SpicyAPIspicyAPI

Privacy Policy

SpicyAPI (also written Spicy API) has been at spicyapi.com since June 2025, and only there. It is operated by Wayfinity Ltd and is not affiliated with spicyapi.ai or any other service using a similar name.

Last updated: 14 October 2026

🔒 Privacy Commitment

SpicyAPI.com ("SpicyAPI", "we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our API services (the "Services").

1. Data Controller

The data controller responsible for your personal information is Wayfinity Ltd, a company incorporated in the Republic of Cyprus (registration number HE 477899), trading as SpicyAPI.

Registered office: 77, Strovolos Center, Floor 4, Flat/Office 401, Strovolos, 2018 Nicosia, Cyprus

Contact Email: contact@spicyapi.com

2. Information We Collect

2.1 Information You Provide to Us

  • Account Information: When you register for an account, we collect your email address and account credentials (such as a hashed password).
  • Payment Information: We use third-party card and cryptocurrency payment processors. We do not store your full credit card details, but we may receive transaction identifiers and summary information.
  • Communications: If you contact us directly, we may receive additional information such as your name, the contents of your message, and any other information you may choose to provide.
  • Age Verification:Where the law of your location requires it, the account holder's age is checked once by VerifyMy, our age verification provider. VerifyMy collects what its check needs (for example an identity document and a selfie, or an age estimate) under its own privacy notice. We receive only the outcome: whether the check passed, the method used, the time and VerifyMy's reference for it. We never receive your documents or images.

2.2 Information We Collect Automatically

  • Usage Data: We collect information about your use of the Services, such as API requests, the endpoints you access, IP addresses, timestamps, and API usage statistics. When you use the dashboard we also record the country and region your IP address points to, to decide whether the law there requires age verification.
  • Device and Technical Information: We may collect information about the device and software you use to access our Services, including browser type and version.
  • Cookies and Analytics: We use essential cookies for sign-in, security and basic site functions. We also use three analytics services. PostHog (EU cloud) records page views, product events and session replays of our website and dashboard, with every form input masked, and links them to your account email when you are signed in. DataFast records visits and the page or campaign that brought you, using a first-party cookie (datafast_visitor_id), so we can tell which marketing leads to sign-ups and payments. Google Analytics (through Firebase) records visits with its own cookies (_ga). What runs depends on where you are. In the European Economic Area, until you accept, PostHog only counts page views without cookies: it stores nothing on your device, and its servers tell visitors apart with a hash of your network address and browser that changes every day and is never stored; this continues if you refuse. In the United Kingdom, PostHog uses statistics cookies to count visits and improve the site unless you refuse; recordings, your account link, DataFast and Google Analytics wait for you to accept. Elsewhere all of them run by default. Anyone can accept or refuse at any time with Cookie settings at the bottom of our pages, and refusing deletes their cookies. We keep your choice in a cookie (sa_consent) for 180 days, use another (sa_region) to know which rules apply to you, and log each choice with a random identifier, the country and the browser type, without your IP address, as a record of consent. Separately, our servers send PostHog and Google Analytics records of events such as sign-ups and payments (to Google Analytics with your account ID but never your email address); this uses no cookies on your device. We do not use advertising cookies and we do not sell your data.

