Privacy Policy

1. Introduction

E2X ("we," "us," or "our") operates the E2X AI API platform available at e2x.ai (the "Service"). E2X provides a unified API for AI-powered video generation, image generation, and other media creation tasks, leveraging multiple upstream AI model providers to deliver a seamless development experience.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you access or use our Service, including our website, API endpoints, dashboard, documentation, and related tools. This policy applies to all users of the Service, including developers, businesses, and any individuals who interact with our platform.

By creating an account, making an API request, or otherwise using the Service, you acknowledge that you have read and understood this Privacy Policy and agree to the collection and use of information in accordance with its terms. If you do not agree with this Privacy Policy, please discontinue use of the Service immediately.

2. Information We Collect

We collect information in several categories to provide, maintain, and improve the Service:

2.1 Account Information

When you create an account, we collect your name, email address, and company or organization name (if provided). If you authenticate via a third-party provider (e.g., Google, GitHub) through our identity provider Clerk, we receive your profile information from that provider, including your name, email address, and profile image.

2.2 Payment Information

When you purchase credits or add funds to your account, payment processing is handled entirely by Stripe, our third-party payment processor. We do not store your full credit card number, CVV, or banking details on our servers. We retain only the last four digits of your card number, card brand, transaction records, billing history, and account balance information for operational and compliance purposes.

2.3 API Usage Data

We automatically collect metadata about your API interactions, including:

• API endpoints called, HTTP methods, and response status codes
• Timestamps of each request and response
• AI model selections and provider routing information
• Credit consumption and cost per request
• Error codes and rate-limiting events
• Request latency and processing duration

2.4 API Input and Output Data

When you submit API requests, we receive the input data you provide, including text prompts, parameters, configuration settings, and any reference media. We also temporarily process the output data (generated images, videos, or other media) returned by upstream AI providers. This data is retained only for the duration necessary to fulfill your request and deliver the results, plus a limited caching period to facilitate re-delivery. We do not use your input prompts or generated outputs to train our own models.

2.5 Device and Technical Information

We automatically collect technical information when you access the Service, including:

• IP address and approximate geographic location
• User agent string, browser type, and version
• Operating system and device type
• Referring URL and pages visited within our platform
• Session duration and interaction patterns

2.6 Cookies and Similar Technologies

We use cookies and similar tracking technologies to maintain your session, remember your preferences, and collect analytics data. For detailed information about our cookie practices, please see Section 12 of this policy.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Service Delivery: To provide, operate, and maintain the Service, including processing your API requests and routing them to appropriate upstream AI providers
• Billing and Payments: To process credit purchases, track usage, calculate costs, manage your account balance, and generate invoices and receipts
• Security and Fraud Prevention: To monitor for and prevent unauthorized access, abuse, fraud, and violations of our Terms of Service
• Analytics and Improvement: To analyze usage patterns, optimize performance, improve reliability, and develop new features for the platform
• Communications: To send transactional notifications (balance alerts, receipts, service updates, API deprecation notices), and to respond to your support requests and inquiries
• Legal Compliance: To comply with applicable laws, regulations, legal processes, and enforceable governmental requests
• Aggregated Analytics: To generate anonymized, aggregated statistics about platform usage, model popularity, and service performance that cannot be used to identify individual users

4. Data Sharing with Upstream AI Providers

This is an important section. Please read it carefully, as it describes how your data may be processed by third-party AI model providers.

E2X acts as an intermediary platform that routes your API requests to various upstream AI model providers to fulfill your content generation requests. When you make an API request, your input data (including prompts, parameters, and any reference media) is transmitted to the selected upstream provider for processing. The providers we currently integrate with include, but are not limited to:

• Google Cloud
• OpenAI API
• BytePlus
• fal.ai
• Replicate
• Runway
• MiniMax

Each upstream provider operates under its own privacy policy and data handling practices. The way these providers process, store, and potentially use your data varies and is beyond E2X's direct control. Key considerations include:

• Some providers (such as Runway) may use input and/or output data from API requests to improve or train their AI models, unless you or we have opted out under their specific terms
• Other providers (such as MiniMax) have stated that they do not use customer data submitted via API for model training purposes
• Provider policies may change over time, and we encourage you to review the current privacy policies of any providers whose models you use through our platform

E2X does not control and cannot guarantee how upstream AI providers handle, store, or use the data they receive through API requests. We select providers that maintain reasonable data protection practices, but we are not responsible for the data handling practices of third-party providers. By using our Service, you acknowledge and accept that your input data will be shared with the upstream provider(s) necessary to fulfill your request.

We recommend that you do not submit sensitive personal information, confidential business data, or any data subject to specific regulatory requirements (such as HIPAA-protected health information) through our API without first reviewing the applicable upstream provider's privacy policy and data handling commitments.

5. Third-Party Service Providers

In addition to upstream AI providers, we use the following third-party services to operate our platform:

• Stripe — Payment processing, subscription management, and billing infrastructure. Stripe may collect and process payment information in accordance with the Stripe Privacy Policy
• Clerk — Authentication, identity management, and session handling. Clerk processes your account credentials and authentication data in accordance with the Clerk Privacy Policy
• Analytics Providers — We use analytics services to understand how users interact with our platform. These services may collect information about your use of the Service through cookies and similar technologies
• Cloud Hosting and Infrastructure — Our Service is hosted on cloud infrastructure providers that maintain industry-standard security certifications and comply with applicable data protection regulations

We do not sell your personal information to any third party. We share information with third-party service providers only to the extent necessary to operate the Service, and we require these providers to protect your information in accordance with applicable law.

