Privacy

Updated

This page summarizes where a request's data goes. The privacy policy is the binding text.

The platform

  • Request and response content is not stored. The exception is risk review: requests that trip risk controls keep a sample for human review, for the period stated in the privacy policy.
  • Usage, amounts and call metadata (time, model, serving endpoint, status) needed for billing are kept for bills and reconciliation.
  • The privacy policy states where the platform itself is deployed.

Content moderation

Requests pass through content moderation. The privacy policy names the moderation provider and where it processes data.

Providers

  • The request is forwarded to the provider that serves it, and how that provider handles data follows each endpoint's data policy declaration: whether it retains data, for how long, whether it trains on it, and where it processes it.
  • Before forwarding, the platform removes fields that could link the request to you (user, metadata.user_id, safety_identifier, prompt_cache_key) and does not pass on your IP, User-Agent or platform key.
  • To require no retention, use "data_collection": "deny"; to limit processing regions, use data_regions or exclude_regions. Both constrain only the provider side; see Data policy.