Terms of Service

TokenZip (“we”, “us”) is a cloud service at tokenzip.ai that analyzes the AI usage data you connect — provider API records and usage exports — finds waste in it, and produces reports estimating what you could save (the “Service”).

Subject to these Terms, we grant you a limited, non-exclusive, non-transferable right to access and use the Service for your own business purposes, including work you do for your clients. We and our licensors own the Service itself — the software, design, branding, and everything under the hood. These Terms don’t give you any right to our source code or trademarks.

TokenZip reports are generated automatically from the usage data you connect. A few things you should understand about them:

• Reports are informational. They reflect the usage records available at the time of the run. Your traffic changes, models are updated and deprecated, and provider prices move — a report is a snapshot, not a live feed.
• Savings figures are estimates. A projected saving is a calculation over your recorded usage under stated assumptions, not a promise about a future invoice. Where a finding has been verified by replay we say so and show the evidence; where it hasn’t, it remains an estimate. Verify anything you intend to rely on.
• Prices come from a maintained catalog. We price your usage against a table of provider rates we keep up to date. It can lag a provider’s own change, and it does not know about any custom or negotiated pricing you have.
• Acting on a recommendation is your decision. Changing a model, a prompt, or caching behavior can affect the quality of your product. TokenZip measures cost, and — where you enable replay — output comparability; it cannot judge whether a change is right for your users. That call, and its consequences, are yours.
• Provider and model names belong to their owners. The names and marks of AI providers and their models appear in reports solely to identify the services your usage runs on. TokenZip is not affiliated with, endorsed by, or sponsored by any of them.

• Your authority to connect. You may only connect API keys, and only upload usage exports, that you own or are authorized to use. You are responsible for ensuring that doing so is permitted by your agreement with the provider and by any obligations you owe your own end users, including any notice or consent they require.
• What we do with a key. We use a connected key only to read the usage records needed to run your audits. We store it encrypted at rest and never write to your provider account. You can revoke it at the provider at any time, which immediately ends anything we can do with it; to have the stored credential removed from TokenZip, email us and we will do it within 30 days (see section 8).
• Replay is opt-in, and this is what it licenses. Replay is off unless you enable it for your workspace. Enabling it grants us the right to transmit, for each sampled call, four pieces of your content to third-party model providers through our AI gateway: the task prompt, its system instructions, the original completion your production model returned, and the candidate completion the alternative model produced. Enabling it also confirms you have the rights to have all four processed that way, including any rights owed to your own end users.
• We screen samples for a few specific patterns. Each sampled call is checked for specific structured patterns — checksum-valid payment card numbers and certain government identifier formats among them. A match in your own content means the sample is never sent; a match in the candidate model’s reply means we discard that sample before the scoring step, after the candidate call has already run. Excluded samples do not count as evidence.
• The screen does not make replay safe for sensitive data. It is a narrow pattern match on particular formats. It cannot detect sensitive information written as ordinary prose, and it does not recognise every format of every identifier — it is not a classification system and it does not discharge your obligations or ours. You must still not connect usage data containing sensitive personal information (see section 4), and you must not enable replay if your traces may contain health, financial, or identity information about individuals. Only you can see what is in your traces.
• Replay is capped, and it is not a runtime. Replay runs against a limited sample per finding and under a token budget per run. It exists to verify a saving, not to serve production traffic; using it as general-purpose model access is a breach of section 4.
• Where the content goes. Our Privacy Policy sets out what is transmitted when replay is on, the no-prompt-training routing constraint we apply to it, and which of our infrastructure providers hold your data whether replay is on or off.

When using the Service, you agree not to:

• use it in violation of any applicable law or regulation;
• connect credentials, or upload usage data, that you are not authorized to use, or attempt to use the Service to reach systems or data you have no rights to;
• connect usage data containing sensitive personal information — including protected health information, financial account numbers or payment card data, government-issued identifiers, precise geolocation, biometric identifiers, or data revealing racial or ethnic origin, religious beliefs, sexual orientation, or trade-union membership. This restriction is not ours alone: the standard terms of the AI gateway replay runs through prohibit sending those categories, so connecting them puts your audit and our access at risk. Before enabling replay you must satisfy yourself that the traces in that workspace are appropriate to transmit to third-party models; TokenZip does not classify or redact free-form prompt text and cannot make that judgement for you;
• resell, sublicense, or offer the Service (or reports generated by it) as your own competing product — sharing reports internally and with your clients is fine;
• reverse engineer, scrape, or programmatically extract the Service itself, or probe it for vulnerabilities;
• circumvent plan limits, rate limits, run quotas, or access controls, or share one account across people or entities beyond what your plan allows;
• use replay to route traffic through our AI gateway for any purpose other than auditing your own recorded usage;
• introduce malware or interfere with the Service's operation or other customers' use of it.

We may suspend or limit access if your use materially harms the Service or others, and we’ll make commercially reasonable efforts to notify you first.

You must provide accurate account information and keep your credentials secure — you’re responsible for activity under your account, including any provider keys connected to it. You must be at least 18 years old (or the age of majority where you live) to use the Service. Tell us promptly at hello@tokenzip.ai if you suspect unauthorized use of your account, and revoke any connected provider keys with the provider.

TokenZip offers a free tier that includes one audit, and a Starter subscription at $199 per month, billed monthly in advance through our payment processor Stripe. Each plan includes the usage allowances described on our pricing page.

