Privacy Policy

Effective date: October 28, 2026

Bimatch operates an AI inference marketplace that connects buyers with suppliers of model access. This policy explains how the Bimatch service at www.bimatch.ai, its API and its optional connected agents handle personal information.

1. Information we collect

• Account information: your username, display name, account identifier, authentication records and, when provided through Google sign-in, your email address. Password-based accounts use a password hash rather than a stored plaintext password.
• Google sign-in: we request only the openid, email and profile permissions. We use your Google account identifier, verified email address and name to create or identify your Bimatch account. We do not request access to Gmail messages, Google Drive files, Google contacts or calendars. We do not receive your Google password.
• Marketplace and usage information: API key identifiers, model selections, listings, orders, request identifiers, token usage, prices, wallet and transaction records, and request status or errors.
• Inference content: prompts, messages, attachments included in API requests, and model responses are processed to provide the inference you request. Content is routed to the selected execution service and relevant model provider.
• Connected supplier agents: when you choose to pair an agent and connect provider accounts, we process node identifiers, device/platform information, connection status, available models, account metadata and the provider credentials or session material required for that integration. These credentials are separate from Google sign-in data.
• Technical and support information: IP addresses and request metadata used for security and rate limiting, essential authentication cookies, browser storage for account display and language preferences, and information you send when contacting support.

2. How we use information

We use this information to authenticate users, maintain sessions, operate buyer and supplier accounts, route inference requests, manage connected agents, calculate usage and account balances, provide support, prevent abuse and investigate service failures. Google account information is used for account identification and sign-in, not to obtain access to unrelated Google services.

We do not sell Google user data, use it for advertising, or use it to train AI models. Bimatch's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3. Sharing and third-party services

Our hosting and infrastructure providers process information as needed to operate the service. The current application and database are hosted on Hetzner infrastructure in the United States. Google processes sign-in requests under its own privacy policy. Pages that load Google Fonts also make requests to Google's font servers.

When you submit an inference request, the content necessary to fulfill that request is transmitted through the relevant supplier execution environment and to the selected model provider. Their processing and retention policies may differ from ours. Do not include information you are not authorized to share with these services. Your Google sign-in identity is not part of the model prompt payload created by Bimatch.

Authorized service operators may access information when necessary for support, security or maintenance. We may also disclose information when required by applicable law or to address fraud, abuse or threats to the service. We do not publish provider credentials or make them available to other marketplace users.

4. Storage, retention and security

We use HTTPS for public connections, HttpOnly authentication cookies, hashed session tokens and encrypted storage for connected-provider credential material. Access to the production database is restricted. No method of storage or transmission is completely secure.

Account and marketplace records are retained while needed to provide your account and service. Transaction and security records may be retained longer where needed for accounting, dispute resolution, fraud prevention or legal obligations. Session and connection credentials have expiry or validity controls; expiry does not necessarily immediately remove every associated database record.

Backups and operational copies may contain personal information and are access-restricted. Deletion from the active service may not immediately remove a record from existing backups. Retained backup data is used for recovery and security rather than ongoing product use. Model providers and supplier execution environments control retention in their own systems.

5. Your choices, access and deletion

You can sign out, stop using the service, revoke Bimatch's Google access in your Google Account connections settings, and disconnect agents or revoke connected-provider credentials. Revoking Google access does not by itself delete your Bimatch account or previously stored marketplace records.

To request access, correction or deletion of your account and associated personal information, email support@bimatch.ai with the subject “Privacy request” and the email or username associated with your account. Do not send passwords, API keys or provider tokens. We may ask you to verify account ownership before acting. We will explain any records that must be retained for legal, security or transaction obligations.

6. International processing

Using Bimatch may involve processing outside your country, including on our United States application infrastructure and in countries where selected suppliers, model providers and supporting services operate.

7. Changes and contact

We may update this policy as the service changes. The effective date above identifies the current version; material changes will be communicated through the service or account contact details where appropriate. For privacy questions or requests, contact the Bimatch service team at support@bimatch.ai.