1. Who we are
Mihfar Interface ("Mihfar", "we") operates a multi-provider AI API gateway and a web dashboard at this website. You can reach us about anything in this policy at destek@mihfar.com.
2. Data we collect
- Account data: username, e-mail address, and your password (stored only as a salted bcrypt hash — we cannot read it), role and prepaid balance.
- Usage records (metadata): for every API call we record the time, the model and endpoint used, token counts or billed minutes, cost, and which of your API keys was used. This is needed for billing and abuse prevention.
- Content you send through the API: prompts, files, audio and responses are forwarded to the AI provider that serves the model you selected. We do not store the content of API requests or responses. For file uploads we keep only the file name, size, purpose and the provider's file identifier.
- Dashboard chat: if you use the in-dashboard chat, the conversation is saved in your account so you can continue it. You can delete a conversation at any time.
- Payment records: order number, amount, currency, status, date and your e-mail. Card details are entered on the payment provider's page and never reach our servers.
- Technical data: a session cookie that keeps you signed in, and standard server logs (IP address, time, requested page) used for security and troubleshooting. Pages load fonts and icons from public CDNs (Google Fonts, jsDelivr), which can see your IP address.
3. Why we use it
To provide the service you asked for (authentication, routing your requests, billing), to process payments, to secure the platform and prevent abuse, to comply with legal and accounting obligations, and to answer your support requests. We do not use your data for advertising and we do not sell it.
4. Who we share it with
- Third-party AI model providers that run the models you call (the provider depends on the model; we may also host some models ourselves). With Mihfar virtual models (e.g.
mihfar-auto) we may choose the provider for you. Your request content is processed under that provider's own terms and privacy policy. - Payment providers: Creem (Merchant of Record for card payments) and Shopier. They receive the data needed to take payment and prevent fraud, and process it under their own policies.
- Infrastructure providers that host the service, and authorities where the law requires it.
Some of these providers are located outside your country (including outside Türkiye and the EEA); transfers rely on the safeguards available under applicable law.
5. How long we keep it
Account data is kept while your account is active. Usage and payment records are kept as long as needed for billing, dispute handling, security and accounting, and for the periods required by law. Dashboard chats are kept until you delete them or close your account. You can ask us to delete your account at any time (see below).
6. Your rights
Under the Turkish Personal Data Protection Law (KVKK) and, where applicable, the GDPR, you may ask whether we process your data, request a copy, ask for correction or deletion, object to processing, and complain to the competent authority. Write to destek@mihfar.com from the e-mail address on your account; we answer within 30 days.
7. Security
Traffic is encrypted with HTTPS, passwords are hashed, and access to administration is restricted. Keep your API keys secret — anyone holding a key can spend your balance. No system is perfectly secure; if we learn of a breach affecting you we will notify you as the law requires.
8. Children
The service is not intended for people under 18.
9. Changes
We may update this policy; the date at the top shows the latest version. Material changes will be announced on the announcements page.