• Auto-renewal. Paid subscriptions renew automatically at the end of each billing period until you cancel.
• Cancellation. You can cancel anytime from the billing portal in your account settings, or by emailing us. Cancellation takes effect at the end of your current billing period and you keep paid access until then. Afterwards your reports remain addressable at their existing links, but they revert to the free-tier view: the executive summary and your top finding in full, with the remaining findings shown as locked headline figures rather than full detail, evidence and replay proof. Nothing is deleted, and resubscribing unlocks those same reports again.
• Refunds. Except where required by law, fees are non-refundable and we don’t prorate partial billing periods.
• Price changes. We may change prices with at least 30 days’ notice; changes apply from your next renewal, and you can cancel before then if you don’t agree.
• Taxes. Fees exclude taxes; you’re responsible for any that apply to your purchase.
• Billing disputes. Contact us about any billing issue within 60 days of the charge so we can put it right.

These Terms apply from the moment you first use the Service and continue while you use it. You can stop using the Service — or ask us to delete your account entirely — at any time. We may suspend or terminate your access if you materially breach these Terms and (if the breach is fixable) don’t fix it within 14 days of our notice, or immediately for serious breaches such as unlawful use or connecting credentials you had no right to connect.

Account deletion is a request rather than a self-service action today: email us and we remove your personal data and any connected provider credentials within 30 days, as described in our Privacy Policy. Sections of these Terms that by their nature should survive termination — including ownership, disclaimers, limitation of liability, and indemnification — survive it.

• Your inputs are yours. You retain all rights to the usage data, credentials, and other content you submit. You grant us the license we need to host and process them solely to provide the Service to you — including, where you have enabled replay, transmitting the four content fields enumerated in section 3 (task prompt, system instructions, original completion, candidate completion) to model providers.
• Your reports are yours to use. As between you and us, you may use the reports generated for you for any lawful business purpose, internally or with your clients.
• Report links are unguessable, not secret. Reports live at long random URLs. Anyone holding a link can open the report, so you control who sees a report by controlling who gets its link.
• We treat your data as confidential. We don’t look at your usage data or reports except to operate the Service, fix problems, comply with law, or with your permission. We do not train AI models on your content. Replay requests are routed with the gateway’s no-prompt-training constraint set, so they are directed to providers that do not train on prompt data, and those providers are reached under commercial API terms that do not grant training rights. We may use aggregated, de-identified usage data to improve the Service.
• Deleting it. Removal of a report, a set of ingested records, a stored credential, or your whole account is handled on request at hello@tokenzip.ai within 30 days. There is no self-service delete in the product today, and we would rather say so here than imply a button that isn’t there.
• Feedback. If you send us ideas or suggestions, we may use them without restriction or obligation to you.

THE SERVICE AND ALL REPORTS ARE PROVIDED “AS IS” AND “AS AVAILABLE.” TO THE FULLEST EXTENT PERMITTED BY LAW, WE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT REPORTS, SAVINGS ESTIMATES, OR PROVIDER PRICING ARE ACCURATE, COMPLETE, OR CURRENT, THAT ANY PROJECTED SAVING WILL BE REALIZED, THAT REPLAY RESULTS PREDICT HOW A MODEL WILL BEHAVE ON YOUR FUTURE TRAFFIC, THAT THE SERVICE WILL BE UNINTERRUPTED OR ERROR-FREE, OR THAT ANY PARTICULAR BUSINESS OUTCOME WILL RESULT FROM USING IT.

Some jurisdictions don’t allow certain warranty disclaimers, so parts of the above may not apply to you.

TO THE FULLEST EXTENT PERMITTED BY LAW: (A) NEITHER PARTY WILL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, OR DATA, EVEN IF ADVISED OF THE POSSIBILITY; AND (B) OUR TOTAL LIABILITY ARISING OUT OF OR RELATING TO THE SERVICE OR THESE TERMS WILL NOT EXCEED THE GREATER OF ONE HUNDRED US DOLLARS ($100) OR THE FEES YOU PAID US IN THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM.

These limits don’t apply to liability that can’t be limited by law, to your payment obligations, or to either party’s fraud or willful misconduct.

You agree to defend and indemnify TokenZip against third-party claims arising from your breach of these Terms, your violation of applicable law, or your connection of credentials or usage data you were not authorized to submit (for example, a claim by one of your own end users about prompt content you uploaded). We’ll give you prompt notice of any such claim and reasonable cooperation, at your expense.

• Changes to the Service. We’re constantly improving TokenZip and may add, change, or remove features. We won’t materially reduce the core functionality of your paid plan mid-term without notice.
• Changes to these Terms. We may update these Terms; material changes will be posted here with at least 30 days’ notice before taking effect. Continued use of the Service after that constitutes acceptance.
• A United States service. TokenZip is operated from the United States and offered to customers in the United States. It is not directed to individuals in the European Economic Area or the United Kingdom, and we do not offer it to customers there. If you use it from outside the United States you do so on your own initiative: your data is processed and stored in the United States, and complying with the laws that apply where you are is your responsibility, not ours.
• Governing law. These Terms are governed by the laws of the State of Texas, excluding its conflict-of-laws rules, and disputes will be resolved exclusively in the state or federal courts located in Texas. Both parties waive any right to a jury trial.
• Force majeure. Neither party is liable for delays or failures caused by events beyond its reasonable control — including an outage or policy change at an AI provider or infrastructure vendor the Service depends on.
• Assignment. You may not assign these Terms without our consent; we may assign them in connection with a merger, acquisition, or sale of assets.
• Severability & waiver. If a provision is unenforceable, the rest remains in effect. Not enforcing a provision isn’t a waiver of it.
• Entire agreement. These Terms, together with our Privacy Policy, are the entire agreement between you and TokenZip about the Service and supersede any prior agreements.

Questions about these Terms: hello@tokenzip.ai.