Last updated: October 5, 2026
1. Who this policy is about
This policy explains what personal data Inferbase ("Inferbase", "we") collects through inferbase.ai, the API at api.inferbase.ai and the dashboard (the "Service"), why, who receives it, how long we keep it, and your rights.
It covers two different roles we play:
- Controller. For your account, your organization's membership and billing details, website visits, and things you send us directly (support, contact forms, job applications), we decide how the data is used.
- Processor. For the content your applications send through the API (prompts, files, outputs, tool calls), we process it on behalf of the organization whose key sent it. That organization is the controller and decides what to send. If you are an end user of an application built on Inferbase, contact that application's operator first. Organizations that need processor terms can sign our Data Processing Addendum.
2. What we collect
2.1 Account and organization data. Email address, name, and optionally company and role; password (stored only as a hash) or your Google account identifier if you sign in with Google; authenticator settings if you enable two-factor authentication; your organizations, projects, roles and invitations; notification preferences.
2.2 Signup security data. When an account is created we record the request's IP address, its network range, browser identifier and sign-up method. We send the IP address to a fraud-prevention service (ipapi.is) to learn whether it belongs to a hosting provider, proxy, VPN or Tor exit and which network operator holds it. We use this only to detect automated or fraudulent signups, and keep it with the account. Sign-up and login forms are protected by Cloudflare Turnstile.
2.3 API usage and routing records (no request content). For each request: time, project and key, the model and provider that served it, tokens or other units, cost, latency, status, the routing decision (task category, eligible models, the pick and why), guardrail verdicts, request tags you send, and session identifiers. These drive billing, your Usage and Logs pages, rate and spend limits, and abuse prevention.
2.4 Request content. By default we store the content of each request (the prompt and, for non-streaming requests, the response) for 30 days, so you can inspect it in your logs and we can verify and debug routing. This is controlled by you:
- turn it off for yourself (zero data retention in account settings);
- an organization admin can turn it off for the whole organization;
- turn it off for any single API key when you create or edit it;
- delete stored content at any time from account settings.
With storage off, no prompt or response content is written; the records in 2.3 are still kept.
2.5 Content you choose to save. Playground conversations you save (kept until you delete them), and prompts you upload to Routing Preview for analysis (kept 30 days). Zero data retention also disables both.
2.6 Credentials you connect. Provider API keys, cloud account credentials or role identifiers, and MCP server tokens. These are encrypted at rest and used only to serve your requests, list and check the models they reach, and show you their status. Connected cloud accounts that use an IAM role (AWS) or workload identity (Google Cloud) give us no long-lived secret at all.
2.7 Audit records. Security-relevant actions on your account (sign-ins, password, profile, key and security changes) and on your organization (membership, policy, key and credential changes) are recorded in audit logs that account owners and organization admins can view.
2.8 Website and device data. Pages visited, referrer, browser and device type, approximate location from IP, and interaction data, collected through the analytics tools listed in our Cookie Policy unless you turn them off there. Errors in the website and API are reported to our error-tracking service with technical context.
2.9 Things you send us directly. Support and contact messages, demo requests, newsletter sign-ups, and job applications (name, email, LinkedIn profile, answers and CV).
2.10 Payment data. When paid plans open, payments are handled by the payment provider named at checkout. We receive the plan, amounts, status and a customer reference, never your full card details.
3. How we use it
- To provide the Service: authenticate you, route and serve requests, apply your policies and limits, bill usage, and show you your usage, logs and receipts.
- To secure the Service: prevent fraud, abuse and automated signups, enforce rate limits, and investigate incidents.
- To measure and improve routing. Stored request content (2.4) may be used to check whether requests were classified correctly. Once a day, for stored requests (up to a daily cap), the latest user message is sent to one of our model providers (currently DeepInfra) to obtain an independent task label, which we compare with our classifier's label. Only the label is kept beyond the 30-day window. Content not stored under 2.4 is never used this way.
- To communicate with you: service and security notices, billing notices, and, if you opted in, product updates you can unsubscribe from at any time.
- To meet legal obligations and to establish or defend legal claims.
We do not sell personal data. We do not use your content to train AI models, and we do not authorize the providers that serve our managed accounts to use it for training.
Legal bases (EEA/UK). Performance of our contract with you (2.1, 2.3, 2.6, 2.10); legitimate interests in securing the Service, improving routing and understanding how the website is used (2.2, 2.4 as used in section 3, 2.7, 2.8); consent where we ask for it (newsletter); legal obligation (tax and accounting records).
4. Who receives it
4.1 Model providers. When a request is served on managed inference, its content goes to the provider serving the chosen model, which processes it under its own terms. When it is served on your key or cloud account, it goes to that provider or cloud under your account and your agreement with them.
4.2 Endpoints you configure. MCP servers, webhooks and custom endpoints you register receive what you configure them to receive.
4.3 Service providers. Hosting, database, email, error tracking, analytics, bot protection, fraud prevention and payments, each limited to its function. The current list, with purpose and location, is at inferbase.ai/subprocessors.
4.4 Your organization. Organization owners and admins can see the organization's usage, logs, audit log and members.
4.5 Legal and business transfers. Where the law requires it, to protect rights and safety, or to a successor in a merger or sale of the business, which remains bound by this policy until you are notified otherwise.
5. International transfers
We host the Service in the United States (US West). Providers and service providers may process data in other countries, including the United States. Where the law requires it, we rely on appropriate safeguards such as standard contractual clauses.
6. How long we keep it
| Data | Kept for |
|---|---|
| Request content (2.4) | 30 days from capture, or less if you delete it or turn storage off |
| Routing Preview uploads | 30 days |
| Saved playground conversations | until you delete them |
| Usage and routing records (2.3) | up to 365 days |
| Account, organization and credentials | while the account exists |
| Audit logs (2.7) | while the account or organization exists |
| Billing and tax records | as long as the law requires |
| Notification delivery records | 365 days |
| Contact and demo enquiries | 2 years |
| Job applications | 12 months from the application |
| Backups | encrypted; overwritten or expired within 90 days |
When you delete your account, it is deleted at once with the data tied to it, except billing records the law requires us to keep and entries in audit logs, where your identity is removed. Copies in backups expire on the backup schedule above.
7. Security
Data is encrypted in transit (TLS). Connected credentials, authenticator secrets and MCP tokens are encrypted at rest; passwords are hashed. Staff access to production requires two-factor authentication, and any change our staff make to a customer's account requires a time-limited, recorded elevation. Access to your organization's data inside the Service follows the roles you assign. No system is perfectly secure; tell us at legal@inferbase.ai if you find a problem.
8. Your rights
Depending on where you live (including under the GDPR, the UK GDPR and India's Digital Personal Data Protection Act, 2023), you may have the right to access, correct, delete or port your personal data, to object to or restrict processing, to withdraw consent, and to nominate someone to exercise your rights. Much of this is self-serve: export your data from account settings, edit your profile, delete request content, or delete your account. For anything else, email privacy@inferbase.ai. We answer within 30 days. You may also complain to your data protection authority.
Grievance Officer (India). Grievance Officer, Inferbase, privacy@inferbase.ai.
9. Children
The Service is not directed to children under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.
10. Changes
We will post changes here with the new date, and notify account owners of material changes by email or in the dashboard before they take effect.
11. Contact
privacy@inferbase.ai. Inferbase, Bengaluru, India.