2.3 Content Data

  • API Inputs: We process the text prompts and parameters you submit through the API ("Input") to generate the requested content. The Services do not accept uploaded images or other media, except reference images and character import as described below.
  • Reference Images: When you or your end users send a picture to the reference image model, we use it only to screen it and to make the resulting image, in which every person is replaced by a different, fictional person. To do that, AI vision models describe the picture and estimate the apparent age of the people in it, and Amazon Web Services (Rekognition) detects the faces in it and estimates their apparent age. The faces are covered before the picture is redrawn. No face is compared against any list or used to identify anyone, and no face template is kept. We do not store the picture: we keep its content hash, its written description and, for a refused picture, the screening results. Pictures may show people other than you; customers warrant that they may submit them (Terms of Service section 2.3).
  • Imported Images:Where we have enabled character import on a customer account under Schedule 1 of the Terms of Service, we process the images that customer submits, together with their content hashes, file metadata (such as format, dimensions and any embedded camera data), the results of automated and human screening, and the customer's attestation (time, API key, terms version and any end-user identifier supplied). Customers warrant that imported images are wholly synthetic and contain no personal data. Imported images are analysed by automated vision systems, including to estimate apparent age and to detect photographs and recognisable people, solely to prevent prohibited content and abuse; this analysis is not used to identify anyone except to refuse an image that appears to show a recognisable real person. Imported images that look photorealistic are also sent to Google Cloud Vision web detection, which looks for copies of the whole image elsewhere on the web; it does not recognise faces. We fetch the page on the customer's website where each imported character is published, and ask the Internet Archive whether it existed earlier.
  • Character Import Applications:When a business applies for character import, we keep the company details it gives (legal name, registration number, country, registered address and website), what an AI vision model reads from the company documents it uploads (such as the certificate of incorporation and the list of directors, including the directors' names), the name, title and email address of the person who signs the Character Import Agreement, their drawn signature, the time, IP address and browser of that signature, and any mailbox on the business's domain that it confirms with a one-time code. We check them against public company registry pages, web search results (Brave Search), the business's website and the Internet Archive. Copies of the uploaded documents are kept only while a person reviews the application and are deleted once it is decided.
  • Generated Content:We store the images, videos and audio the Services generate for you ("Output"), and the characters and voices you create, in your account library, so that you can retrieve them and reuse them as inputs. How long each is kept is set out in section 6.

2.4 Google Sign-In

  • What we receive: If you sign in with Google, we request only the basic scopes (openid, email and profile). Google shares your email address, name, profile picture and a unique Google account ID with us. We do not access your Gmail, Drive, contacts, calendar or any other Google data.
  • How we use it: We use this information only to create your account, sign you in, and contact you about your account. Your email address is stored with your account; your name and profile picture are kept by our authentication provider (Firebase Authentication) and are not used for anything else.
  • Sharing: We do not sell Google user data, use it for advertising, or share it with third parties, except the service providers that host our authentication and database, or where required by law.
  • Retention and deletion: We keep this data while your account is open. You can delete your account and its Google data at any time in Settings, under Security, or ask us to by emailing contact@spicyapi.com. You can also remove SpicyAPI's access at any time from your Google Account settings (myaccount.google.com/permissions).
  • Limited Use: SpicyAPI's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3. How We Use Your Information

We use the information we collect for the following purposes:

  • To Provide and Maintain the Services: To operate our API, process your requests, manage your account, and process payments.
  • To Improve and Analyze the Services: To understand usage patterns, diagnose technical issues, and improve the performance and safety of our API. We may use Input and Output for these purposes.
  • To Communicate with You: To send you service-related announcements, technical notices, security alerts, and support messages.
  • For Security and Fraud Prevention: To monitor for malicious or prohibited activity, to screen imported images and reference images, and to enforce our Terms of Service. This includes checking that affiliate referrals are genuine by comparing hashed identifiers of the referred account and the affiliate: network address, a browser cookie, card brand, last four digits and expiry (from our payment processor), and checkout email.
  • To Comply with Legal Obligations: To comply with applicable laws, regulations, and legal processes, such as responding to lawful requests from public authorities, and to apply age verification laws: deciding from your location whether the account holder must verify their age, and keeping the outcome.

4. Legal Basis for Processing (for EEA/UK Users)

If you are in the European Economic Area (EEA) or the UK, our legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which we collect it. We process your data based on:

  • Contractual Necessity: To fulfill our contract with you to provide the Services.
  • Legitimate Interests: For our legitimate interests, such as improving the Service, security, and fraud prevention, provided these are not overridden by your data protection interests.
  • Legal Obligation: To comply with our legal duties.
  • Consent: Where we specifically ask for your consent for a processing activity.
  • Reference Image Screening: Face detection and age estimation are carried out to comply with our legal obligations and in our legitimate interest in preventing child sexual abuse material and intimate images shared without consent. They are not used to identify anyone.

