> ## Documentation Index
> Fetch the complete documentation index at: https://docs.farmgpu.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Privacy Policy

> How FarmGPU handles data on its LLM inference API

# FarmGPU Inference API Privacy Policy

**Effective date:** August 29, 2026

This policy describes how FarmGPU, Inc. ("FarmGPU", "we", "us") handles data
sent to and generated by the **FarmGPU Inference API** — our OpenAI-compatible
API for serving large language models, including endpoints made available
through routing partners such as OpenRouter. It supplements, and does not
replace, any Master Service Agreement or partner agreement in place with your
organization.

<Note>
  For how long each category of data is kept, see the
  [Data Retention Policy](/company-docs/legal/data-retention-policy).
</Note>

***

## The short version

* **We do not store your prompts or completions.** Request and response
  content is processed in memory to generate your response and is not written
  to persistent storage.
* **We do not train on your data.** Content sent to the API is never used to
  train, fine-tune, or evaluate models, and is never used for any purpose
  other than serving your request.
* **We do not sell or share your data.** We are an inference provider, not a
  data business.
* What we do keep is **operational telemetry** — token counts, latency,
  error rates, and similar service metadata — used solely to run a reliable
  service.

***

## Data we process

### Request and response content

Prompts, messages, tool definitions, and model completions ("Content") are
processed in GPU and host memory for the duration of the request. Content is
not persisted to disk, not logged, not used for training or evaluation, and
not shared with any third party.

The serving engine maintains a transient **prefix cache** in GPU memory to
speed up repeated request prefixes. This cache exists only in volatile memory,
is evicted continuously under normal operation, and is destroyed entirely
whenever the serving process restarts.

### Service metadata

To operate, secure, and bill for the service, we collect metadata about API
requests, which does not include Content:

* Timestamps, HTTP status codes, and request latency
* Model identifier, prompt/completion **token counts**, and cache-hit counts
* Concurrency, queue depth, and hardware utilization metrics
* API key identifier used to authenticate the request
* Network-level connection metadata at our edge (see Subprocessors below)

### Diagnostic traces and logs

Our reliability tooling (metrics, distributed traces, and application logs)
records the request lifecycle — timing, sizes, and outcomes — for debugging
and capacity planning. These systems are configured to capture service
metadata, not Content, and are retained on the short schedules described in
the [Data Retention Policy](/company-docs/legal/data-retention-policy).

<Info>
  We do not currently advertise a formal **Zero Data Retention (ZDR)**
  designation. We will publish one only after our independent validation that
  no diagnostic system can capture request content is complete.
</Info>

***

## What we never do with API data

* Train, fine-tune, or benchmark models on Content
* Sell data, or share it with advertisers or data brokers
* Use Content for product analytics or human review, except where strictly
  required to investigate abuse or a security incident, and then only with
  access limited to authorized personnel
* Retain Content after a request completes, beyond the volatile in-memory
  caches described above

***

## End users reaching us through a routing partner

When you use FarmGPU through a router or aggregator (for example, OpenRouter),
your account, identity, and billing relationship is with that partner. FarmGPU
receives the request payload and partner-level authentication only — we do not
receive your name, email address, account identity, or payment details, and we
cannot associate requests with individual end users. The partner's own privacy
policy governs the data they hold about you.

## Direct API customers

For customers with a direct agreement, we hold the business contact and
billing information needed to administer the account (names, email addresses,
company details, and usage records for invoicing). This information is used
only for account administration and is retained as described in the
[Data Retention Policy](/company-docs/legal/data-retention-policy).

***

## Subprocessors

| Subprocessor     | Role                                                             | Data exposed                                                                                                                                                                              |
| ---------------- | ---------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Cloudflare, Inc. | TLS termination, DNS, and network perimeter for the API endpoint | Encrypted request traffic in transit; connection metadata (IP addresses, request URLs, timing). Cloudflare does not persist request bodies for us; caching is disabled for API responses. |

Inference itself runs on **FarmGPU-owned hardware in FarmGPU-operated
facilities in California, USA**. No model-serving or Content processing is
outsourced to any third-party cloud.

***

## Security

API access requires bearer-token authentication; unauthenticated requests are
rejected. Serving infrastructure is operated under the controls described in
our [Security documentation](/company-docs/security/compliance-standards),
including our SOC 2 Type II program. Access to production systems is limited
to authorized FarmGPU operations personnel.

***

## Legal disclosures

We disclose data only if required by valid legal process, and only the minimum
required. Because Content is not stored, historical prompts and completions
cannot be produced — only the service metadata described above exists to be
disclosed.

## Your rights and contact

Depending on your jurisdiction (including the California Consumer Privacy Act
and the EU/UK GDPR where applicable), you may have rights to access, correct,
or delete personal information we hold about you. Because we hold no end-user
identity for API traffic, such requests typically apply to direct-customer
account information.

Questions, requests, or concerns: **[privacy@farmgpu.com](mailto:privacy@farmgpu.com)**.

## Changes to this policy

We will post updates to this page with a revised effective date. Material
changes affecting partner integrations will be communicated to partners
directly.