Data handling

This page states what data is stored, for how long, what is never stored, and how the no-training default and opt-in training work. Read this with the privacy page and data processing addendum.

What is never stored (paid traffic, training off)

Purchased-credit requests with training off are not written to the durable capture corpus or used for training or evaluation. With capture enabled, accounts marked for promotional use or explicit training consent may have eligible prompts and completions stored on the serving host and archived, encrypted, in Cloudflare R2. Prompt prefixes may remain in engine memory after a response until evicted or the process restarts. The gateway namespaces prefix reuse by account and cache_salt, not by individual API key.

This policy covers the chat deployment trial described in the trial documentation.

What is stored and for how long

Billing metadata: Billing records contain request identifiers, account or tenant identifiers, API key prefixes where available (not full keys), model, route, timestamps, outcome, token counts and cost; they do not contain prompt or completion bodies. Kept for up to 12 months because it is the record behind your invoice and is required for tax and accounting.
Operational logs: HTTP status codes, request latency, error classes (e.g., rate_limit_exceeded, context_length_exceeded), calling client IP address.No prompt or completion text. Kept for up to 30 days for debugging, rate limiting, and abuse detection.
Account data: Email address, verified login provider identity (e.g., Google account ID), API key prefixes (not full keys), credit balance and ledger, referral tag from sign-up link, training consent setting, suspension status.Kept while the account exists. Deleted when you delete the account (see Deletion below).
Sign-up abuse detection data: To prevent promotional credit farming, we record: verified login provider identity, normalized email domain, sign-up timing, account and key activity, and a keyed digest (hash) of the sign-up network address.The raw IP address is not stored in the account graph. The digest and email local-part similarity data are deleted after30 days. Case decisions (account suspended for abuse) stay with the account for support and appeals.
Payment data: We never see your payment card. Paddle processes payments and returns a customer reference and the last four digits of your saved payment method, which we store so the console can show what auto top-up will charge. Full card details stay with Paddle only.

No training by default (paid traffic)

Prompts and completions paid from purchased credit are not used to train, fine-tune, distill, or evaluate a model by default. The training switch is off unless you turn it on. When off, your prompts and completions are never written to durable storage and cannot be used for training. In-memory prefix caching is separate from durable capture and can outlive a response.

Opt-in training for a rebate

In the console under Settings → Training on your prompts, you can agree that prompts and completions from your account may be retained and used to improve our models. While that switch is on,5% of your metered spend is credited back to your balance, one whole day at a time, for each day the switch was on from start to finish.

It is off by default, per account, and you can turn it off at any time. From that moment, new capture stops. Data already in a completed training run cannot be withdrawn. We do not sell prompts and do not share them with other customers. Each consent change is timestamped, so the posture that applied to any request is auditable.

Captured training data is subject to a 24-month deletion policy; account closure starts a 30-day purge deadline, whichever comes first. Purging is performed by our deletion process, with overdue closure alerts and a validated deletion receipt; turning consent off stops new capture, not the retention clock for existing data.

Promotional credit (if active)

When a promotional offer is open, new accounts receive free credit. Prompts and completions paid from that promotional credit may be retained and used to improve models and serving quality, as stated on the offer terms. Your first completed purchase ends promotional capture; explicit training consent, if enabled, still applies.

Capture is off unless the serving host is explicitly configured to store training data. The console sets a per-account trial or consent mark. Explicit consent takes precedence; without consent, promotional capture requires an eligible grant, the promotional training setting and no completed purchase. The gateway captures only successfully completed chat/completions requests on eligible customer accounts, rechecking the mark before writing. Captures can include reasoning, tool calls and the forwarded request body, not just visible answer text.

Captured files are available to the operator through serving-host permissions and archive decryption access, not through customer API keys. Cloudflare handles the encrypted archive. Email notifications also pass through the recipient’s mailbox provider.

Deletion on request

Mail support@tiyuvta.ai to delete your account. Deletion removes:

Account record (email, verified identity)
API keys
Unused credit balance (not refundable)

Billing metadata (token counts, model, cost; no content) is retained for 12 months after deletion because tax law requires a record of a sale.

Prompts and completions: For paid traffic with training off (default), there is nothing to delete because they were never written. For opt-in training traffic or promotional traffic, deletion of future retention is immediate (switch off or delete account), but data in a completed training run cannot be withdrawn.

Encryption

Encryption in transit: TLS 1.2 or higher on all public endpoints (api.tiyuvta.ai, tiyuvta.ai). No plaintext HTTP listener exists. Internal service-to-service communication uses Cloudflare Tunnels (encrypted) and private networking.
Encryption at rest: Account and billing data lives in Cloudflare D1, which Cloudflare states is encrypted at rest. API keys and session tokens are stored as SHA-256 hashes, never in plaintext: the console looks a key up by its hash. Billing metadata and operational logs on the compute host hold no prompt content and are kept there for 30 days; the billing ledger itself is kept for 12 months, as stated above.

Data location

Trial requests: Processed in Europe (Finland). Request content passes through process and accelerator memory, including prefix-cache state; the durable capture rules above apply.
Account and billing database: Cloudflare D1; this policy does not promise EU-only storage.
Edge routing: Cloudflare global edge network; request routing metadata transits the edge but account data stays in D1.

Bit-for-bit identity not guaranteed

Bit-for-bit output identity across requests, restarts, or engine updates is not guaranteed.

Multi-tenancy isolation

Per-tenant isolation across accounts:

API keys: Each key is scoped to one account. A key cannot reach another account's data.
Credit balances: Per-account ledger. One account's balance is never visible to or debited by another account.
Cache namespaces: Prompt cache is per-account and per cache_salt. One account's cached prefixes are never served to another account, in either direction.
Billing records: Per-account. One account cannot see another account's usage or billing history.

International transfers

Data controller is in Israel (sole proprietorship). GLM-5.3-Flash was served from Nebius UK (uk-south2) from 2026-09-13 to 2026-09-19; Nebius holds no customer content now; Verda Oy (Finland, FIN-01) is the only GPU-inference sub-processor (DeepSeek-V4.1-Flash). Cloudflare operates global infrastructure; this policy does not promise EU-only D1 or R2 storage. Paddle (payments) is UK/EU entity.

GDPR compliance: For EU customers, we rely on Standard Contractual Clauses (SCCs) for transfers to processors outside the EEA where no adequacy decision exists. Israel does not have an adequacy decision for GDPR. See the DPA for processor terms.

Israel Privacy Protection Law: The entity is subject to Israel Privacy Protection Law 1981 and Amendment 13 (processor obligations).

Changes

Changes that widen what we do with your data are emailed to you at least 30 days before they take effect. The date at the top moves with every change. Continued use after notice constitutes acceptance.