Skip to content
Inferray
DashboardGet API key

Privacy Policy

Last updated: 5 November 2026

This policy explains what Inferray ("we", "us") does with data when you use our website, console, and API (together, the "Service"). It sits alongside our Terms of Service.

The short version

We do not train on your data, and we do not store your prompts or responses. Your requests pass through to the model provider that serves them and are not written to our storage. What we keep is the metadata we need to bill you and show you your usage — when a request was made, which model and project it used, how many tokens it consumed, how long it took, and what it cost.

We do not sell your personal information, and we do not share your prompts or responses with anyone other than the provider that serves the request.

What we collect

Account data. Your name and email address, and — if you sign in with GitHub or Google — the basic profile details that provider returns. Plus the organizations and projects you belong to, your role in them, and any invitations you send or accept.

Usage metadata. For every API request: the time, the model, the project and API key it was sent with, the request path, the HTTP status, the duration, the token counts reported by the provider, and the resulting cost. Not the prompt, the response, the system prompt, tool definitions, attachments, or any other request or response content — those are never written to our database.

Billing data. Your credit balance, top-up history, and auto top-up settings. Card details go directly to Stripe and are never seen or stored by us; we keep the customer and payment identifiers Stripe gives back, and the amount, currency, and status of each payment.

Session data. A session cookie that keeps you signed in, plus cookies that remember which organization and project you are currently working in. These are required for the console to function.

Optional website analytics. If you accept analytics cookies, Google Analytics measures visits to our public pages, including the pages viewed, the referring website, the campaign tags in the link that brought you to us (such as utm_source or utm_campaign), approximate location, browser, and device information. It does not run on our sign-in, invitation, console, or API pages. We remove every other part of the query string, and fragments, before sending page URLs. If you accepted analytics cookies and then create an account, buy a Token Plan, or add credit for the first time, our server also reports that this happened to Google Analytics, together with the analytics identifiers stored in your browser and the internal identifier of your organization (a random code, not its name), so that we can tell which pages and campaigns bring us customers. So that a purchase can be reported once it has been paid, those analytics identifiers are kept with the payment at Stripe. We do not send names, emails, API keys, prompts, responses, payment amounts, or payment details, and nothing is reported for anything you do while analytics cookies are not accepted. Advertising features and Google signals are disabled. No Google Analytics script is loaded before you accept, and none is loaded in the console. Use Cookie preferences in the public-page footer to accept or reject analytics; rejecting stops collection and removes our analytics cookies. Your choice is remembered for 180 days.

Visit linking. Separately from Google Analytics, we connect the pages you view in a browser tab with your account once you sign up or sign in in that tab. This happens by default for a signed-in account and never for a visitor who has not signed up or signed in: there is no account to link to until then. You can turn it off at any time under Cookie preferences; a refusal is remembered in your browser's local storage for 180 days and always wins over the default. The link itself uses a random identifier that is kept only in that tab's memory, never in a cookie or in storage, and a new one replaces it whenever you sign out, switch account or organization, or open or reload the site. With that identifier our hosting provider's analytics service records the pages you view on our website and the requests from that tab that start a purchase; our server tells it which account and organization the identifier belongs to, and attaches it to your sign-up and to the purchases you start (with their amount). We use this to learn which pages lead people to become customers. Renewals, automatic top-ups, and other charges you did not start in that tab are never linked to a visit. We do not send your name, email, prompts, responses, or payment details for this, and the identifier is never sent to Stripe or to Google. Nothing is linked if your browser sends a Global Privacy Control or Do Not Track signal, or if you have turned it off.

This is separate from the account, billing, and purchase records we keep anyway to run the Service and to report our own sign-ups and sales, which do not depend on this choice. Turning visit linking off stops linking from then on in your browser; it does not delete what was already recorded, which you can ask us to delete (see "Your rights"). Retention: on our side, the identifier is kept with your account for at most two days and with a purchase you started for at most four days, so the purchase can be reported once it is paid. Our analytics provider keeps the linked visits and events for at most 30 days. Its operational request logs follow their own, separate retention.

Support correspondence. Anything you send us by email, for as long as we need it to answer you.

