This policy applies to every request to the Cynic Inference API at https://api.cynic-hosting.com/v1, whether you call it directly or through a marketplace or router. It is part of our Terms of Service and sits alongside our Privacy Policy. The Service is run by Cynic Hosting LLC, a company in the United States.
1. Zero data retention
- We do not log or store prompts or completions. Request and response content, including system prompts, messages, tool definitions and tool calls, and the generated output, exists only in memory while the request is answered and is then discarded.
- Content is never written to application logs, error logs, databases, disks or backups, including when a request fails.
- We do not review the content of requests, by people or by automated tools, and we keep nothing that would let us do so later.
- This applies to every request and every account. There is no setting that turns retention on.
2. No training
We never use your prompts, completions or metadata to train, fine-tune, evaluate or otherwise improve any model, ours or anyone else's. The models we serve are published open-weight models that we run as released; your requests do not change them.
3. The prefix cache
To make repeated input fast and cheaper, the model server keeps the processed form of recent input (the key-value cache) in GPU memory, so a request that starts with the same tokens as a recent one, such as a shared system prompt or the earlier turns of a conversation, can reuse it. Those tokens are billed at the cached input price. The cache holds the model's internal representation of those tokens, not your text, and lives only in GPU memory: it is overwritten continuously as new requests arrive and is lost whenever the server restarts. It is never written to disk and never used for anything but answering requests.
4. What we keep
For each request we record metadata, never content:
| Field | Why |
|---|---|
| Time of the request | Billing, capacity planning, abuse handling |
| Model | Billing, capacity planning |
| Input, cached input and output token counts | Billing |
| Latency (time to first token, total time) | Capacity planning, keeping the Service fast |
| HTTP status | Reliability, abuse handling |
| API key identifier (not the key) | Billing, rate limits, abuse handling |
We also keep account details and billing records, described in the Privacy Policy.
5. How long we keep it
- Request metadata: 90 days, then deleted.
- Billing records: usage totals per key per day, invoices and payments are kept only as long as tax and accounting law requires, generally up to 7 years.
- Prompts and completions: not kept at all.
6. Subprocessors
One company processes your requests for us. It is bound by its own data processing terms and may not use your content for its own purposes.
| Company | What it does | What it handles |
|---|---|---|
| RunPod | GPU compute: the dedicated NVIDIA GPU servers, in its secure cloud, that run the models. | Request and response content in memory while each request is answered. As the operator of the hardware it has physical and administrative access to those machines. Traffic between our gateway and those servers passes encrypted through its HTTPS proxy. |
Our API gateway, which checks keys, counts tokens and keeps the metadata above, runs on a server we own. We will update this list before adding a subprocessor that handles request content, and give account holders at least 14 days' notice by email.
7. Security
- Every connection to the API uses TLS. Traffic between our gateway and the GPU servers is encrypted in transit.
- API keys are stored only as one-way hashes; a lost key cannot be recovered, only revoked and replaced.
- The GPU servers run only the model server and the software it needs, and answer only requests that carry a per-server key that only our gateway holds.
- Access to our systems is limited to the people who run them, with individual keys.
- If we learn of a breach that affects your data, we will tell you without undue delay.
8. Abuse handling and legal requests
Because we keep no content, abuse handling relies on metadata (such as unusual volumes per key) and on reports to [email protected]. If we receive a valid legal demand, we can only provide what we keep: account details, billing records and request metadata. We will tell the affected customer unless the law forbids it.
9. Deletion and access requests
Email [email protected] from the address on your account to get a copy of, or delete, your account details and request metadata. We answer within 30 days. Deleting an account revokes its keys and deletes its request metadata; billing records the law requires us to keep stay until their retention period ends. There is no content to delete, because none is kept.
10. Changes and contact
We will post any change to this policy here and update the date at the top. We will not weaken sections 1 to 3 for requests already made, and for any change that weakens them we will give account holders at least 30 days' notice by email first. Questions: [email protected].