Privacy Policy
Effective date: 30 September 2026
This Privacy Policy explains how Harvanera Limited ("Harvanera", "we", "us" or "our") handles personal data when you visit our website, create an account, make a payment, contact us or use our dashboard and API (together, the "Service"). Please read it together with our Terms of Service, Cookie Policy
1. Who is responsible for your data
Harvanera Limited is a private company limited by shares incorporated in Hong Kong, registration number 81275806. Our registered office is Unit 704C, 7/F, Block 3, Nan Fung Industrial City, 18 Tin Hau Road, Tuen Mun, N.T., Hong Kong. You can contact us about privacy at info@harvanera.com.
We decide how and why we process information about visitors, account holders and people who contact us. When a business customer sends personal data about its own users through our API, that customer may determine the purposes of processing and we may process that data on its behalf to provide the Service. The customer's own privacy notice should explain its use of that data. Where applicable law requires additional contractual terms for that processing, those terms must be in place before the data is submitted through the Service.
2. Information we collect
| Category | What it may include | How we receive it |
|---|---|---|
| Account and sign-in information | Email address, account identifier, authentication information, and any name or profile details you provide | From you or, if you choose Google sign-in, from Google |
| Billing and transaction information | Top-up amount and currency, resulting USD balance, exchange rate shown at checkout, payment status, transaction references, refunds and invoice details | From you, our payment service provider and our own transaction records |
| API request metadata | Model selected, usage units such as input and output tokens, charge, timestamp, API key identifier, IP address and request status | Generated when you use the Service |
| Technical and security information | IP address, browser or device information, session information and security events | From your device and our systems |
| Settings and preferences | API key names and spending limits, language and currency preferences, and whether you enabled request logging | From your account settings and use of the Service |
| Support communications | Messages you send us, any documents you provide in support of a request, and our replies | From you and our support records |
| Request content | Prompts, files, parameters and model responses | From API requests you make or that are made using your account |
An email address or a supported Google sign-in is needed to create an account. Payment details are needed to add paid balance. API request metadata is needed to deliver and bill requests. If you do not provide information needed for one of these purposes, we may be unable to provide that part of the Service. Support messages and optional profile details are voluntary.
Card payments are handled by a third-party payment service provider. We do not request or store your full payment-card number. The payment provider sends us information needed to confirm and administer the transaction. It may also perform its own fraud and payment checks under its privacy notice.
3. Prompts, responses and logging
When you select a model, we transmit the content of your request to the provider operating that model so it can generate a response. This transmission occurs whether or not request logging is enabled.
By default, we do not store the content of your prompts or responses as a request history. We store request metadata for billing, account history, security and support. If you enable request logging in your dashboard, we store the content of requests and responses so you can review it. Turning logging off stops the creation of new content logs; it does not by itself change how a Model Provider handles data it has already received.
We do not use your prompts or responses to train models. A Model Provider may process or retain request content under its own terms, for example to operate its model, prevent abuse or meet legal obligations. Review the information about the selected provider before sending sensitive content. Do not include another person's sensitive personal data unless you have a lawful basis and a need to submit it.
4. Why we use personal data
We use personal data to:
- register and authenticate accounts, manage API keys and settings, forward requests to the selected Model Provider and return responses;
- display usage, calculate charges, process top-ups and refunds, and issue receipts or invoices;
- answer questions, investigate support requests and communicate service or account changes;
- keep the Service secure, detect fraud or abuse, enforce our Terms and comply with applicable sanctions and other legal requirements;
- maintain business, tax and accounting records and establish, exercise or defend legal claims; and
- operate necessary website and account features and honour the privacy choices available on the Service.
Where EU or UK data protection law applies to processing for which we are the controller, we use the following legal bases as applicable:
| Purpose | Legal basis |
|---|---|
| Creating an account, delivering requests, maintaining a prepaid balance and providing requested support | Performance of our contract with you, or steps taken at your request before entering it |
| Tax and accounting records, and compliance with legal requirements that apply to us | Compliance with a legal obligation |
| Security, fraud prevention, abuse investigations, service administration and the defence of claims | Our legitimate interests in protecting the Service, our users and our legal rights, unless those interests are overridden by your rights |
| Request content logging that you choose to enable | Providing the logging feature you request as part of the Service |
| Optional cookies or direct marketing, if introduced and where consent is required | Your consent, which you can withdraw |
When we process a business customer's end-user data on its behalf, that customer is responsible for identifying the legal basis for its own use of the data and for giving any required notices to its users. Our processing for that customer is subject to the applicable data-processing arrangements.