5. Data Sharing and Disclosure

We do not sell your personal information. We may share your information with the following third parties:

  • Service Providers: We use the following service providers, which process personal data on our instructions, only have access to the information they need for their function, and are obliged to protect it:
    • Alibaba Cloud (Singapore) Private Limited, Singapore: runs the AI models that generate images, video, audio and chat, and some of the vision and language models we use for screening. It receives prompts, chat messages, input and reference images, imported images and audio you or your end users send, and returns the results. We do not use your data to train AI models. Alibaba Cloud processes it under its own terms, which may allow it to use it to improve its own models.
    • Alibaba Cloud, China (Beijing region): only when you design a custom voice or speak with a designed voice, because voice design is offered only there. It receives the voice description, the preview line and the text spoken in that voice. Cloned and preset voices and everything else stay in Singapore.
    • Features & Labels, Inc. (fal.ai), United States: converts finished videos to 60 frames per second when a request asks for it. It receives the video clip.
    • Eleven Labs Inc. (ElevenLabs), United States: generates speech for the Spicy Voice 3 models. It receives the text to be spoken and its language, and returns the audio. We have opted out of ElevenLabs using this data to train its models.
    • TypeSafe AI, Inc., United States: classifies prompts for content screening, and does not train on them.
    • Amazon Web Services, Inc.: detects faces in reference pictures and estimates their apparent age.
    • Google (Google Cloud and Firebase): our account database and sign-in, Google Cloud Vision, which matches photorealistic imported images against the web, and Google Analytics, which receives visits from your browser when analytics cookies are allowed, and sign-up and payment events from our servers without email addresses.
    • Vercel Inc., United States: hosts the website and the API.
    • BunnyWay d.o.o. (Bunny.net), Slovenia: stores and delivers the files the Services generate, through its global content delivery network.
    • Cloudflare, Inc.: processes reference pictures for the room redesign step, and protects parts of our infrastructure.
    • Resend, Inc., United States: sends our emails.
    • PostHog, Inc. (EU cloud): product analytics and session replays.
    • DataFast: website analytics and marketing attribution.
    • VerifyMy (VerifyMy Ltd, United Kingdom): age verification, for account holders in jurisdictions that require it.
    • Payment processors: TagadaPay for cards and NOWPayments for cryptocurrency, which receive what they need to take and record a payment.
  • Legal Requirements:We may disclose your information if required by law, subpoena, or other legal process, or if we have a good faith belief that disclosure is necessary to protect our rights, your safety, or the safety of others. This includes reporting apparent child sexual abuse material and related account information to the National Center for Missing & Exploited Children, the Internet Watch Foundation, law enforcement or other competent authorities.
  • Business Transfers: In the event of a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction.

6. Data Retention and Deletion

6.1 Account Data: We keep your account information for as long as your account exists. When your account is deleted, we delete it within 30 days, except the records described in sections 6.3 to 6.6, which we must keep.

6.2 Generated Content and Your Library: Output, and the characters and voices you create, are kept for as long as your account exists, so that they remain available to you and can be reused as inputs. Deleting an item through the API or the dashboard removes it from your account and stops it being used as an input; the stored file is deleted when your account is deleted. We also delete Output that is removed under our Acceptable Use Policy or following a valid takedown request. Audio you send for transcription, the audio and transcripts of live calls, and pictures sent as reference images are not stored. We do not use Input or Output to train AI models. Every generated file carries a machine-readable label saying it is AI-generated, with an identifier of the output, and we keep a fingerprint (a short perceptual hash) of every generated image, for as long as the request record, to match abuse reports and takedown requests.

6.3 Request Records: For each API request we keep a record of the time, endpoint, model, status, cost, request parameters, links to the Output and the first 500 characters of the prompt or input text (for chat, of the last message; for transcription, of the transcript). For image and video generation the record also holds the IP address and API key the request came from, the end-user id you sent, and links to the input images (for a reference image, its cryptographic hash). These records are your usage and billing history and our evidence of legal compliance. They are kept for as long as your account exists and for six years after it is closed.

