Skip to main content

​
FarmGPU Inference API Privacy Policy

Effective date: August 29, 2026 This policy describes how FarmGPU, Inc. (“FarmGPU”, “we”, “us”) handles data sent to and generated by the FarmGPU Inference API — our OpenAI-compatible API for serving large language models, including endpoints made available through routing partners such as OpenRouter. It supplements, and does not replace, any Master Service Agreement or partner agreement in place with your organization.
For how long each category of data is kept, see the Data Retention Policy.

​
The short version

  • We do not store your prompts or completions. Request and response content is processed in memory to generate your response and is not written to persistent storage.
  • We do not train on your data. Content sent to the API is never used to train, fine-tune, or evaluate models, and is never used for any purpose other than serving your request.
  • We do not sell or share your data. We are an inference provider, not a data business.
  • What we do keep is operational telemetry — token counts, latency, error rates, and similar service metadata — used solely to run a reliable service.

​
Data we process

​
Request and response content

Prompts, messages, tool definitions, and model completions (“Content”) are processed in GPU and host memory for the duration of the request. Content is not persisted to disk, not logged, not used for training or evaluation, and not shared with any third party. The serving engine maintains a transient prefix cache in GPU memory to speed up repeated request prefixes. This cache exists only in volatile memory, is evicted continuously under normal operation, and is destroyed entirely whenever the serving process restarts.

​
Service metadata

To operate, secure, and bill for the service, we collect metadata about API requests, which does not include Content:
  • Timestamps, HTTP status codes, and request latency
  • Model identifier, prompt/completion token counts, and cache-hit counts
  • Concurrency, queue depth, and hardware utilization metrics
  • API key identifier used to authenticate the request
  • Network-level connection metadata at our edge (see Subprocessors below)

​
Diagnostic traces and logs

Our reliability tooling (metrics, distributed traces, and application logs) records the request lifecycle — timing, sizes, and outcomes — for debugging and capacity planning. These systems are configured to capture service metadata, not Content, and are retained on the short schedules described in the Data Retention Policy.
We do not currently advertise a formal Zero Data Retention (ZDR) designation. We will publish one only after our independent validation that no diagnostic system can capture request content is complete.

​
What we never do with API data

  • Train, fine-tune, or benchmark models on Content
  • Sell data, or share it with advertisers or data brokers
  • Use Content for product analytics or human review, except where strictly required to investigate abuse or a security incident, and then only with access limited to authorized personnel
  • Retain Content after a request completes, beyond the volatile in-memory caches described above

​
End users reaching us through a routing partner

When you use FarmGPU through a router or aggregator (for example, OpenRouter), your account, identity, and billing relationship is with that partner. FarmGPU receives the request payload and partner-level authentication only — we do not receive your name, email address, account identity, or payment details, and we cannot associate requests with individual end users. The partner’s own privacy policy governs the data they hold about you.

​
Direct API customers

For customers with a direct agreement, we hold the business contact and billing information needed to administer the account (names, email addresses, company details, and usage records for invoicing). This information is used only for account administration and is retained as described in the Data Retention Policy.

​
Subprocessors

Inference itself runs on FarmGPU-owned hardware in FarmGPU-operated facilities in California, USA. No model-serving or Content processing is outsourced to any third-party cloud.

​
Security

API access requires bearer-token authentication; unauthenticated requests are rejected. Serving infrastructure is operated under the controls described in our Security documentation, including our SOC 2 Type II program. Access to production systems is limited to authorized FarmGPU operations personnel.
We disclose data only if required by valid legal process, and only the minimum required. Because Content is not stored, historical prompts and completions cannot be produced — only the service metadata described above exists to be disclosed.

​
Your rights and contact

Depending on your jurisdiction (including the California Consumer Privacy Act and the EU/UK GDPR where applicable), you may have rights to access, correct, or delete personal information we hold about you. Because we hold no end-user identity for API traffic, such requests typically apply to direct-customer account information. Questions, requests, or concerns: privacy@farmgpu.com.

​
Changes to this policy

We will post updates to this page with a revised effective date. Material changes affecting partner integrations will be communicated to partners directly.