Privacy Policy
Last updated October 12, 2026
What information Amux collects, how it is used and stored, where data flows, and how you can exercise your rights.
This policy is issued by Amux AI ("we", "us", or "Amux") and explains how we collect, use, share, and protect information when you use the Amux service. For the processing activities described here, the data controller is SentenceEnd Inc., incorporated in the State of Wyoming, United States.
Amux is an LLM API gateway: requests are forwarded to upstream model providers according to your configuration and the results returned to the caller. Because Amux sits in the call path, some data passes through our systems.
1. What we collect
Account information
Registration and sign-in require an email address. When you sign in with Google or GitHub, we receive your email address and avatar from them.
We do not collect passwords — sign-in uses an emailed code or third-party authorization.
Organization accounts also hold the organization name, industry, size, billing email, and other details you provide.
API keys
Keys are stored using envelope encryption, which is why you can view a key in full again on the console's key page without regenerating it.
Decryption happens only when you actively view a key, and that action is recorded in the audit log. A small number of legacy keys issued before retrievable storage shipped keep only a hash and prefix and cannot be shown in full.
Call data
Every call records metadata: time, model, provider, protocol, token usage, duration, status code, and failure reason.
For successful text and chat calls, request and response bodies are not recorded. Prompts and model output are not written to disk once forwarded; we keep only the metadata above.
Failed calls are sampled and retained solely for troubleshooting. When a call fails because of the request itself (for example, an invalid parameter, or the upstream provider cannot fetch an image URL you supplied) or because of a fault in Amux itself, we may keep that request's body, some of its headers, and the error returned by the upstream provider, as follows:
- Only a small number of samples per error category are kept each hour; not every failure is saved;
- Inline binary content such as images, audio, and video is not kept, only its type and size; text in the request, including image URLs, is kept as sent;
- Credentials such as API keys are not kept: authentication headers are not recorded, and content in the request body that looks like a credential is masked; model response bodies are not kept;
- For failures caused by an upstream provider outage, only the upstream error message is kept, not the request body;
- Samples can be viewed only by authorized Amux staff while investigating issues, every view is recorded in the audit log, and samples are kept for no more than 15 days.
If you do not want a particular request retained, send it with the header x-amux-omit-request: true; its body will not be kept if it fails.
Asynchronous generation tasks such as image and video work differently, see Section 3; conversations in the console playground are stored, see below.
Playground conversations
The console playground is a conversational interface, and the messages you send there and the model's replies are stored under your account so that you can view them after a refresh or later.
Conversation content is visible only to you and to workspace admins with the relevant permission. You may delete a single turn or an entire conversation at any time.
For content you would rather not have retained, call the API directly instead of typing it into the playground.
Billing and usage
For invoicing and reconciliation, we retain aggregated usage records and the transaction ledger long-term. This data is kept even after you delete detailed logs — without it, historical invoices cannot be reproduced.
Information needed for payment (legal name, address, tax ID, invoice email) is provided by you. We neither handle nor store your full card number; card details are collected and held directly by the payment provider.
Technical information
Your IP address and browser identifiers when visiting the website, plus a small number of cookies and browser local storage (listed item by item in section 8). We do not use advertising trackers. We use Google Analytics to measure how the site is used; it belongs to a category that requires your consent, described in section 8.
On the call path we also record the client IP, user agent, and the gateway hostname the request arrived on, for troubleshooting and risk management.
On-site search terms
Search terms are recorded to improve documentation coverage and search quality. We record only the de-identified search term itself, the language, the number of results, and whether a result was opened, aggregated into daily counts; we do not record the searcher's identity, IP address, or per-query records.
Terms that look like credentials are discarded in full and email addresses are masked, both preferentially in the browser.
Ticket content
Ticket content and attachments you submit are stored so that we can handle your request. Please do not submit sensitive information in a ticket that you would rather we did not see.
