中文

This is the English translation. The Chinese version prevails where permitted by applicable law.

The Surd AI Team (“we”) operates the services described here. Email contact@zqwei-tech.cn for privacy requests and notices, or use our Contact page.

This Policy explains how we process personal information on surdai.com and related subdomains, consoles, Playground tools, APIs and experimental applications expressly covered by it. Independent third-party policies, private enterprise deployments and special projects should be read together with their specific notices and valid contracts.

Accepting the Terms or reading this Policy is not blanket authorization for every data use. We distinguish processing needed for the service from optional processing you may refuse, and separately obtain any legally required separate consent, guardian consent or other authorization. Mentioning unavailable speech, video, memory or robotics features here does not activate their data collection.

1.1 We process personal information only for clear, reasonable, service-related purposes and within necessary scope, minimizing submission and retention. We do not require identifying information where a task can be completed without it.

1.2 Registration, sign-in, requested API calls, settlement and support rely on the applicable basis, such as necessity to enter into or perform a contract with you, legal obligations or valid consent. Writing a use into an agreement does not make an unnecessary use contractually necessary.

1.3 The data improvement program, commercial messages and non-essential tracking are explained separately from basic services. Section 3 describes the program's initial preference, which is not a substitute for required valid authorization. Refusing optional processing does not affect basic services that do not depend on it.

1.4 We undertake applicable controller responsibilities for account and service-management information you provide directly. For end-user information received through developers or enterprise customers, roles depend on who actually determines purposes and means, with data-processing agreements where applicable. End users may contact their application provider or ask us to forward or assist with requests.

2.1 Registration, verification and sign-in

For email registration, we process the email address, internal account identifier, password hash, verification status, necessary verification records and session information to create the account, send verification messages, authenticate, recover access and prevent abuse. Passwords are stored as hashes and should not be logged or persistently stored in plain text. Without necessary registration information, an account cannot be created, but public pages remain available.

Sending verification mail requires providing the email provider with the recipient address and necessary message content, not model requests, images or business files. The appendix describes email processing and how to inquire about it.

When Google sign-in is enabled and you choose it, necessary authentication requests go to Google, and we receive the account identifier, verified email and authentication information for sign-in or linking. We do not request access to Gmail, contacts or Google Drive files, or receive your Google password. Availability depends on the sign-in page; see the appendix for the processing description.

2.2 Access Tokens and API usage

When you create, use or revoke a Token, we process its hash and necessary management identifiers, account association, creation and revocation status and authentication information. Protect full Tokens; never send them to support or public channels.

For authentication, rate limiting, troubleshooting, usage display and billing when enabled, we process request time and identifier, selected model, status, duration, token usage, error type and necessary account-linked information. Security may also require IP addresses, browser or client details and abnormal-access records, without unrelated device collection under the guise of security logs.

2.3 Decision-model text, images and results

When you call Simplex CD (SPX-CD) or Playground, we receive the context, questions, candidate options, instructions, parameters and images you submit and process the results. The purpose is your requested inference, classification, decision or scoring; uploading does not grant unlimited permission for other uses.

Usage records and content archives are separate data. Usage records support metering, limits and billing reconciliation. When content archiving is enabled, authenticated model API and Playground request bodies, uploaded images and responses are also stored separately under sections 3 and 5. Actual service configuration determines archiving; the preference switch alone does not establish that historical content has been stored.

Model archives cover Simplex CD (SPX-CD), its compatible interfaces and the integrated Jev model. For other API calls and calls failing authentication or input validation, the archive primarily records method, path, time, status and duration. Login, registration, password-reset, payment and key-creation request bodies do not enter the model-training archive. Account, email and payment systems still process information for their own necessary purposes; exclusion from training archives does not mean no processing anywhere.

Images are files in restricted server storage; the archive database holds requests, responses and file associations. Storage technology does not reduce protection requirements. Restricted temporary copies may support recovery from failed writes and are subject to the same retention and preference limits. Field filtering does not guarantee removal of all personal information embedded in text or images.

Simplex CD (SPX-CD) requests go to the configured inference service. If you select typesafe-ai/jev, relevant state and questions are sent directly to TypeSafe AI or through Vercel AI Gateway to TypeSafe AI. Vercel processes the request only when the intermediary route is used. Model data paths may differ; routing and third-party handling information should be available before the first call.

Prefer anonymized examples or remove identifying information unrelated to the task. Do not submit identity documents, financial accounts, medical records, credentials, trade secrets or others' information without authority to experimental services whose necessary protections have not been established. Your upload does not replace our notice, minimization or other legal duties.

