Short answer
LaoZhang API does not store API prompts or responses by default. API content is transmitted only as necessary to process the request and return the result. Necessary request metadata is stored for billing, usage display, troubleshooting, rate limiting, security, and abuse prevention. Upstream model and infrastructure providers may apply their own processing, logging, and retention rules.
This page follows the LaoZhang API Terms and Data Policy. The policies were last updated on January 1, 2026, and this page was last verified on September 2, 2026. If this page conflicts with a formal policy, the formal policy controls.
API prompts and responses
Upstream providers may apply their own logging, retention, abuse monitoring, safety review, training, and opt-out terms. LaoZhang API cannot guarantee that every upstream provider uses the same data practices.
- account or API key identifier;
- timestamp, model, endpoint, and route;
- token or usage amount and billing unit;
- request status, error category, and latency;
- routing reliability, security, and abuse-prevention information.
Troubleshooting logs are generally retained for 7 days. Relevant data may be retained longer where reasonably necessary for security, abuse investigation, billing disputes, legal compliance, or service integrity.
Other stored data
Do not send complete API keys, passwords, regulated data, or sensitive personal information in support messages, screenshots, or public chats. Provide only necessary, redacted information through a support-approved secure channel.
Cross-border processing and user responsibility
API requests may be transmitted to upstream model, infrastructure, and service providers in the United States, Singapore, the European Union, or other regions. Users are responsible for confirming that they:
- have the right to submit and transmit the data;
- have obtained necessary notices, consents, contractual protections, and legal bases;
- comply with applicable privacy, data protection, cybersecurity, export-control, and cross-border transfer requirements;
- minimize, de-identify, or anonymize personal, confidential, or regulated data where appropriate.
Pre-integration checklist
- Store API keys in a server-side secret manager or environment variable.
- Minimize personal and sensitive data in prompts.
- Complete internal security, legal, and upstream-policy reviews before production use.
- Use call logs to review metadata and errors without copying complete request content into support messages.
- Revoke or rotate a potentially exposed key immediately and contact support.
