Data and privacy

What BigModel.io keeps from your API requests, for how long, and what model providers see. Prompts are not stored after delivery and never used for training.

On this page
  1. What the gateway does with your prompts
  2. What model providers see
  3. Reduce what you send
  4. See what is recorded about your requests
  5. Verify the setup
  6. Your rights and requests
  7. Troubleshooting
  8. Related

This page summarizes how BigModel.io handles the data in your API requests. The Privacy Policy (effective 2026-10-17) is the binding text; if the two ever differ, the policy wins.

Data Kept by BigModel.io?
Prompts, files and outputs of successful requests No. Forwarded to the model provider and not kept after the response is delivered.
Body of failed requests Up to 30 days, for debugging, with credentials removed
Video and other async tasks Task parameters, including the prompt, kept with the task; generated files kept for a limited time so you can download them
Usage records Yes: API key, model, time, tokens, cost, status, latency, error type, request ID, endpoint, IP address and User-Agent. No prompt content.
App attribution Daily aggregates of the HTTP-Referer host and X-Title. See App attribution.

#What the gateway does with your prompts

  • No training. BigModel.io does not use your prompts or outputs to train models.
  • No sale. BigModel.io does not sell your personal information.
  • Success path. A successful request passes through to the provider of the model you chose and the content is not stored once the response is returned.
  • Failure path. If a request fails, its body may be kept for up to 30 days so the error can be investigated. API keys and other credentials are removed first.

#What model providers see

To answer a request, BigModel.io sends its content to the provider of the model you picked. Each provider processes it under its own terms and privacy policy. Some providers may keep request content for a while or use it to improve their services. Contact support before you send sensitive data, and do not send personal data, trade secrets or regulated data that you are not allowed to share.

#Reduce what you send

  • Remove names, emails, phone numbers, keys and other secrets from prompts when the task does not need them.
  • Use one API key per app or environment so usage records stay separable, and delete keys you no longer use.
  • Do not call the API from browser code. Your key would be exposed, and the request carries the user's IP and User-Agent.
  • Download video outputs you need before their retention deadline; see Video generation.

#See what is recorded about your requests

The Usage page shows every record kept for your account: key, model, endpoint, tokens, cost, timing and User-Agent. You can filter it and export it as CSV. For one key, GET /v1/usage returns the same counters:

cURL
curl https://bigmodel.io/v1/usage \
  -H "Authorization: Bearer $BIGMODEL_API_KEY"

#Verify the setup

Send a request, then open Usage. The new row shows metadata (model, tokens, cost, User-Agent) and no prompt or output text. That row is all BigModel.io keeps from a successful request.

#Your rights and requests

You can ask to access, correct, export or delete your personal information, or object to some processing. Email support@bigmodel.io from your account address; the policy commits to an answer within 30 days. Some records, such as billing records, are kept as long as accounting, tax and dispute rules require.

#Troubleshooting

You need a provider's own data terms. BigModel.io cannot change how a provider handles content. Ask through Support before you send sensitive data.

You sent something you should not have. For a successful request, BigModel.io kept no content. For a failed request, the body may be kept for up to 30 days; contact support@bigmodel.io with the request ID (X-Request-ID response header).

You need a security questionnaire or a DPA. For security questionnaires or a DPA, contact support@bigmodel.io.

Updated · View as Markdown