Privacy Policy

01Scope

This Policy explains how Plenum Cloud at plenumcloud.ai (an OPTIWAVE platform operated by Guangyuan Weilai (Shanghai) Technology Co., Ltd., "we", "us") collects, uses, stores and protects information when you use the website, console, API and compute onboarding services. It applies to the global site; the mainland China site plenumcloud.com has its own policy.

02Information we collect

Account information: registration email and password. Passwords are stored only as salted hashes (PBKDF2-HMAC-SHA256); we cannot read them in plaintext.

API key metadata: name, prefix, creation and revocation time. A key's plaintext is shown once at creation; only a hash is stored afterwards.

Usage records: for each request, the timestamp, model, key used, input / cached-input / output / reasoning token counts, status code, latency and the upstream routed to. These records are the basis for billing and reconciliation.

Payment information: top-up order amounts, the invoice name and tax ID you provide, and the bank reference of incoming wires. We do not collect card numbers.

Technical information: source IP addresses for rate limiting and brute-force protection; session credentials and interface preferences (language, theme) in browser local storage.

Compute provider information: node name, endpoint address and access credentials, hourly rate and probe results, and payout bank details. Credentials are used only to send inference probes and customer requests to that node and are never shown to other customers.

03How request content is handled

Prompts you submit and the content generated are used to complete the inference request and are forwarded to the inference node or third-party model provider serving it (for example OpenAI), which processes them under its own terms and privacy policy. The usage ledger records only token counts and metadata, not request or response bodies. Customer data is never used for model training.

04How we use information and legal bases

To provide and maintain the Services, route requests and fail over, meter and bill usage, enforce rate limits and security, meet legal obligations (such as tax and anti-fraud), and send service notices where you have agreed. For users covered by the GDPR / UK GDPR, our legal bases are performance of a contract, legitimate interests (service security and abuse prevention) and legal obligations.

05Sharing and international transfers

To complete an inference request, its content is passed to the compute node or third-party model provider serving it; we require them to process data solely for that purpose. We do not otherwise disclose your information to third parties, nor sell it, except as required by law or with your explicit authorisation.

The global site's servers are located in the United States, and third-party model providers may be located in other countries. Your information may therefore be stored and processed outside your jurisdiction; we rely on contractual safeguards and other measures required by applicable law to protect such transfers.

06Storage and retention

Account, usage-ledger and order information is stored on servers in the United States. Usage records are retained as needed for billing, reconciliation and tax obligations; account information is kept for the life of the account and deleted or anonymised after closure within the period permitted by applicable law; revoked API keys retain only their hash and revocation record.

07Security

Passwords are stored as salted hashes; session credentials are signed, versioned tokens, and changing your password invalidates sessions on other devices; API keys are shown once and stored as hashes; the login endpoint is rate-limited per source against brute force; data files are kept with minimal permissions and backed up regularly to private storage; all transport is encrypted with TLS.

08Cookies and local storage

The website and console use no third-party tracking or analytics cookies. Browser local storage holds only the login session and interface preferences; signing out clears the session.

09Your rights

Depending on where you live, you may have the right to access, correct or delete your personal information, to restrict or object to processing, to obtain a copy of your data (portability), to withdraw consent, and to lodge a complaint with your local supervisory authority. You can view and export usage records, manage API keys and change your password in the console; for other requests, contact us through the channels published on our website and we will respond within the period required by applicable law (generally 30 days).

10Minors

The Services are intended for businesses and developers, not for anyone under 18. If we learn that a minor has provided personal information, we will delete it.

11Changes

Updates to this Policy are dated on this page; material changes are announced via the console or email. The English version prevails; the Chinese text is a courtesy translation.

12Contact

For questions about this Policy or to exercise your rights, contact us through the channels published in the website footer (Guangyuan Weilai (Shanghai) Technology Co., Ltd., Room 1709, Canxing Building, 158 Longqi Road, Xuhui District, Shanghai, China).