2. How we use it
| Purpose | Data involved |
|---|---|
| Providing the service | Account information, API keys, call data |
| Billing and invoicing | Usage records, transaction ledger, billing details |
| Security and risk management | Technical information, call metadata, audit records |
| Customer support | Account information, ticket content, call records |
| Troubleshooting failed calls | Sampled failed calls (request body, some request headers, upstream error message) |
| Improving the service | Aggregated statistics, on-site search terms |
| Meeting legal obligations | Financial records and, where necessary, logs |
We do not use your requests or responses to train any model, nor for any purpose other than upstream inference and the troubleshooting of failed calls described in Section 1.
3. Where your prompts go
Request content is forwarded to the upstream model provider you select or that routing lands on, and is subject to that provider's own privacy policy. The model catalog states the provider for every model, so you can pin or avoid specific providers.
Generation tasks
For image and video generation, the prompt, reference material, and generation parameters are stored with the task.
The reason is that these tasks run asynchronously: results are retrieved minutes to tens of minutes later, and retrieval, retries, and billing disputes all depend on that input. They are cleared on the schedule in Section 5.
Storage of generated artifacts
Generated artifacts and reference material you upload are stored in publicly readable object storage. The address is unguessable (it contains a random identifier), but anyone who obtains it can access it without signing in.
⚠️ Do not treat this as private storage, and do not forward addresses to anyone who should not see the content. Artifacts are cleared periodically, after which the address stops working.
4. Who we share with
We do not sell your personal information. Sharing occurs in the following cases:
| Recipient | What is shared | Purpose |
|---|---|---|
| Upstream model providers | Request content and necessary parameters | Performing inference |
| Payment providers | Billing details, transaction amounts | Processing payments and issuing documents |
| Cloud and infrastructure providers | Data being hosted | Running the service |
| Email service providers | Email addresses and notification content | Sending account and billing notifications |
A full list of sub-processors is available on request from support@amux.ai.
We may also disclose information where required by law or by a competent authority, or where necessary to protect our rights or those of others.
In a merger, acquisition, or transfer of assets, information may transfer as part of the transaction; we will notify you before that happens.
5. How long we keep it
| Data | Retention |
|---|---|
| Call metadata | Long-term, for reconciliation, usage reporting, and dispute handling; we review and clear records no longer needed |
| Request / response bodies of text and chat calls | Not recorded for successful calls; sampled failed calls (without response bodies) are kept for no more than 15 days |
| Prompts, parameters, and material references for image and video generation | 30 days by default, then cleared; the task record itself is kept |
| Playground conversation content | Kept until you delete it |
| Aggregated usage and transaction ledger | Long-term (statutory financial record requirements) |
| Audit records | 2 years |
| Tickets and attachments | Kept after closure, for later reference and dispute handling; we review and clear them periodically |
| On-site search terms | Aggregated into daily counts, with no per-query records |
| Account information | For the life of the account |
6. International transfers
Our own services and storage are located in the United States. Using the service means your data may be transferred outside your country or region and processed there.
Upstream model providers decide their own processing locations, and we do not make a blanket statement about them. The model catalog states the provider for every model, and you can consult that provider's privacy policy for where it processes and stores data. Where processing location matters, you can pin providers on the account or key to confine requests to the ones you have assessed.
The site analytics you may consent to are provided by Google LLC (United States) and processed there. For that processing we are the data controller and Google is the data processor; we have accepted Google's data processing terms, and Google is certified under the EU–US Data Privacy Framework (DPF).
We take appropriate safeguards for international transfers as required by applicable law.
7. How we protect it
API keys and upstream credentials are stored encrypted, and all traffic uses TLS. Access to production data is granted on a least-privilege basis and recorded in audit logs.
No system can guarantee absolute security. If a security incident confirmed to affect user data occurs, we will notify affected users as promptly as applicable law requires.
8. Cookies and local storage
The cookies and browser local storage we use fall into two categories: necessary and functional. There is currently no analytics category and no advertising category: this site does not load any third-party analytics or advertising service.
