Privacy Policy

Purpose of this policy

This Privacy Policy explains how Chariot AI Limited (“we,” “us,” or “our”) collects, uses, stores, shares, and protects personal information when you visit chariot.hk, call model APIs, rent GPUs, or use the console.

Please pay special attention to bold text that may limit your rights or describe how sensitive information is handled. By registering an account, checking consent, or continuing to use the services, you confirm that you have read and understood this Policy. If you do not agree, please stop using the services.

Eligibility to use the services

You represent that you have the legal capacity or authorization to enter into and perform this Policy and the Terms of Service. Using the services requires a compatible device and network connection, at your own cost. We grant you a limited, non-exclusive, revocable, and non-transferable license to access the services.

1. Scope of personal information we collect

Personal information means information recorded electronically or otherwise that relates to an identified or identifiable natural person. When you browse, register, purchase, or call the services below, we may collect:

1.1 Registration data

Username, email address, phone number, and password. Email and phone are used for registration, login verification, password recovery, and service notices. You may add name, industry, region, and mailing address in the console.

1.2 Verification data

Where law or our risk controls require individual or business verification, you may need to provide name, ID or passport details, company name, and business licenses. Facial recognition data and bank card numbers are sensitive personal information. You may refuse to provide them, but you may then be unable to complete verification or purchase on-demand or reserved compute.

1.3 Service usage data

• Model calls: model name, time, token usage, and request metadata. Prompts and outputs may contain personal information about you or third parties; avoid submitting unnecessary sensitive content.
• Compute instances: instance size, region or cluster, power state, image, disk and network settings, and resource usage.
• API credentials: API Key creation time, last-used time, and permission scope. We do not store full keys in plaintext for long periods.

1.4 Log data

User ID, IP address, browser type, language, device and operating system, access time and duration, and error codes, used to operate the service and troubleshoot issues.

1.5 Support data

When you contact support, we collect UID, username, contact email or phone, and necessary ticket and correspondence records so we can verify identity and respond.

1.6 Payment and invoice data

Payment channel identifiers, amounts, invoices, credit or voucher information; and billing name, tax ID, recipient name, phone, and address for invoices. Full payment credentials are handled by payment providers; we do not store full card numbers or payment passwords.

1.7 Other data

Before collecting personal information outside the scope above, we will obtain separate consent or rely on another lawful basis under applicable law.

2. Purposes of collection

1. Provide, maintain, and improve model APIs, GPU instances, billing, and the console;
2. Send necessary notices about security, billing, and service changes;
3. Complete account verification, quotas, and risk checks;
4. Introduce related products where permitted by law and where you have not opted out;
5. Conduct internal audits, usage analysis, and capacity planning;
6. Protect the information security of accounts, the platform, and users;
7. Comply with applicable laws and industry requirements;
8. Other purposes with your consent.

If we use information for a purpose not stated in this Policy, we will obtain prior consent, except where law provides otherwise.

3. Cookies we use

1. Unless you refuse, we set or read cookies on your device to keep you signed in, remember preferences, and enable console features. Some cookies are used for traffic statistics.
2. You may refuse cookies in your browser settings. After refusal, login and features that depend on cookies may be unavailable.
3. Information obtained through cookies is subject to this Policy.

4. Storage, sharing, transfer, and disclosure

4.1 Storage

We protect personal information with encryption, access controls, and key management. Registration data, verification data, logs, support records, invoices, and billing data are protected in transit and at rest using industry practices to prevent unauthorized access.

4.2 Sharing

We do not share your personal information with companies, organizations, or individuals outside Chariot AI except where:

• we have your explicit consent;
• laws, litigation, arbitration, or a competent authority lawfully require it;
• we share with affiliates information necessary to provide the services, subject to the purposes of this Policy;
• we share with authorized partners such as cloud infrastructure, payment, SMS, or email providers, only for lawful, necessary, and specific purposes;
• in a merger, acquisition, or asset transfer, we will notify you and require the recipient to protect the information to a standard no lower than this Policy.

4.3 Transfer

Except with your explicit consent, or as required by law in a merger, acquisition, or bankruptcy liquidation (with notice and binding obligations on the recipient), we do not transfer your personal information.

4.4 Public disclosure

We disclose personal information publicly only with your explicit consent, where required by law or a competent authority, or as otherwise agreed with you.

5. How we protect personal information

5.1 Technical measures

We use encrypted transmission, access isolation, firewalls, and intrusion detection, and we limit access to personal information by people who do not need it.

5.2 Organizational measures

People who handle personal information are subject to least-privilege access, confidentiality duties, and security training.

5.3 Risks you should manage

Safeguard your password, API Keys, and verification emails. Do not forward codes or keys to others. The confidentiality of content you submit in model prompts also depends on how you use the service.

6. Minors

Our services are intended for users with full civil capacity and for lawfully established organizations. If you are a minor, please use the services only with parental or guardian consent. If we learn that we collected a minor’s personal information without verifiable guardian consent, we will delete it as soon as practicable.

7. Your rights

• Access. You may view registration details, verification status, and invoices in the console. If you cannot access them yourself, contact us using the details below; we will respond within 15 business days.
• Correction. When information changes, you may update it in the console or ask us to correct it.
• Deletion. If processing violates the law or this Policy, you may request deletion. After verifying identity, we will respond within 15 business days.
• Withdraw consent. You may turn off related features or close your account to withdraw consent. Withdrawal does not affect processing already performed based on consent, or information we must retain by law.
• Account closure. You may request account closure. After closure we will stop providing services and delete personal information as you request, except where law requires retention.

8. Cross-border transfers

We will describe the primary storage location of personal information. If model inference, multi-cloud scheduling, or support services require transferring personal information outside your location, we will inform you to the extent required by law and apply protections proportionate to the risk. The storage region shown in the console or on your order controls.

9. How this Policy is updated

We may update this Policy because of service changes, user feedback, or legal changes. Material changes will be posted on the website and, where appropriate, notified via your account email or the console. Please review this Policy regularly.

About us

The model market, compute market, and related console on chariot.hk (together, the “Services”) are operated by Chariot AI Limited. “You” in this Policy means an individual who visits or uses the Services.

Contact us

For questions, comments, or to exercise the rights above, contact:

• Email: jihao@chroit.hk
• Website: https://chariot.hk/

For security, we may ask you to verify your identity before responding.