1. Data we process
To provide the service, we process account email, verification and session records, API-key digests and policy, prompts and input images, task and result metadata, billing and usage, source IP, User-Agent, support requests and security audit events. A complete API key is shown once at creation or regeneration; the server retains a verification digest.
2. Purpose and retention
Data is used for authentication, task execution, result delivery, settlement, abuse prevention, support and troubleshooting. OGA result assets for successful tasks are retained on the server for 3 hours after completion, and re-signing does not extend that window. Necessary task, billing, legal-acceptance and audit metadata is retained for its business and compliance period.
3. Third-party upstream processing
To execute a task, prompts, images and necessary parameters are sent to the selected third-party upstream provider. That provider may process in different regions and log or retain content under its own policy; the period may be unknown or vary by route. OGA's 3-hour server-side result window is not an upstream deletion period, and we cannot guarantee deletion on an upstream provider's behalf.
4. Sharing, security and requests
We share data only as necessary for task processing, infrastructure, legal requirements or security response, and do not sell personal information. We use access controls, digest verification, private assets and audit measures, but no test service can guarantee absolute security. You may use the support entry to ask about, correct or delete applicable account information; records required by law or fraud prevention may not be deleted immediately, and upstream copies are not controlled by OGA alone.
Terms · AUP · Privacy · Support and appeals