Necessary
These cannot be disabled and do not require consent. Blocking them in your browser prevents you from signing in.
| Name | Purpose | Lifetime |
|---|---|---|
| Sign-in session | Maintains your signed-in state | For the life of the session |
NEXT_LOCALE | Records the interface language you select | Cleared when you close the browser |
theme | Records the light or dark display mode you select | Local storage, until you clear it |
amux_consent | Records your choice regarding optional cookies | 180 days |
Interface language and display theme are included in this category: both result from your own selection, contain no identifier, and are not used to track your activity.
Functional (requires your consent)
No cookie in this category is written before you make a choice. If they are not accepted, the preferences below apply to the current visit only and are not retained after you close the tab; the rest of the site is unaffected.
| Name | Purpose | Lifetime |
|---|---|---|
tz | Displays times in your time zone rather than UTC | 1 year |
amux_page_size | Records the page size of each list | 1 year |
amux_ws | Records the workspace you last visited | 1 year |
amux.search.recent | Records your recent search terms | Local storage, until you clear it |
amux.notifications.lastSeen | Records the latest announcement you have viewed when signed out | Local storage, until you clear it |
amux:last-login-method | Records the sign-in method you used last | Local storage, until you clear it |
Analytics and performance (requires your consent)
We use Google Analytics 4 to understand how visitors use Amux and to measure product usage and site performance.
| Name | Purpose | Lifetime |
|---|---|---|
_ga | Distinguishes visitors | 2 years |
_ga_<measurement ID> | Maintains session state | 2 years |
⚠️ Even if you reject analytics cookies, your browser still sends a single signal to Google that carries no identifier and writes no cookie on your device. That signal includes your IP address, the page address you visited, and the referring page. We use it only to estimate overall traffic; it does not let us identify you or link your visits together. You can block the request entirely with a browser extension or at the network level.
The page addresses we report are processed first: inside the console, organization, workspace, and ticket identifiers are replaced with placeholders (for example /o/[id]/logs), and every query parameter other than campaign attribution (utm_*) is dropped, so filters and search terms are never sent. We also do not send your account identifier to the service.
In Google Analytics we have turned off Google signals and ad personalization, and we do not use this data for advertising.
Your choice
We ask for your choice on your first visit, and no functional or analytics cookie is written beforehand. Your choice is kept for 180 days, after which we ask again; a rejection is kept for the same 180 days, so that you are not asked again on every visit.
You may change your choice at any time: through "Manage cookies" in the footer, or directly at Cookie settings. When you withdraw consent, anything already written from the table above is deleted immediately.
This choice is stored on the device you are currently using. While you are signed in we also store it on your account, so that signing in on a new device starts from the same choice; where the two differ, the more recent one wins. When you are not signed in it lives only on the current device, and switching device or browser, or clearing your browser data, means we will ask again.
We do not use advertising cookies and do not share data with third-party advertising networks.
9. Your rights and choices
- Access and export — view usage, cost, and call records in the console
- Delete playground conversations — remove a single turn or an entire conversation at any time
- Correction — change account and billing details in settings
- Deletion — request account deletion through a ticket or by email. We handle this by anonymization: name, email, and avatar are cleared, source IP addresses are erased from call records, and sampled failed calls are deleted; the transaction ledger and aggregated usage are retained under statutory financial record requirements, at which point those records no longer point to an identifiable person
- Objection and restriction of processing — available where applicable law grants you that right
To exercise these rights, contact support@amux.ai. We usually respond within 30 days; where a request is complex we will tell you first and extend appropriately.
If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with a data protection authority, and believe our processing does not comply with the law, you have the right to lodge a complaint with your local authority.
10. Minors
Amux is intended for developers and businesses, not for minors. We do not knowingly collect personal information from minors, and will delete any such information we find.
11. Changes to this policy
When this policy changes, we update the effective date at the top of this page. Where the change is material, we give notice by email or in the console.
12. Contact us
- Privacy enquiries: support@amux.ai
- Data protection and compliance: account@amux.ai
- Operating entity: SentenceEnd Inc., incorporated in the State of Wyoming, United States