Data handling

This page states what data is stored, for how long, what is never stored, and how the no-training default and opt-in training work. Read this with the privacy page anddata processing addendum.

What is never stored (paid traffic, training off)

When a request is paid for out of purchased credit with the training switch off (the default), prompts and completions are processed in memory to answer the request and are never written to durable storageby the inference stack. They exist in GPU memory for the duration of the inference request (typically milliseconds to seconds), then are deleted when the response completes.

There is no sampling queue, no human review, no debug exception. This applies to /v1/chat/completions, /v1/completions,/v1/messages, /v1/responses,/v1/embeddings, and /v1/rerank.

What is stored and for how long

Billing metadata

Token counts (prompt, cached, completion), model name, timestamps, API key prefix (not the full key), computed cost in USD.No prompt or completion text.Kept for up to 12 months because it is the record behind your invoice and is required for tax and accounting.

Operational logs

HTTP status codes, request latency, error classes (e.g.,rate_limit_exceeded, context_length_exceeded), calling client IP address.No prompt or completion text.Kept for up to 30 days for debugging, rate limiting, and abuse detection.

Account data

Email address, verified login provider identity (e.g., Google account ID), API key prefixes (not full keys), credit balance and ledger, referral tag from sign-up link, training consent setting, suspension status.Kept while the account exists. Deleted when you delete the account (see Deletion below).

Sign-up abuse detection data

To prevent promotional credit farming, we record: verified login provider identity, normalized email domain, sign-up timing, account and key activity, and a keyed digest (hash) of the sign-up network address.The raw IP address is not stored in the account graph. The digest and email local-part similarity data are deleted after30 days. Case decisions (account suspended for abuse) stay with the account for support and appeals.

Payment data

We never see your payment card. Paddle processes payments and returns a customer reference and the last four digits of your saved payment method, which we store so the console can show what auto top-up will charge. Full card details stay with Paddle only.

No training by default (paid traffic)

Prompts and completions paid from purchased credit are not used to train, fine-tune, distill, or evaluate a model by default. The training switch is off unless you turn it on. When off, your prompts and completions are never written to durable storage and cannot be used for training because they do not exist after the request completes.

Opt-in training for a rebate

In the console under Settings → Training on your prompts, you can agree that prompts and completions from your account may be retained and used to improve our models. While that switch is on,5% of your metered spend is credited back to your balance, one whole day at a time, for each day the switch was on from start to finish.

It is off by default, per account, and you can turn it off at any time. From that moment, nothing further is retained. Data already in a completed training run cannot be withdrawn. We do not sell prompts and do not share them with other customers. Each consent change is timestamped, so the posture that applied to any request is auditable.

Training data retention: Retained prompts and completions are deleted 24 months after we receive them. If you close your account they are purged within 30 days, whichever comes first. Every closure starts a 30-day clock in the console, which alerts us while it is open, and the clock closes only on a validated deletion receipt. Ask and we will send that receipt: what was deleted, where, and when.

Promotional credit (if active)

When a promotional offer is open, new accounts receive free credit. Prompts and completions paid from that promotional credit may be retained and used to improve models and serving quality, as stated on theoffer terms. Buying credit moves you to the purchased-credit rule (no training by default) from your first paid request.

Deletion on request

Mail support@tiyuvta.ai to delete your account. Deletion removes:

• Account record (email, verified identity)
• API keys
• Unused credit balance (not refundable)

Billing metadata (token counts, model, cost; no content) is retained for 12 months after deletion because tax law requires a record of a sale.

Prompts and completions: For paid traffic with training off (default), there is nothing to delete because they were never written. For opt-in training traffic or promotional traffic, deletion of future retention is immediate (switch off or delete account), but data in a completed training run cannot be withdrawn.

Encryption

Encryption in transit

TLS 1.2 or higher on all public endpoints (api.tiyuvta.ai,inference.tiyuvta.ai). No plaintext HTTP listener exists. Internal service-to-service communication uses Cloudflare Tunnels (encrypted) and private networking.

Encryption at rest

Account and billing data lives in Cloudflare D1, which Cloudflare states is encrypted at rest. API keys and session tokens are stored as SHA-256 hashes, never in plaintext: the console looks a key up by its hash. Billing metadata and operational logs on the inference host hold no prompt content and are kept for 30 days.

Data location

• Inference requests: Processed in Europe (London, United Kingdom). Prompts and completions exist in GPU memory only, never written to disk for paid traffic with training off.
• Account and billing database: Cloudflare D1, in the EU where the platform allows region selection.
• Edge routing: Cloudflare global edge network; request routing metadata transits the edge but account data stays in D1.

Bit-for-bit identity not guaranteed

Embedding and reranking endpoints run no sampling, but bit-for-bit identity across requests, restarts, or engine updates is not guaranteed. Parity gates verify cosine similarity ≥ 0.998 and rank order parity for embeddings, and score + order parity for reranking.

Multi-tenancy isolation

Per-tenant isolation across accounts:

• API keys: Each key is scoped to one account. A key cannot reach another account's data.
• Credit balances: Per-account ledger. One account's balance is never visible to or debited by another account.
• Cache namespaces: Prompt cache is per-account and percache_salt. One account's cached prefixes are never served to another account, in either direction.
• Billing records: Per-account. One account cannot see another account's usage or billing history.

International transfers

Data controller is in Israel (sole proprietorship). Inference runs in UK (Nebius). Cloudflare operates a global edge; D1 and R2 are in the EU where available. Paddle (payments) is UK/EU entity.

GDPR compliance: For EU customers, we rely on Standard Contractual Clauses (SCCs) for transfers to processors outside the EEA where no adequacy decision exists. Israel does not have an adequacy decision for GDPR. See the DPA for processor terms.

Israel Privacy Protection Law: The entity is subject to Israel Privacy Protection Law 1981 and Amendment 13 (processor obligations).

Changes

Changes that widen what we do with your data are emailed to you at least 30 days before they take effect. The date at the top moves with every change. Continued use after notice constitutes acceptance.