2.4 Existing voice projects and future multimodal features

Previously saved voice projects, jobs and generated files may remain while voice tools are unavailable. Contact us to request access, export or deletion. Suspension does not mean deletion or authorization for a new purpose.

Before opening speech, camera, video, long-term memory or device-coordination features, we will explain inputs, permissions, processing location, storage controls and deletion. Unavailable features and missing device permissions do not cause recording, photography or continuous environmental collection merely because you browse a page.

Relevant scenarios include microphone audio and transcripts, selected image/video uploads, memory conversations and their summaries or vectors, device state and task-related environmental information. Long-term memory does not automatically mean permanent storage of original audio/video. Deleting an original conversation does not by itself delete related summaries, vectors or memories; corresponding deletion handling is needed.

For identifiable faces, voiceprints, health, location trajectories or other sensitive information, we will explain necessity and effects on individuals, use stricter safeguards and obtain separate consent or another valid basis as required. Ordinary microphone or camera permission does not automatically authorize voice cloning, identification or bystander processing.

2.5 Top-ups, payments and billing

When Stripe top-ups are enabled and you initiate a payment, the Platform and payment chain process information needed for payment, reconciliation, refunds, fraud prevention and required records: account or order identifiers, amount, currency, status, transaction identifiers and necessary billing details.

Card details and authentication collected directly by Stripe-hosted pages follow its applicable policies. We receive necessary results for order and balance management. We will not ask for full card numbers, security codes or payment passwords through the contact form. Model requests, images, audio/video and memory content should not be sent as payment information.

2.6 Contact, support and rights requests

Contact forms collect the name, email, topic and message you provide and necessary correspondence for responding, supporting services or handling collaboration inquiries. Unrelated information is unnecessary.

An inquiry alone does not enroll you in advertising or a marketing list. Separately subscribed commercial messages will include clear opt-out routes. Necessary account, security and transaction messages are not marketing and are limited to service or legal needs.

For closure, deletion, refunds or other rights requests, we may verify your relationship to an account using existing account details or reasonable additional information. We do not request unrelated proof or excessive document copies.

2.7 Website operation, security and browser storage

To deliver pages and maintain security, we may process IP addresses, access times, request paths, browser or client type, errors and necessary security-event information. Logs are used within their purposes and retention periods.

Session cookies maintain sign-in and prevent unauthorized access. Theme preference is stored in your browser and shared through a preference cookie across configured Simplex subdomains. Language and theme preferences should not be used for undisclosed cross-site advertising. Section 4 lists purposes and technical lifetimes.

3.1 The program supports model improvement, evaluation and necessary sample selection and labeling. The participation preference initially appears enabled. That default, not turning it off, registration, acceptance of the Terms or a top-up does not itself establish legally required training authorization. Relevant content may be used only after establishing an applicable lawful basis and necessary authorization. Permission for one inference request is not unlimited training permission.

3.2 Program content may include submitted text, context, questions, options, parameters, images and answers. Long-term retention is possible only while the stated purpose, lawful basis and necessity remain. No uniform automatic expiry does not mean permanent, irrevocable or purpose-unlimited rights. Original samples, annotations and linkable evaluation samples are equally restricted. Public samples, independent third-party disclosure or expanded purposes require applicable additional notice and authorization.

3.3 Turn the program off at Console → Account settings → Data improvement program. The setting covers all API Tokens and Playground calls on the account. After opting out:

  • Existing and new model content is excluded from subsequent training selection and handled confidentially; a prior eligibility marker does not authorize new training.
  • For necessary, lawfully based security, troubleshooting or abuse investigations, ordinary confidential retention is at most 30 days from the call, not a new 30-day period starting at opt-out. Earlier deletion applies when required or when retention is no longer necessary.
  • Content already older than 30 days enters cleanup; newer content is cleaned at expiry. Requests, responses, images and associated temporary archive copies are handled together. Account, billing and legally required security records may have different rules.
  • Background tasks normally perform physical deletion. Task or storage failures do not extend permitted use: training exclusions and expiry access restrictions continue, with deletion completed after recovery. See section 5 for backups and exported copies.

3.4 Rejoining applies only to new calls after rejoining. Earlier confidential content is not returned to long-term retention or training; calls begun before rejoining but still processing keep their original confidential treatment. Enabling the preference still does not replace authorization required for that purpose.

3.5 Opting out cannot automatically reverse completed model training and does not guarantee removal of model influence. You retain applicable deletion, correction, restriction and other rights. We will examine scope, related samples and feasible measures rather than categorically reject requests because training has completed.

