Privacy for Inferock.

This policy covers the public website, hosted Inferock, and the local inferock-bench posture described in the public documentation.

The policy is written the way Inferock writes receipts: concrete controls, concrete data paths, and no certification or recovery claim that is not backed by shipped product reality.

B1. Retention schedule.

• - Prompt text: not kept, in any request format. Reply text: not kept; from each reply we keep its length, a fingerprint and simple facts about it. Provider error messages: not kept in the call record; we keep the type of error and its code. Tool definitions: a fingerprint and their structure, without their descriptions. What we do keep from a call is held in the call record for 18 months, then deleted. See What we see and keep on a call.
• - Money records: we keep records of top-ups, charges, service fees, taxes, balances and billing corrections, together with the billing and account details needed to identify those records and the balance owner, and records of acceptance of the applicable Terms. We keep these records while the account is open and for 7 years after the later of the transaction date or account closure. If law requires a longer period, we retain the required records for that period. These records support accounting, tax, billing disputes and unclaimed-property reporting. This money-record period does not extend retention of inference request or response content.
• - Usage and metering records that are not needed as money records follow the billing and observation window plus the statement/dispute period, with an in-house default of 13 months. Records needed to support charges or balances follow the money-record period above.
• - Account and identity data: kept for the life of the account and deleted on closure under B2, except the billing and account details needed for the money records and retained under their schedule above.
• - Operational logs: most are kept for one month; some internal logs have no time limit set. See What we see and keep on a call.

B2. Deletion process.

Account closure disables access immediately and triggers deletion of account and identity data except the details retained with money records under B1. Call records, with everything they hold as set out in What we see and keep on a call: 18 months, then they are deleted automatically. Other usage and metering records are deleted at the end of their B1 window; money records are deleted at the end of their applicable retention period. Backups containing residual copies age out on the backup cycle, with an in-house default of no more than 7 days, and are not restored selectively. We handle written deletion requests within an in-house 30-day target, subject to the retention requirements above and applicable law. We log the deletion action and timestamp without content.

B3. Export process.

A customer may request a machine-readable export of its account-scoped data—including identity and configuration data, usage and billing records, and the call records kept for your account—by emailing contact@inferock.ai. We respond to export requests within 7 to 14 business days. We verify the requester's identity, keep any export tenant-scoped, and may route requests for organization-controlled data through the customer's administrator. Export requests remain subject to the rights and limits described below.

B4. Incident-response process.

Stages: Detect (alerts to a staffed destination + the login-to-call synthetic; customer/report intake) → Triage (severity + scope + whether personal data is affected; open an incident record) → Contain / mitigate (revoke keys, isolate, roll back to the last-good build as the go-live ops plan already rehearses) → Notify (affected customers per A7's without-undue-delay / 72h target when personal data is affected; status updates until resolved) → Remediate + post-mortem (root cause + the regression/control that prevents recurrence; recorded like the existing incident post-mortems, e.g. the 2026-07-21 TLS incidents). Owner: the on-call/support contact named in the go-live ops readiness (O1).

This section explains in plain words what Inferock receives and keeps when you send a call. It applies the same way to calls made with your own provider key and to calls on managed Inferock Serve, because both use one pipeline.

In short: on our standard routes we do not keep the text of your prompt or of the model's reply, apart from the error case explained under Logs. For each call we keep a call record with what we need for billing and measurement, fingerprints in place of text, and the structure of any tool definitions, for 18 months.

What we receive

• On our standard routes your request and the model's reply pass through Inferock so we can route the call, measure it and bill it.
• On our encrypted routes we only relay encrypted traffic. We cannot read your request or the reply.

