Privacy Policy

Version 2 · last updated 19 October 2026

Effective date: 2026-10-19

1. Who we are

MIRASTACK LABS PRIVATE LIMITED, 4th floor, Survey No. 322(P), Myscape Weave, Financial District, Hyderabad, Telangana 500089, India, is the controller of your personal data for endlesstokens. We follow the Digital Personal Data Protection Act 2023 and the Information Technology Act 2000 with the SPDI Rules 2011.

2. What we collect

Account: email, name, and your GitHub or Google identifier if you sign in with them.
Billing: billing name, country, state, ZIP, city, address and GSTIN (if given).
Country derived from your IP address.
Payments: payment identifiers, amounts and status. Razorpay handles card details; we do not receive them.
Request metadata for each API call: time, account and key, model, GPU, format, status, token counts, timings and IP address.
Daily usage totals per account, and one-way hashed values of your sessions and IP addresses used to count distinct sessions (served requests only) and IPs per day.
Emails we send you and your support messages.

3. Prompts and completions

We do not store your prompts or completions. They are passed to the model and returned to you. We keep only the metadata above.

4. Why we use it

To provide the service, bill you and meet tax obligations, secure the service and prevent abuse, and give support and service emails. We rely on your consent at sign-up and on the legitimate uses the DPDP Act allows.

5. What we do not do

We do not sell personal data. We use no advertising trackers and no analytics cookies.

6. Cookies

The portal sets only two essential cookies:

et_session: keeps you signed in (HttpOnly, SameSite=Lax, Secure in production, expires with your session lifetime).
et_csrf: protects against cross-site request forgery (same attributes, readable by the page so it can send it back).

Both are removed when you sign out.

7. Retention

Request metadata (request logs): 180 days, then deleted automatically.
Invoices and financial records: 72 months.
Daily usage totals and the hashed session and IP values: kept with financial records. We do not delete them automatically.
Audit log (records of account and admin actions): kept with financial records. We do not delete it automatically.
Email log (record of which service emails we sent): no automatic deletion; kept with financial records.
Account data: until you delete your account, then anonymised as described in section 11.

8. Your rights

You may access and correct your data, erase it (delete your account in account settings), seek grievance redressal, and nominate another person to exercise your rights if you die or cannot act. Write to support@endlesstokens.ai.

9. Children

The service is not for people under 18.

10. Processors and transfers

Your data may be processed outside India by:

Cloudflare (network);
Razorpay (payments);
Zoho ZeptoMail and Amazon SES (email);
GitHub and Google (sign-in, if you use them);
cloud infrastructure and GPU hosting providers (named when chosen).

11. Deleting your account

When you delete your account:

your email is replaced with a placeholder address;
your name, billing name, ZIP, GSTIN, address line and city are cleared;
your sign-in links (GitHub and Google) are removed;
your active API keys are revoked;
your waitlist entries are deleted;
we send a confirmation to your previous email address.

We keep your billing country, billing state and sign-up IP country, your request metadata until its retention period ends, and the audit log. Invoices keep the billing details as they were at the time of sale, as the law requires.

12. Data breaches

We notify the Data Protection Board and affected people as the DPDP Act requires.

13. Grievance Officer

Shiva Kumar RV, Founder & CEO, MIRASTACK LABS PRIVATE LIMITED, support@endlesstokens.ai. We acknowledge complaints within 24 hours and resolve them within 15 days.

14. Changes

We notify material changes by email and on the site at least 7 days before they take effect.

1. Who we are

2. What we collect

Account: email, name, and your GitHub or Google identifier if you sign in with them.

Billing: billing name, country, state, ZIP, city, address and GSTIN (if given).

Country derived from your IP address.

Payments: payment identifiers, amounts and status. Razorpay handles card details; we do not receive them.

Request metadata for each API call: time, account and key, model, GPU, format, status, token counts, timings and IP address.

Daily usage totals per account, and one-way hashed values of your sessions and IP addresses used to count distinct sessions (served requests only) and IPs per day.

Emails we send you and your support messages.

6. Cookies

The portal sets only two essential cookies:

et_session: keeps you signed in (HttpOnly, SameSite=Lax, Secure in production, expires with your session lifetime).

et_csrf: protects against cross-site request forgery (same attributes, readable by the page so it can send it back).

Both are removed when you sign out.

7. Retention

Request metadata (request logs): 180 days, then deleted automatically.

Invoices and financial records: 72 months.

Daily usage totals and the hashed session and IP values: kept with financial records. We do not delete them automatically.

Audit log (records of account and admin actions): kept with financial records. We do not delete it automatically.

Email log (record of which service emails we sent): no automatic deletion; kept with financial records.

Account data: until you delete your account, then anonymised as described in section 11.

11. Deleting your account

When you delete your account:

your email is replaced with a placeholder address;

your name, billing name, ZIP, GSTIN, address line and city are cleared;

your sign-in links (GitHub and Google) are removed;

your active API keys are revoked;

your waitlist entries are deleted;

we send a confirmation to your previous email address.