We may use automated signals to identify suspicious sign-ups, payments or requests. Our payment service provider may separately decide whether to accept a payment. If an automated check affects your access to the Service, contact info@harvanera.com. Any right to contest a decision made solely by automated means under applicable law remains unaffected.
5. Who receives personal data
We disclose personal data only as needed for the purposes above, to the following classes of recipients:
- Model Providers: the provider of the model you select receives request content and the technical information needed to process it. Currently this is DeepInfra, Inc. (United States), which runs the models available on the Service. We will update this list before any other provider receives request content. A provider's own terms and privacy notice may govern some of its processing.
- Service providers: companies that provide hosting, technical infrastructure, payment processing, authentication, email delivery or customer-support services. They receive only the information needed for their role.
- Google: if you choose Google sign-in, information is exchanged to authenticate your account.
- Professional advisers and transaction parties: lawyers, accountants, auditors and, if relevant, a purchaser or successor to our business, subject to appropriate protections.
- Public authorities and other parties: where disclosure is required by law, necessary to protect legal rights or needed to respond to a valid legal request.
We do not sell personal data or disclose it for cross-context behavioural advertising.
6. Processing outside Hong Kong
Harvanera is based in Hong Kong. The Model Provider you choose and the companies supporting our website, payments and communications may process data in other countries. Depending on the selected model and the services involved, these may include the United States, mainland China and other locations. The Service is unavailable to customers in the locations listed in our Terms of Service; this does not mean that a provider located in one of those places cannot receive a request where lawful and disclosed here.
Different countries have different data protection laws. We take account of the laws that apply to a transfer and of the recipient's role and protections. If EU or UK transfer rules apply, an applicable legal transfer mechanism and any required safeguards must be in place. You can ask info@harvanera.com for information about the arrangements relevant to a particular provider or transfer.
7. How long we keep data
We keep personal data for the time needed for the purpose for which it was collected, taking account of the account's status, the need to provide the Service, security investigations, refunds, disputes and legal obligations. We then delete or anonymise it unless another lawful reason requires us to keep it. In particular:
| Data | Retention approach |
|---|---|
| Account information and settings | While the account is open, then only as long as needed to complete closure, resolve outstanding matters or meet a legal duty |
| Request metadata | As needed to show usage, calculate charges, investigate errors or abuse and handle disputes; no longer than necessary for those purposes |
| Request content when logging is off | Processed to fulfil the request; not stored by us as a request history |
| Request content when logging is on | Stored to provide the feature while logging is enabled and for the period needed to manage existing logs; we may keep limited information for an unresolved security or legal matter where permitted |
| Security logs and support communications | For as long as needed to investigate security events, respond to you, resolve disputes or protect legal rights |
| Business and accounting records | For at least seven years after the transactions they document where Hong Kong record-keeping law applies, and longer only if another legal duty or unresolved claim requires it |
Model Providers and payment service providers have their own retention practices. Their privacy notices may apply to information they receive. Turning off request logging or closing your Harvanera account does not itself delete records held by those independent providers.
8. How we protect data
We use technical and organisational measures designed to protect personal data against unauthorised or accidental access, processing, loss or misuse. These include controls over who can access data and protections for data transmitted over the network. We review access and security events as appropriate. No internet service can guarantee absolute security. If a security incident affects personal data, we will investigate and give notices required by applicable law.
Keep your password and API keys confidential. If you suspect a key has leaked, revoke it in your dashboard and contact info@harvanera.com promptly, as explained in our Terms of Service.
9. Your choices and rights
You can turn request logging on or off in your dashboard, manage your API keys and spending limits, and ask to close your account. You can also contact us about access to, or correction of, personal data we hold about you.
The rights available to you depend on the law that applies. They may include the rights to access and correct data; request deletion, restriction or portability; object to certain processing; and withdraw consent where consent is the basis for processing. Withdrawal does not affect processing already carried out lawfully. Some requests may be limited where we must retain records or another legal exception applies.
Send requests to info@harvanera.com or by post to the address in section 1. We may ask for information reasonably needed to verify your identity and locate your records. We will respond within the time required by applicable law. Under Hong Kong's Personal Data (Privacy) Ordinance, requests for access and correction are generally subject to a 40-calendar-day response period, with statutory exceptions and procedures. Where the EU or UK GDPR applies, the usual response period for rights requests is one month, subject to lawful extensions. Hong Kong law permits a reasonable, non-excessive fee for complying with a data-access request.