What we keep for each call

• A call record: your account, the model provider, the model, the result of the call including any failure type, the tokens billed and the tokens delivered, the cost and the time.
• From your request we keep a fingerprint of the request body (a one way SHA 256 hash) and the generation settings you chose, such as the maximum number of tokens. We do not keep the text of your prompt, in any request format.
• If you ask for a reply in a set format, we keep a fingerprint of that format and its structure, in the same way as for tool definitions in the next point. If you set words or phrases that make a reply stop, we keep only how many there are and a fingerprint of them. If you send us a reference answer for a factuality check, we keep only its length and a fingerprint.
• If your request includes tool or function definitions, we keep, for 18 months, the name of each one, a fingerprint of its fields, and how its fields are set up, including their names and types, which ones are required, limits such as a maximum length or value, and patterns a text value must match, as written. Where a field lists the values it allows, we keep numbers, true or false values and empty values as written, and for every other value, such as a word or phrase, only its length and a fingerprint. We do not keep their descriptions, titles, comments, examples or default values.
• If we find a secret such as an API key inside a request, we keep a fingerprint of it in place of the secret.
• From the reply we keep its length, a fingerprint of it (a one way SHA 256 hash) and simple facts about it, such as whether it came back empty or, for a reply in a set format, where it breaks that format. We do not keep the text of the reply, or the words in tool call arguments, citations, token probabilities or the text of a refusal. If the model provider sends back an error, we keep the type of error and its code, not the text of the message.
• We work those facts out as the reply passes through us, to check billing and to run automatic quality and safety checks on replies, such as spotting broken output or a leaked secret. We do not use your prompts or the replies to train any model.

What we do not keep

• The text of the prompts you send in calls, in any request format, and the text of the replies, apart from the error case explained under Logs. Prompts you save yourself in a test set are covered under Optional features.
• Anything readable from calls on our encrypted routes. For those we keep only a billing receipt for each call.

Logs

• Our service logs record request ids, the provider, the route, the model, the result, the spend and your IP address. Apart from the error case below, they do not record the text of your prompts or the replies. We keep most of them for one month. Some internal logs have no time limit set.
• In some error cases one of our services can log an error that includes part of a provider error message, which can repeat part of your request.

How long we keep it

• Call records, with everything they hold as set out above: 18 months, then they are deleted automatically.
• If a call record cannot be saved at first, a copy of it, with everything listed above, waits in a retry queue for up to 14 days. The queue is encrypted.
• Logs: most for one month, as above.
• Money records such as top ups and charges: as described in the Money records part of this page.
• Backups: 7 days, encrypted. A deleted record can remain in a backup for up to 7 days.

Who can see it

• You can see your own call records in your dashboard.
• Inside Inferock, only the service itself and a small number of Inferock administrators can read call records. No one outside Inferock has been given access to the systems that store them, and call records are stored encrypted.

Training

• We do not use your prompts, the replies or your call records to train any model.
• For managed Inferock Serve, the hosting partner's terms with us say it does not train on your content and does not keep it after serving the request.

Your own key and managed Inferock Serve

• Both use the same pipeline, so everything above applies to both.
• With your own key, the model provider handles your call under your account and its own terms.
• With managed Inferock Serve, we send your call to our hosting partner without your account details.

Optional features

• If you save a test set (a golden set), we keep the prompts and the replies you put in it until you delete them. This happens only when you use that feature, and you can delete a test set at any time.

Analytics

• The analytics tool records how you use the dashboard, with all text and inputs masked. It never receives your calls or call records, and it does not keep your IP address.

Deleting your data

• To delete your account and its call records, email contact@inferock.ai. We handle written requests within 30 days, as described on this page. Today our team does this by hand: closing your account does not delete your call records on its own. A deleted record can remain in a backup for up to 7 days.

Audits

• We plan an independent audit of how we handle call data as part of a future release, and we intend to publish the result.

Request headers

• To see which request headers we pass on to the model provider, read What the gateway forwards.

In Inferock Watch, the customer keeps its own provider account and provider bill. Inferock stores the customer provider key in the hosted key vault, uses it to route selected calls, and stores evidence for usage, receipts, and failure analysis. Inferock Watch reporting is visibility on the customer's own provider bill; it is not a promise that OpiusAI will recover or credit every provider-side issue.

In Inferock Serve mode, OpiusAI may operate the provider relationship as part of the service only where separately approved in the applicable order form or plan. Inferock Serve credits, if any, are bounded service credits under those terms.