Privacy Policy

1. Who is responsible

TODO, TODO, is the data fiduciary for the purposes of the Digital Personal Data Protection Act, 2023. Contact TODO.

2. What we collect

• Account data — the email address you sign up with, your API key prefixes, and your wallet and invoice history. Kept while your account exists.
• Usage metadata — for every call: timestamp, API or model, token or unit counts, amount charged, the engines and region used, and the SHA-256 hashes of the input and output. This is what receipts and invoices are built from.
• Call content — the prompts, documents, audio and images you send. See section 3.
• Uploaded files — stored to serve the call and deleted automatically when their retention window expires (24 hours by default).
• Product analytics — page views and named UI events. No third-party advertising or cross-site trackers.

3. Call content is not used to train models

We do not train models on your inputs or outputs, and we do not sell them. Job API calls run in ephemeral retention mode by default: content is held only for the duration of the call and is not written to durable storage. The receipt keeps the hash of your input and output, never the content itself, which is how a call can be proven without retaining what was in it.

Datasets you create are the exception, by design: their documents and vectors are stored until you delete the dataset.

4. Where it is processed

The platform runs in Falkenstein, Germany (Hetzner). This means your data is processed outside India.

Individual calls may additionally be routed to third-party model providers or to rented marketplace GPUs, which may be in other countries again. Every call is labelled with a lane:

• S (Sovereign) — no third-party egress.
• R (Resident) — served from an India-resident worker.
• G (Global) — may cross to a third-party provider or a marketplace GPU in any region.

Before anything leaves for an R or G lane it passes a PII gate that strips identifiers. The lane and region on each receipt are the authoritative record of where a call actually ran, and your API key can be pinned so that calls outside a permitted lane are refused rather than routed.

5. Who else sees it

We share data only with processors needed to run the service:

• our hosting provider, for compute and storage;
• our payment gateway, for card and UPI processing — we never see or store your card details;
• model and GPU providers, for calls you route to lanes R or G, after the PII gate;
• a law-enforcement or regulatory authority, where we are legally required to.

6. How long we keep it

• Uploaded files: 24 hours by default, then deleted automatically.
• Call content: not retained for job APIs in ephemeral mode; dataset content until you delete it.
• Usage metadata, receipts and invoices: eight years, as required for tax records.
• Account data: until you close your account, then deleted except records we must keep for tax.

7. Your rights

Under the DPDP Act you may ask us for a copy of your personal data, ask us to correct it, ask us to erase it, and nominate someone to exercise these rights on your behalf. Write to TODO and we will respond within 30 days.

8. Grievance officer

TODO, TODO. If we have not resolved your complaint you may escalate to the Data Protection Board of India.

9. Security

Traffic is encrypted in transit. API keys are stored hashed, never in plaintext. Receipts are signed with an Ed25519 key so that a record of what we did cannot be altered after the fact — including by us.

10. Changes

Material changes will be announced by email at least 14 days before they take effect.