without information necessary for verification, payment reconciliation, or request processing, we may be unable to provide the corresponding feature. Withdrawing consent does not automatically invalidate processing already lawfully carried out.

13. Children and Account Eligibility

The Service is not specifically directed at children. Account eligibility is subject to the legal-capacity requirements in the Terms of Service. Where a person lacks the legal capacity to enter into the agreement independently, a parent or legal guardian must provide any legally required authorisation and supervision.

If you believe a child has provided personal information without the authorisation required by law, contact us with the relevant account details. We will assess the situation and take appropriate action, which may include restricting access or deleting information subject to lawful retention requirements.

14. Changes to This Policy

We may revise this Policy to reflect changes to the Service, processing practices, or legal requirements. The effective date will identify when the published revision takes effect. Material changes will be announced through the dashboard or official service channels.

Where a change requires consent or additional notice under applicable law, we will not treat continued use alone as a substitute for that requirement. Please review the Policy periodically, particularly before using the Service for a new category of information.

15. Questions, Complaints, and Applicable Law

This Policy is intended to operate consistently with applicable Malaysian law. It does not exclude any mandatory protection that applies to your personal information or prevent you from raising a complaint with a competent data-protection authority where the law provides that right.

For privacy questions, requests, or complaints, contact:

Fibonacci Ventures
D-15, Endah Promenade, Sri Petaling, 57100 Kuala Lumpur, Malaysia
Email: [email protected]

Please identify the issue and the outcome you are seeking. Do not send passwords, complete API keys, banking authentication codes, or unrelated sensitive records.