Optional community promotions. If you claim community credit, we use your Discord member, server, channel and introduction-message identifiers to confirm your participation. We do not collect the channel’s conversation history or retain your introduction text. We check your verified account email and completed Stripe credit- or debit-card verification, and retain keyed hashes of the normalized email and Stripe card fingerprint to prevent repeat awards, together with the awarded organization, account, amount and time. Claim codes are stored only as hashes; no card number or security code is stored. Discord receives your interaction and our private claim response, under its own privacy policy.

How we use it

To run the Service: authenticate you, route your requests, enforce your balance and rate limits, and show you your usage and invoices. To bill you, take payment, and keep the tax and accounting records we are required to keep. To keep the Service secure — investigating abuse, fraud, and attacks on the Service itself. To reply when you contact us, and to send service notices such as a failed payment or a material change to our terms. Marketing email, if we ever send any, is opt-in and unsubscribable.

We do not use your data — prompts, responses, or usage metadata — to train, fine-tune, or evaluate any model, ours or anyone else's.

Legal bases

Where data protection law asks us to name a legal basis for using personal data, we rely on: contract, to provide the Service you signed up for, serve your requests, and bill you for them; legitimate interests, to keep the Service and your account secure, prevent fraud and abuse, and improve how the Service works, in ways that do not override your rights; and legal obligation, to keep tax and accounting records and to respond to lawful requests. Where we rely on consent, such as for optional website analytics or marketing email, you can withdraw it at any time. Visit linking is not based on consent: it is part of how we measure and improve the Service for signed-in accounts, which we do on the basis of our legitimate interests, and you can object to it at any time under Cookie preferences.

Model providers

Serving a request means sending it to the provider that runs the model you chose. That provider necessarily receives your prompt and returns the response, and handles it under its own privacy policy and data-retention practices, which we do not control. Choosing a model is choosing its provider. If your data has handling requirements, review the provider's policy before you send it, and treat any provider-side retention as outside our control.

Service providers

Only the service providers we need to operate see your data, and only for that purpose:

We may also disclose data where the law requires it, or where it is necessary to establish or defend a legal claim — and we will resist a request that we believe is overbroad or unlawful. If the Service is ever transferred to another owner, your data may transfer with it, subject to this policy.

How long we keep it

Account, organization, and project records last as long as your account does. Individual request-metadata rows are deleted 90 days after they are made, once the usage on them has been billed. The aggregate usage figures behind your analytics — hourly totals per project, model, and key — are kept longer so your history does not vanish, and they contain no request content. Billing and payment records are kept for as long as tax and accounting law requires, which is longer than the rest, and outlives account deletion for that reason.

Promotion claim codes and interaction challenges expire within 30 minutes; their records, unused card-verification proofs and rate-limit records are removed within seven days after expiry by scheduled cleanup. Award records and the card-verification evidence they reference are retained as promotional accounting and anti-abuse records for the campaign lifetime and any legally required accounting period. Deleting an account or organization does not reset eligibility. We retain the minimum identifiers and keyed hashes needed to prevent repeated awards, with access restricted to authorized operators.

Security

API keys are stored hashed, never in a form we can read back to you or to anyone else. Traffic to and from the Service is encrypted in transit, access to production data is limited to the people who need it, and the fastest way to limit the damage from a leaked key is to rotate it in the console. No system is perfectly secure, and we do not claim otherwise.

Your rights

You can see and correct your account details and your usage in the console, and you can ask us to close your account at any time. Depending on where you live — in particular in the EU, UK, and California — you may also have the right to a copy of your personal data, to have it corrected or deleted, to object to or restrict certain processing, and to complain to your data protection authority. Email us and we will action it; we will not charge you for it or treat you differently for asking.

Deletion has limits: we cannot delete billing records we are legally required to retain, and may retain the minimum pseudonymous promotion identifiers necessary to prevent repeated awards and fraud. We explain any applicable retention when handling your request. Other account information is removed.

International transfers

The Service runs on infrastructure in several countries, and your data may be processed outside the country you are in — including in the United States. Where we transfer personal data out of the EU or UK, we rely on the appropriate safeguards for that transfer, such as the European Commission's Standard Contractual Clauses.

Children

The Service is not for anyone under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, tell us and we will delete it.

Changes

We may update this policy. The date at the top always reflects the current version, and if a change is material we will give notice through the Service or by email before it takes effect.

Contact

Privacy questions, or a request about your data: support@inferray.com.