If you have a complaint about our handling of personal data, contact info@harvanera.com. We will investigate and respond. Where UK data protection complaint rules apply, we will acknowledge the complaint within 30 days and respond without undue delay. You may also contact the relevant data protection authority, including the Privacy Commissioner for Personal Data in Hong Kong, the UK Information Commissioner's Office or the data protection authority in an EU/EEA country where you have the right to complain.
10. Cookies
Cookies and similar technologies support account sign-in, security and site preferences. Our Cookie Policy explains the technologies used, their purposes and the controls available to you. If we use optional technologies that require consent under applicable law, we will ask for that consent before using them and provide a way to change your choice.
11. Children
The Service is for people aged 18 or older. We do not knowingly offer accounts to children. If you believe a child has created an account or submitted personal data, email info@harvanera.com so we can investigate and take appropriate steps, including deletion where required and permitted by law.
12. Hong Kong Personal Information Collection Statement
For the purposes of Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486):
- Purpose: We collect personal data to provide and bill the Service, manage accounts, secure the platform, prevent fraud and abuse, answer requests, maintain records and comply with legal duties, as described in section 4.
- Obligatory or voluntary provision: Information necessary to open an account, process a paid top-up or deliver a request is required for that activity. Optional profile information, support messages and enabling content logging are voluntary. The consequences of not providing required information are explained in section 2.
- Classes of transferees: Data may go to the recipients described in section 5, including Model Providers, service providers, advisers, authorities and a successor to the business. Some recipients may be outside Hong Kong, as explained in section 6.
- Access and correction: You may direct data-access and data-correction requests to our privacy contact at info@harvanera.com or Harvanera Limited, Unit 704C, 7/F, Block 3, Nan Fung Industrial City, 18 Tin Hau Road, Tuen Mun, N.T., Hong Kong. Applicable procedures and fees are described in section 9.
We will give any separate notice and obtain any consent required by Hong Kong law before using personal data for direct marketing.
13. Additional information for people in Brazil
Where Brazil's General Personal Data Protection Law (Lei Geral de Proteção de Dados Pessoais, or LGPD) applies, Harvanera Limited is responsible for the processing described in this Policy when it determines the purposes and means of that processing. Sections 2, 4, 5 and 7 explain the categories of data, the purposes and duration of processing, and the classes of recipients. Send requests concerning your personal data to info@harvanera.com.
Subject to the conditions and exceptions in the LGPD, you may request confirmation that we process your data; access to it; correction of incomplete, inaccurate or outdated data; anonymisation, blocking or deletion of data processed unnecessarily, excessively or contrary to law; portability where applicable; information about entities with which data is shared; and information about the consequences of withholding consent. Where processing is based on your consent, you may withdraw it and request deletion of data processed on that basis, subject to legal exceptions. You may also request a review of a decision made solely by automated processing where the LGPD gives you that right.
As described in section 6, personal data may be processed outside Brazil. Where the LGPD applies to an international transfer, the transfer must meet the conditions of that law and the rules of Brazil's National Data Protection Authority (ANPD). Contact us for information about a transfer relevant to your data. If you are unable to resolve a rights request with us, you may petition the ANPD as provided by Brazilian law.
14. Additional information for people in Japan
Where Japan's Act on the Protection of Personal Information (APPI) applies, the purposes for which we use personal information are described in section 4. The categories of recipients and the possibility of processing outside Japan are described in sections 5 and 6.
Subject to the conditions in the APPI, you may request disclosure of personal data we retain about you, correction or addition of inaccurate data, or suspension of use, deletion or suspension of third-party provision where the law permits. Send your request to info@harvanera.com. We may ask for information needed to verify your identity and locate the data.
When an API request contains personal data, the selected Model Provider may receive it outside Japan. If the APPI requires consent before personal data is provided to a third party in another country, we will provide the information required by that law and obtain the required consent before the transfer, unless a lawful exception or another permitted arrangement applies. You can ask us about the recipient and its data-protection measures before selecting a model.
15. Changes to this policy
We may update this Policy to reflect changes in our Service, providers or legal obligations. We will publish the updated Policy with a new effective date. If a change materially affects how we handle personal data, we will give additional notice through an appropriate channel before the change takes effect where required by law.
16. Contact
Harvanera Limited
Registration number: 81275806
Registered office: Unit 704C, 7/F, Block 3, Nan Fung Industrial City, 18 Tin Hau Road, Tuen Mun, N.T., Hong Kong
Privacy requests and complaints: info@harvanera.com