3.6 Pseudonymization, replacing account IDs or removing names is not necessarily anonymization. Identifiable or linkable samples remain protected personal information; faces, documents, screens and contextual clues in images require consideration. Anonymization does not automatically extinguish copyright, trade-secret or other restrictions.

3.7 The program primarily controls data and purposes under our control. A selected third-party model has its own processing chain; our opt-out switch does not automatically stop upstream retention or training. Applicable policies, contracts and controls should be checked before connection and disclosed under section 6 and the appendix.

4.1 The website uses the following principal storage. Cookies apply to the current Simplex site or configured shared subdomains; view actual scope and expiry in browser settings. Technical expiry is not proof that related database records have been physically deleted.

Name or type Purpose Default lifetime and control
simplex_platform_session Maintain sign-in 14 days; logout or revocation may invalidate it earlier
simplex_platform_csrf Prevent forged account actions 14 days; may change with security state
simplex_google_flow Validate a Google sign-in you initiate 10 minutes; cleared after the flow
simplex_theme and simplex-theme Remember light/dark appearance Cookie: 365 days; local storage until changed or cleared
Sign-in and verification synchronization markers Synchronize sign-in, logout or verification across tabs Local storage; removable and not an advertising profile
Email cooldown and duplicate-payment submission controls Avoid repeated email and payment submissions Tab session storage, cleared with the relevant flow or session

4.2 If non-essential analytics or marketing tools are enabled, we will separately explain providers, information, purposes, periods and refusal methods, and fulfill applicable authorization requirements.

4.3 Manage cookies and local storage through your browser. Disabling essential sign-in cookies can prevent persistent sign-in. Refusing non-essential tracking should not affect basic services that do not depend on it.

4.4 Features requiring microphone, camera or device permissions will request them before use. Browser or operating-system settings can revoke permission. Revocation affects future collection and does not automatically delete lawfully stored information; use section 7 to request deletion.

5.1 Under current arrangements, principal service data managed by us is stored in Hong Kong. This does not mean all third-party processing, remote access and backups occur there, nor does it describe Hong Kong as mainland-China storage. The appendix describes Google, Vercel, TypeSafe AI, Stripe and email processing and inquiry channels.

5.2 Rules differ by information category:

Category Retention and deletion
Model content in the improvement program Long-term only with an applicable lawful basis and necessity, without a uniform automatic expiry; section 3 governs opt-out. Necessity review and statutory deletion still apply
Confidential model content Normally no more than 30 days from the call; delete earlier when no longer necessary, unsupported by a lawful basis or legally required
General API archive metadata Current archive cleanup operates at 30 days from the call; separate metering, billing and security systems are not deleted by that cleanup
Accounts, password hashes and settings Retained for account management; after verification of closure/deletion requests, remove data without a continuing basis. Required records have restricted purposes and access
Email codes, verification links and sign-in Email verification and password-recovery codes/links: 10 minutes. One-time reset credentials issued after validating a recovery code: 5 minutes. Session lifetime: section 4. Expired credentials cannot authenticate; database cleanup is separate
API Token management Access follows chosen expiry and revocation; necessary management/security records require separate deletion arrangements
Usage, billing and security logs Limited to necessary purposes and applicable statutory periods, depending on record type, unresolved settlement/disputes and legal requirements. Contact us for applicable retention/deletion arrangements; “security” is not a blanket reason to keep model content forever
Existing voice projects, jobs and files Subject to applicable storage arrangements and valid deletion requests. Suspension neither deletes them automatically nor turns them into training samples
Contact, email-delivery and support records Retained to respond, deliver account notices and resolve matters. Afterward, assess continued necessity; request deletion of information no longer needed
Backups, snapshots, exports and dataset copies Follow their systems' rotation/deletion arrangements; contact us for particular periods. Deleting the primary database does not replace handling these copies

5.3 Linked images, requests, answers and temporary archive copies are cleaned together. Exported training or evaluation samples should have source associations and opt-out/deletion handling; deleting the online original does not permit continued use of copies without a basis. This does not claim an existing automatic ability to track every external copy.

5.4 Offline backups and snapshots need rotation, isolation or deletion under their actual management arrangements. Restoration should reapply applicable deletion records. Until removal, backups should be isolated with restricted use, not used to circumvent expiry.

5.5 For information legally required to remain or temporarily difficult to delete, we will verify the reason and restrict it to permitted storage and necessary security, with no incompatible further use, and act when that condition ends. Required records do not automatically include complete model inputs and outputs.

5.6 Material changes to location, purpose or period require applicable prior notice and renewed authorization where needed, without retroactively expanding prior permissions.

6.1 Providers may process necessary information for infrastructure, email, inference, payments, security and support. For entrusted processing, we will agree purposes, periods, methods, categories, safeguards and responsibilities, and supervise processing within authorization rather than permit independent purpose expansion merely because they are providers.

6.2 When providing information to another party that independently determines purposes and means, we will disclose the recipient's identity and contact, purposes, methods and categories, and obtain separate consent or meet another applicable condition. Provider identity, actual scope, locations and rights contacts should be disclosed in the appendix and feature notices, not replaced by a generic “partners” label.

6.3 Integrations include TypeSafe AI's Jev, Google sign-in and Stripe payments, subject to actual availability. Jev requests are sent directly to TypeSafe AI or via Vercel AI Gateway; Vercel participates only in requests using that intermediary. See the appendix for scope. A common gateway does not imply identical policies for all model providers.

6.4 For cross-border provision or overseas access, we will explain recipients, countries/regions, contacts, purposes, methods, categories and rights channels, and fulfill required separate consent, impact assessment and applicable transfer mechanisms. Registration, accepting this Policy, choosing a model name or consenting to one transfer does not cover every future provider/location or replace other legal transfer conditions.

6.5 You may decline optional third-party or cross-border processing by not using the feature, while retaining services independent of that processing. If the processing is integral to the chosen feature, we will explain beforehand. Silent backend routing changes do not replace required notice or authorization for major changes.

6.6 We do not sell personal information or provide non-public inputs/outputs to advertisers for targeting. Unless you make it public, separately authorize disclosure or law otherwise provides, we do not publicly disclose personal information, business samples or conversations. For lawful authority requests, we will verify the basis, limit scope and notify you where permitted.

6.7 If merger, division, dissolution or asset transfer requires a transfer of information, we will notify you as required of the recipient and contact and require continued duties. Changes in purposes or methods need appropriate renewed notice/authorization; changing company or brand does not automatically grant new data rights.

7.1 Within applicable law, you may request access, copies, completion/correction, explanation of processing, restriction or refusal of particular processing, withdrawal, deletion or account closure, and portability where legally available.

7.2 Revoke API Tokens in the console. Request account closure, deletion of existing voice projects and other data actions via contact@zqwei-tech.cn or our Contact page. Lack of a self-service button does not remove the manual channel. For memory, identify whether the request includes originals, summaries, vectors and retrieval indexes; we will handle the applicable associated data.

7.3 To prevent impersonation, verification will be proportionate to risk, preferring existing account channels. Never provide passwords, full keys or unrelated identity documents. We will acknowledge promptly, then explain results, progress or expected completion after necessary checks, within legally specified periods. For complex requests, we will explain additional time and arrangements rather than reject them because no self-service button exists.

7.4 Reasonable requests are generally free. If a request cannot be fully met, we will explain the applicable basis and remedy channels, rather than merely say “unsupported” or “system reasons”. Repetitive or excessive requests are addressed under law, not arbitrary rules.

7.5 Withdrawal or closure does not extinguish lawful fees or required records, but unrelated conditions will not obstruct your rights. Before closure, we will explain effects including Token invalidation, loss of service, export and refundable credit.

7.6 If our processing makes automated decisions with major effects on your rights, you may request explanations and, where provided by law, refuse decisions based solely on automation. For developer-application decisions, we assist according to our role; a model score alone is not a sufficient explanation.

7.7 You may contact us about alleged infringement, complain or report to competent authorities, or seek relief in a court with jurisdiction.

8.1 We take measures appropriate to scale, information and risk, including transmission security, password/Token hashing, access controls, least privilege, necessary log review, confidentiality management and reasonable backup/recovery. Specific certifications or security levels depend on actual publicly evidenced achievements; this Policy claims no certification not obtained.

8.2 Human access for troubleshooting, complaints or security should be limited to authorized personnel, necessary scope and purpose, with appropriate records. “Internal use” does not permit arbitrary viewing, copying or removal.

8.3 For actual or potential disclosure, alteration or loss, we will promptly mitigate, report as required and notify affected individuals of the information, cause, possible effects, remedies and protective steps where required. Effective public notice may be used where individual notice is impracticable and law allows it.

8.4 Protect your account and devices and keep credentials out of requests, repositories and support messages. The internet's inability to be absolutely secure does not remove our responsibilities.

9.1 Services primarily serve developers and researchers. Children under 14 should not register; users aged 14–17 should have guardian knowledge and consent. Any future child-focused service requires specific rules and guardian consent rather than relying on this general Policy.

9.2 If children's information was collected without an appropriate basis, we will verify promptly and take deletion, restriction or other measures. Guardians may contact us, subject to proportionate relationship checks.

