1. Who we are
apiai.me is operated by Zebro Labs. When we say "we", "us", or "our", we mean Zebro Labs. Our website is https://apiai.me.
2. What data we collect
We collect:
- Account data — your email address and company name when you register. There are no passwords: you sign in with a code we email you, or with your Google account.
- Sign-up signals — when an account is created we record the IP address, browser (user agent) and country it was created from, to detect and stop abuse of the free trial credit.
- Google account data — if you sign in with Google, Google tells us your email address, whether Google has verified it, and your name. We use the email address to find or create your account; we do not receive your Google password or access to anything else in your Google account.
- Usage data — API requests made, timestamps, workflow slugs, and cost data for billing purposes.
- Images and files — files you submit to workflows are processed and immediately discarded. We do not store uploaded images after processing. The one exception is results returned to an AI assistant you have connected to your account (for example Claude or ChatGPT): each is kept for 24 hours behind a private, unguessable link so you can download it, and then deleted. If you give an assistant an image link, we download that image only to process it. An image you upload through a link an assistant gives you is kept for 2 hours, so the assistant can use it, and then deleted.
- Payment data — handled entirely by Stripe. We do not store card numbers or payment details.
3. How we use your data
We use your data to:
- Provide and bill for the API service.
- Send transactional emails (verification codes, receipts).
- Monitor system health and debug errors.
We do not sell your data to third parties. We do not use your data to train AI models.
4. Data retention
Usage logs are retained for 90 days. Results kept for connected AI assistants are deleted after 24 hours, and images uploaded for them after 2 hours. Account data is retained until you delete your account. You can request deletion by contacting us at apiai.me/contact.
5. Third-party services
We use the following third-party services to operate the platform:
- Stripe — payment processing
- Google Gemini, xAI, OpenAI, Replicate — AI model providers (your prompts and images may be sent to these services as part of workflow execution)
- MailerSend — transactional email
- Render — cloud hosting
- Google (sign-in) — "Continue with Google" and Google One Tap. For visitors who are not signed in, the homepage and the login page load Google's sign-in script, which lets Google see your IP address and browser and that you visited, and show you a "Use apiai.me with google.com" prompt if you are signed into Google. Nothing is shared with us unless you choose to continue.
- Google Analytics — measures how the website is used (pages visited, approximate location, device and browser). It only sets cookies after you accept them in the cookie banner.
- Meta — the Meta pixel tells us which Facebook and Instagram ads bring people to the site. It only loads after you accept cookies in the cookie banner.
- Cloudflare — DNS, and the Turnstile check on the sign-up form that tells people from bots
6. Cookies
Your dashboard session is kept in your browser's local storage, not in a cookie. Signing in with Google uses short-lived cookies of our own (at most ten minutes) that protect the sign-in from forgery, and Google's sign-in script may use cookies on google.com to recognise that you are signed into Google. These are needed for the site to work.
We ask before setting anything else. Your answer is kept in a cookie called apiai_consent for 180 days. If you accept, Google Analytics sets its own cookies to count visits, the Meta pixel sets its own cookies to measure our Facebook and Instagram ads, and we set two cookies of our own: a random visitor id (apiai_vid) and the campaign or ad link you arrived from (apiai_touch, 30 days), so we can tell which campaigns bring people who sign up and stay. If you accepted, we also tell Meta when you create an account or buy credit, sending your email address only in hashed (scrambled) form, so Meta can measure our Facebook and Instagram ads. If you reject, none of these are set and nothing is sent to Meta. You can change your answer at any time under "Cookie settings" at the bottom of every page.
7. Your rights
You may request access to, correction of, or deletion of your personal data at any time by contacting us at apiai.me/contact.
8. Contact
Questions about this policy? Get in touch.