Legal Requirements

We may disclose your information if required to do so by law, in response to valid legal process (such as a subpoena, court order, or government request), or to protect the rights, property, or safety of E2X, our users, or the public.

Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information.

6. Data Retention

We retain different categories of data for different periods:

• Account Data: Retained for the duration your account remains active, plus 90 days following account deletion to allow for account recovery and to comply with legal obligations. After this period, personal data is permanently deleted unless retention is required by law
• API Request/Response Logs: Metadata and logs from API requests are retained for up to 30 days for debugging, abuse prevention, and service optimization purposes, after which they are aggregated or deleted
• API Input/Output Content: Your prompts and generated content are not permanently stored after processing is complete. Temporary caching may occur to facilitate re-delivery of results, but content is not retained beyond the cache expiration period
• Transaction Records: Payment and billing records are retained for up to 7 years to comply with financial, tax, and accounting regulations
• Anonymized Analytics: Aggregated, anonymized usage data may be retained indefinitely for platform improvement purposes, as it cannot be used to identify individual users

7. Data Security

We implement industry-standard technical and organizational security measures to protect your information, including:

• Encryption of data in transit using TLS/SSL and encryption of data at rest using AES-256 or equivalent standards
• API key authentication with scoped permissions and key rotation capabilities
• Strict access controls and role-based permissions for internal systems
• Regular security audits and vulnerability assessments
• Monitoring and alerting for suspicious activity and unauthorized access attempts
• Secure infrastructure hosted on certified cloud platforms

While we strive to protect your personal information using commercially reasonable measures, no method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security and are not responsible for the security practices of upstream AI providers or other third-party services.

8. Your Rights Under GDPR

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR) and equivalent legislation:

• Right of Access: You may request a copy of the personal data we hold about you
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data
• Right to Erasure: You may request deletion of your personal data, subject to certain legal exceptions
• Right to Restriction: You may request that we restrict processing of your personal data under certain circumstances
• Right to Data Portability: You may request to receive your personal data in a structured, commonly used, and machine-readable format
• Right to Object: You may object to processing of your personal data based on our legitimate interests or for direct marketing purposes
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal

To exercise any of these rights, please contact us at support@e2x.ai. We will respond to your request within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.

9. Your Rights Under CCPA

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the business purpose for collection, and the categories of third parties with whom it is shared
• Right to Delete: You may request deletion of the personal information we have collected about you, subject to certain exceptions
• Right to Opt-Out: You have the right to opt out of the sale or sharing of your personal information. We do not sell your personal information
• Right to Non-Discrimination: You have the right to exercise your privacy rights without receiving discriminatory treatment in pricing, quality, or level of service
• Right to Correct: You may request correction of inaccurate personal information we maintain about you

To exercise any of these rights, please contact us at support@e2x.ai. We will verify your identity before processing your request and respond within 45 days as required by applicable law.

10. International Data Transfers

Your information may be transferred to, stored in, and processed in the United States and other countries where our infrastructure providers and upstream AI providers operate. These countries may have data protection laws that differ from those in your jurisdiction.

When we transfer personal data outside the EEA, UK, or Switzerland, we rely on appropriate legal mechanisms, such as Standard Contractual Clauses (SCCs) approved by the European Commission, adequacy decisions, or other lawful transfer mechanisms to ensure an adequate level of data protection.

By using the Service, you acknowledge that your data may be processed in jurisdictions outside your country of residence, including jurisdictions where upstream AI providers maintain their infrastructure.

11. Children's Privacy

The Service is intended for users who are at least 18 years of age. We do not knowingly collect, use, or disclose personal information from individuals under the age of 18. If you are under 18, you may not create an account or use the Service.

If we become aware that we have collected personal information from an individual under 18, we will take immediate steps to delete that information. If you believe that a minor has provided us with personal information, please contact us at support@e2x.ai so that we can take appropriate action.

12. Cookies and Tracking Technologies

We use the following types of cookies and similar technologies:

Essential Cookies

Required for authentication, session management, security, and core platform functionality. These cookies cannot be disabled without affecting the operation of the Service.

Analytics Cookies

Help us understand how visitors interact with the Service, including page views, navigation patterns, and feature usage. Analytics cookies are optional, and you can opt out through your browser settings or cookie preferences.

Preference Cookies

Remember your settings and preferences (such as language, theme, and dashboard layout) to provide a more personalized experience.

Third-Party Cookies

Third-party services integrated into our platform (such as Clerk for authentication and Stripe for payments) may set their own cookies as described in their respective privacy policies. We do not control these third-party cookies.

We do not use cookies for advertising or behavioral targeting purposes. You can manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of the Service.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will:

• Post the updated policy on this page with a revised "Last updated" date
• Send an email notification to the address associated with your account for significant changes that affect your rights or the way we handle your data
• Provide a prominent notice on our website or dashboard when material changes take effect

Your continued use of the Service after any changes to this Privacy Policy constitutes your acceptance of the updated terms. We encourage you to review this policy periodically to stay informed about how we protect your information.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, our data practices, or your personal information, please contact us: