Exchange privacy notice

Updated 21 October 2026

Ever AI Exchange is a project of Ever AI Holdings Sdn Bhd. This notice covers buying requests, seller listings, supplier connections, API keys and usage accounting stored by the exchange. Requests and submitted listings do not by themselves create completed purchases.

Information you submit

We store your company or seller name, email, country, requested model, quantities, asking price or budget, requirements and seller authorisation details. We also store your Site-specific sign-in identifier, record status and timestamps. Earlier enquiries may contain your name and estimated spending range. Do not put secrets in free-text fields. The supplier connection form has a dedicated encrypted endpoint-token field; only supply credentials you are authorised to delegate.

How it is used

We use these details to manage buying requests, assess seller eligibility, verify supply and contact you about the relevant record. Submitting a listing does not enrol you in a general marketing mailing list. Unverified listings and buying requests are not publicly displayed.

What an activated listing shows

Once a seller listing is verified and activated, its seller name, model, quantity, price and available supply may be visible in the catalogue. Contact email, account identifier and evidence descriptions are not included in the public inventory response.

Hosting and access

The application uses OpenAI Sites for hosting and authentication and Cloudflare D1 for storage. These services process data under their applicable terms. Your account records are accessible after sign-in and managed by the exchange operator. Buying requests and evidence are not sent to AI models. When routing is activated and an API request is made, its prompt is sent to the selected approved supplier. Buyer prompts and responses are not stored in the exchange database; supplier retention and processing location must be reviewed separately. Infrastructure providers may process request metadata under their terms.

Router records and credentials

We store versioned supplier declarations, evidence references, representative names, scope, expiry and review decisions. Endpoint tokens are encrypted; buyer API keys are hashed and their full value is shown only at creation. Request records contain identifiers, status, timestamps, token counts and accounting amounts, not prompt or response text. Reviewers can access supplier evidence and operational records. No automatic retention deadline or self-service deletion of declaration, audit or financial records is currently configured; operator handling and retention policy must be established before public commercial use.

Manage your records

You can remove buying requests or listings through My exchange, and earlier enquiries through Earlier enquiries. Removal deletes that request or listing record; it does not delete separate supplier declarations, router audit or accounting records. API keys can be revoked and supplier connections paused in the router console. Hosting logs and backups, if retained by infrastructure providers, may follow separate schedules. Deleting a record does not cancel any separately executed external agreement.

Service availability

The hosted exchange is currently restricted to its owner's account. Public service, contact arrangements, retention policy, paid transactions and international availability require operational activation and the applicable commercial terms. No payment is collected by the current request and listing forms.