Privacy Policy

1. Who we are and what this policy covers

OpenCSN ("the Service", "we") is an API gateway to AI models operated by OpenCSN. For personal data processed through the Service, OpenCSN is the Personal Data Controller under Law No. 27 of 2022 on Personal Data Protection ("the PDP Law").

Controller contact: [email protected]. Address: not provided.

This policy covers https://opencsn.com, the user console, the API gateway, and transactional email we send. It does not cover third-party sites or services, including AI model suppliers, which process data under their own privacy policies.

2. Data we collect

Account data

• Display name, email address, and account role (for example Admin or Developer).
• Account status (Active or Suspended), balance, API key count, referral code, join time, and last-seen time.
• Password credentials stored in the password_hash column of the accounts table.

We use this data to create and manage accounts, render the console, calculate balances, and run the referral program.

Google account data

When you sign in with Google, we request the openid, email, and profile scopes. From the Google response we receive the Google account identifier (sub), email address, display name, and profile picture URL. We store the account identifier, email, and name on your account. We do not store the profile picture URL in our database.

Authentication and security data

We verify Cloudflare Turnstile tokens on sign-in, password reset requests, and registration. The request IP address is sent to Cloudflare as part of that verification. Password reset codes are 6 digits, valid for 10 minutes, and held in server memory rather than in the database. Sign-in and password reset attempts are written to system logs (time, event, and email address) for security purposes.

We do not set a login session cookie. Sign-in state in the browser is kept in localStorage (see the Cookies and local storage section).

Service usage metadata

When you call the gateway, we record request metadata: request ID, account, API key ID, model, input and output token counts including cache, cost, status, latency, and timestamp. This metadata does not contain prompt or response content.

Billing and balance records

Each balance transaction records the customer name, email, payment provider, amount, bonus, net amount, status, and transaction time.

Support communication

If you email [email protected], we keep the message and sender address for as long as needed to handle the request.

3. Data we do not store

OpenCSN does not store the content of your requests or responses in its own systems. Prompts, system messages, images, files, tool calls, and model output are not written to the OpenCSN database or to OpenCSN application logs. That content exists only in server memory while the request is processed.

Your request is forwarded to the AI model supplier that produces the answer. Storage and processing on the supplier side are governed by that supplier policy. The statement in this section applies to OpenCSN systems only.

We do not sell personal data and we do not use your request content to train AI models.

4. How we use data

• Provide the Service: authenticate accounts, forward requests to the model you choose, and return the answer.
• Charge for usage and show usage history and balance in the console.
• Prevent abuse, including rate limiting and automated checks in the authentication flow.
• Keep systems secure and investigate incidents.
• Meet legal obligations, including valid requests from authorities.
• Answer support requests you send us.

We do not use personal data for advertising, do not build behavioural profiles for sale, and do not transfer personal data to other parties for marketing.

5. Google user data and Limited Use

OpenCSN use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google account data is used only to create an account and complete sign-in. It is not sold, not used for advertising, not used to train AI models, and not transferred to others except as needed to provide the Service or as required by law. Humans do not read it except for security purposes, legal compliance, or with your explicit consent.

You can revoke OpenCSN access to your Google account at any time at https://myaccount.google.com/permissions.

6. Sharing and processors

We share personal data only with the following parties:

• AI model suppliers: request content is forwarded to the supplier serving the model you choose so it can produce the answer.
• Cloudflare: network delivery and Turnstile verification.
• Email delivery provider: receives the email address and transactional message, such as a password reset code, through SMTP or Resend.
• Payment provider: when online payment is available, the transaction is processed by the provider shown on the payment page. We do not store card numbers.
• Authorities: where required by law or a valid order.

Each supplier processes data under its own privacy policy. We do not sell or rent personal data.

7. International transfers

Some processors, including Cloudflare and AI model suppliers, are located outside Indonesia. Transfers outside Indonesia follow the PDP Law and use reasonable safeguards, such as data processing agreements or contractual clauses with the processor.

8. Retention

• Account data and usage metadata: kept while the account is active and deleted or anonymised within 30 days of a verified account deletion request.
• Transaction and financial records: kept for 10 years as required by Indonesian accounting and tax rules.
• Security logs: kept for 90 days.
• Password reset codes: valid for 10 minutes, deleted when used or expired.
• Backups: deleted within 30 days after the primary data is deleted.

We may keep data longer where the law requires it or to handle an ongoing dispute.

9. Security

Security measures in place on the Service:

• Account access requires the account email and password, or a verified Google account.
• Cloudflare Turnstile verification in the authentication flow.
• Six-digit password reset codes valid for 10 minutes.
• HTTPS connections through Cloudflare.
• Database queries use parameters rather than concatenating user input.
• Request and response content is not stored on OpenCSN systems.

No system is free of risk. If you find a security issue, report it to [email protected].

10. Your rights as a data subject

Under the PDP Law you have the right to:

• Obtain information about the processing of your personal data.
• Access and obtain a copy of your personal data.
• Request correction of inaccurate data.
• Request deletion of your personal data.
• Withdraw consent you have given.
• Object to specific processing.
• Request portability of your personal data in a commonly used format, where applicable.

Send requests to [email protected] from your account email address. We respond within 7 working days. We may ask for proof of identity to protect the account before acting on a request.

11. Cookies and local storage

• opencsn_lang (cookie): stores your language choice. Path=/, SameSite=Lax, valid for 1 year.
• opencsn_user (localStorage): the account profile object after you sign in, containing name, email, role, status, balance, API key count, and referral code.
• opencsn_lang (localStorage): your language choice for the browser interface.

Cloudflare Turnstile may set its own cookies during verification. Those cookies are controlled by Cloudflare and described in the Cloudflare policy. We do not use advertising or third-party analytics cookies.

12. Children

The Service is not intended for people under 18 or under the age of majority applicable to them. We do not knowingly collect personal data from children. If you know of a child account, contact [email protected] so we can close it.

13. Changes to this policy

This policy has a version number and an effective date. We announce material changes in the console or by email at least 14 days before they take effect. The version and effective date are shown on this page.

This version takes effect on 2026-11-04.

14. Contact

Questions about personal data processing: [email protected]. Address: not provided. Controller: OpenCSN.