6.4 Moderation and Abuse Records:Records of declined prompts, withheld Output, strikes, abuse reports and takedowns, including the prompt, the screening scores and the content hash, are kept for as long as your account exists and for six years after it is closed, or longer where the law requires it or legal claims are pending. The content hash of withheld Output may be kept on a blocklist for as long as it is needed to refuse the same content again; a hash does not contain the content. For a refused reference image these records hold its content hash, written description and age estimates, never the picture itself, unless two of our age checks agree it shows a person under 18: that picture is kept, access-restricted, with the IP address and account it came from, until we have reviewed it, and kept as long as the law requires once we report it to the National Center for Missing & Exploited Children.

6.5 Imported Images:Imported images and their content hashes, metadata, screening and provenance results, attestation records, and the business's import application and signed Character Import Agreement are kept for as long as the character created from them exists and for six years afterwards, or longer where the law requires it or legal claims are pending, as evidence for legal compliance, abuse investigations and the establishment, exercise or defence of legal claims. Images that fail screening are deleted from our content delivery network; their hashes may be kept on a blocklist so the same file is refused again. Where the law requires it, material that appears to be child sexual abuse material, and related account information, is preserved and reported to the competent authorities.

6.6 Payment, Tax and Legal Records:Payment and invoice records, records of your acceptance of our terms (with the time, IP address and browser), any Customer Commitment Letter you sign (with your name, drawn signature, time, IP address and browser), and the outcome of any age verification (with VerifyMy's reference, the method and the time) are kept for six years after the end of the financial year they relate to or after your account is closed, whichever is later, or longer where the law requires it.

6.7 Technical Logs:Records of failed API requests are kept for 30 days. Our hosting providers' server logs are kept for up to 12 months for security analysis and troubleshooting.

6.8 Deletion: If you run a platform on SpicyAPI, you can erase what was generated for one of your users with DELETE /v1/end-users/{user} (the requests sent with that user id and their files); screening records are kept as described in sections 6.3 to 6.6. You can delete your account and associated personal data yourself in Settings, under Security, or ask us to by contacting us. Deleting it signs you out, revokes your API keys and deletes your library straight away, and removes you from our mailing lists; we delete the rest within 30 days, except the records described in sections 6.3 to 6.6, which we keep only for the purposes stated there and delete at the end of those periods.

7. Data Security

We implement industry-standard technical and organizational measures to protect your information. This includes using encryption for data in transit (TLS) and at rest, access controls, and regular security reviews. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. International Data Transfers

We are established in the European Union, but some of our service providers process personal data outside the European Economic Area and the United Kingdom, in particular in Singapore (Alibaba Cloud, which runs the AI models), China (Alibaba Cloud's Beijing region, only for designed voices) and the United States (including TypeSafe AI, Vercel, Resend, Google, Amazon Web Services, Cloudflare, fal.ai and ElevenLabs). These countries may have data protection laws that differ from yours. For every such transfer we rely on the European Commission's Standard Contractual Clauses (with the United Kingdom addendum for UK data) in the provider's data processing terms, or on the EU-US Data Privacy Framework where the provider is certified under it. You can ask us for a copy of the relevant safeguards at contact@spicyapi.com.

9. Your Data Protection Rights

Depending on your location, you may have the following rights regarding your personal information:

  • The right to access, update, or delete the information we have on you.
  • The right of rectification.
  • The right to object to our processing.
  • The right of restriction.
  • The right to data portability.
  • The right to withdraw consent at any time.

To exercise these rights, please contact us at contact@spicyapi.com. We will respond to your request in accordance with applicable law.

10. Age Restrictions

Our Services are intended exclusively for users who are 18 years of age or older. We do not knowingly collect personal information from individuals under 18. If we become aware that we have collected such information, we will take steps to delete it promptly.

11. Supervisory Authority

If you have concerns about our data practices, we encourage you to contact us first. However, you have the right to lodge a complaint with a data protection supervisory authority. Our lead authority is the Commissioner for Personal Data Protection of the Republic of Cyprus. You can also complain to the authority where you live or work: in the United Kingdom, the Information Commissioner's Office (ICO).

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically.

13. Contact Us

If you have any questions about this Privacy Policy, please contact us at: contact@spicyapi.com