9.3 For others' information in applications, recordings, camera views or robot environments, comply with notice, authorization and minimization requirements. Children, visitors and bystanders at home, school or work do not lose their rights because a device owner accepts terms.

10.1 We will retain policy versions and effective information. Important changes in purposes, means, categories, main recipients or rights channels will be clearly notified appropriately before taking effect. Required renewed consent will precede processing.

10.2 This Policy concerns the specified Surd AI services. It does not replace other products' policies or authorize cross-service profiles, movement of old content or repurposing of historical data.

10.3 Non-excludable applicable local protections also apply to overseas users. This Policy does not claim completion of every jurisdiction's requirements; region-specific service provision should include necessary supplemental notices and arrangements.

10.4 For questions, email contact@zqwei-tech.cn or use our Contact page. The operating team and contact email are identified above.

This appendix is part of the Policy and identifies recipients by the features actually used. Names below are service brands; contracting entities, locations, upstream retention and contractual restrictions can vary by account region and route. This page does not present details not yet individually confirmed as verified facts, or promise that all providers process in Hong Kong, retain nothing or refrain from training. Ask contact@zqwei-tech.cn about applicable arrangements; legally required individual notice and authorization should precede relevant processing.

A. Simplex CD (SPX-CD) inference and infrastructure

Purpose and scope: inference and necessary operation, including submitted context, questions, options, images, parameters, results and necessary metadata. Account management and inference information are handled separately; complete account details are not attached to inference requests.

Storage and contact: principal service data managed by the Surd AI Team is in Hong Kong; archived images use private server file storage. This does not presume all inference nodes, backups and remote access are in Hong Kong. Contact the team about infrastructure, storage and deletion; sections 3 and 5 govern content-archive periods.

B. Vercel AI Gateway — only when used as an intermediary

Trigger: where a third-party model call uses the gateway, it forwards necessary content to TypeSafe AI or another expressly disclosed model provider. A direct connection does not send that request through this gateway.

Information and purpose: necessary context (state), questions/options (questions), model parameters and technical metadata for forwarding requests and returning results. Your Simplex password and full Simplex API Token are not needed.

Rules and contact: entities, locations, retention and training restrictions depend on actual gateway terms, contracts and configuration. Our improvement switch does not automatically change those rules. See the Vercel Privacy Notice, or contact Simplex about our specific route.

C. TypeSafe AI / Jev

Trigger: choosing typesafe-ai/jev sends necessary inference content to TypeSafe AI, directly or through Vercel AI Gateway. Either route uses a model provided by TypeSafe AI.

Information and purpose: context, questions, candidate content, necessary parameters and technical metadata for text decisions and results. Unrelated account, payment and business information is not needed.

Rules and contact: processing locations, retention, training and opt-out depend on TypeSafe AI's applicable rules and contracts, not assumptions from a model name or our preference switch. Ask Simplex to help inquire, forward or address requests concerning actual recipients, upstream rules and rights. Major changes in recipients or scope require applicable notice and authorization under section 6.

D. Stripe payments

Trigger and information: voluntarily initiating a top-up or refund through an available Stripe flow involves order identifiers, amount, currency, payment status and necessary payment, billing and anti-fraud information. Payment services handle card and other details collected directly on their pages.

Purpose and boundaries: payment, refunds, security and compliance, without model inputs, images, audio/video or memory as order attachments. Actual entities, locations and retention depend on the account region, payment product and contract.

Notice and contact: see the Stripe Privacy Policy for Stripe's rights channels; contact us about Platform-controlled order data.

E. Google sign-in — when enabled and chosen

Trigger and information: sign-in or account linking initiated by you sends necessary client/authentication parameters and receives account identifiers, verified email and necessary identity claims. The purpose is authentication, not authorization to access Gmail, contacts or cloud files.

Rules and contact: entities and locations depend on actual use region and Google terms. See the Google Privacy Policy. Contact us about Platform-held account information. Availability depends on the actual sign-in page.

F. Email and other feature services

Email: registration verification, security and service messages involve recipient addresses, necessary message content and delivery status, without model requests, images or business files attached. Ask our contact email about the actual mail provider, locations and applicable retention.

Other services: if we introduce personal-information-processing CDN, anti-abuse, error-monitoring, analytics or support services, we will explain actual providers, categories, purposes, locations, retention and refusal arrangements, and first obtain authorization where required. Listing a service category does not mean it is already used or collecting data.

Read the Surd AI Terms of Service or submit requests through our Contact page.

Read the Terms of Service ↗Back to top ↑