The English text is legally binding. Other languages are convenience translations.

ExecuteAI ApS · CVR 45798798

Privacy Policy

Effective 14 September 2026. This describes how we process personal data when you use tokenmaxing.online.

1. Controller

The data controller is ExecuteAI ApS, Nikolajgade 22, 1068 København K, Denmark, CVR 45798798. Contact: info (at) tokenmaxing.online.

2. Data we collect

When you create an account we store:

• company or organisation name
• work email address
• a generated tenant id and API key
• prepaid balance
• the time the account was created
• encrypted copies of any Anthropic, OpenAI or Google keys you choose to store in Account. Plaintext is not written to the database and is not returned by the portal

When you pay we store the Stripe checkout session id, the amount, the payment status and the time. Card numbers never touch our servers; Stripe processes the card.

When you call the API we store an audit row: tenant id, requested model, routed model, input / output / cached token counts, and the calculated costs. We do not store prompt text or model output in that database.

The browser keeps a signed-in portal session in an httpOnly cookie. The API key is not stored in the page, JavaScript or localStorage. That cookie is not a marketing cookie and we do not set advertising cookies.

3. Why we process it

Account, key and balance data are processed to perform the contract (GDPR art. 6(1)(b)): creating the tenant, authenticating calls, reserving and settling prepaid funds.

Payment records are processed for the contract and for our bookkeeping duties (art. 6(1)(c)).

Audit rows are processed for the contract and for our legitimate interest in billing disputes, abuse detection and security (art. 6(1)(f)).

Email to info (at) tokenmaxing.online is processed to answer you.

4. Where data is processed

• Application and database: Azure Container Apps and Azure Database for PostgreSQL in North Europe (Ireland).
• Model inference: prompts and completions are sent to the backend for the requested alias so the model can answer. Most OpenAI aliases and DeepSeek V4-Flash use Azure in the EU data zone unless you have stored your own OpenAI key, in which case the call goes to OpenAI with that key. GPT-6 Astra uses Azure OpenAI on a global SKU and may leave the EU. Grok, Llama, Kimi and DeepSeek V4 Pro use Azure AI Foundry on a global SKU. Gemini is sent to Google, with your Google key when you have stored one. Claude is sent to Anthropic with your Anthropic key only, not to Azure and not with a shared ExecuteAI account. Prompts and completions are not written to our application database.
• Payments: Stripe processes checkout. Stripe is a separate controller for card data.
• Outbound email: Azure Communication Services in Europe sends mail from info (at) tokenmaxing.online.
• Inbound email: Forward Email receives mail for info (at) tokenmaxing.online and forwards it to steffen (at) executeai.software.

We do not sell personal data. We do not use the account for marketing lists.

5. How long we keep it

Account and API-key records are kept while the account is open, and then for as long as Danish bookkeeping rules require for payment rows (currently five years from the end of the financial year). Audit rows that are only needed for billing disputes are kept for two years unless a longer period is required for an active dispute. You can ask us to delete the account; we will remove or anonymise data that the law does not require us to keep.

6. Your rights

You may request access, rectification, erasure, restriction, objection or portability, and you may complain to Datatilsynet (the Danish Data Protection Agency). Write to info (at) tokenmaxing.online from the email on the account. We will need to verify that you control the account before we release or delete data.

We do not use automated decision-making that produces legal effects about you.

7. Security

Only hashes of Tokenmaxing API keys and portal sessions are stored in the database. Customer provider keys are stored as AES-256-GCM ciphertext and decrypted in memory for one call. A new Tokenmaxing API key is emailed after email verification or authenticated replacement; replacing it revokes the previous key. Sign-in codes expire and have attempt limits. Prepaid reservations and charges are recorded durably. Stripe webhook signatures and timestamps are verified before crediting funds.

8. Children

The service is not directed at anyone under 18. We do not knowingly create accounts for children.