This policy explains what personal data Cynic Hosting LLC, a company in the United States ("Cynic", "we", "us"), handles when you use the Cynic Inference API at https://api.cynic-hosting.com/v1 or hold an account for it (the "Service"), why, for how long, and the choices you have. Our other hosting services and the rest of cynic-hosting.com are covered by our main privacy policy.
The short version: we never store the prompts you send or the completions you receive. We keep a small record of each request (no content) for billing, capacity and abuse handling, and delete it after 90 days. We do not sell personal data or use it for advertising.
1. Prompts and completions
The content of your requests and responses is processed only in memory, for as long as it takes to answer the request, and is then discarded. It is not written to logs, databases or disks, not used to train or improve any model, and not shared with anyone except the subprocessors that carry or compute it (section 4). The Data Policy describes this in detail, including the short-lived prefix cache in GPU memory.
If your prompts contain personal data about you or others, you are the one deciding to send it, and you are responsible for having a lawful basis to do so. Because we do not store content, we cannot retrieve, correct or delete it later; there is nothing kept to act on.
2. What we collect
Account and billing details
When you open an account: your name, email address, company name if you give one, and billing details (billing contact, address for invoices, tax details where required). Card payments, if offered, are handled by a payment processor; we do not see or store full card numbers.
API keys
We store only a one-way hash of each key, never the key itself.
Request metadata
For every request: the time, the model, input, cached input and output token counts, latency, the HTTP status, and which API key made it. No prompt or completion content.
Connection data
To deliver the Service and protect it from abuse, our gateway processes the IP address and technical headers of each connection. Our gateway uses them in memory for rate limiting and abuse prevention and does not add them to the request records above.
Messages you send us
If you email us, we keep the conversation to answer you and for our records.
If you use the Service through a third-party marketplace or router, the marketplace holds your account and billing details and its privacy policy covers them. We receive your requests from the marketplace and keep the same request metadata, tied to the marketplace's key rather than to you.
3. Why we use it
- To provide the Service: authenticate keys, route requests and return responses (performance of our contract with you).
- To bill you: count tokens and issue invoices (contract; legal obligations for accounting records).
- To run and plan capacity: see load, latency and errors per model (our legitimate interest in a working service).
- To prevent abuse and keep the Service secure: rate limits, detecting compromised keys and misuse (legitimate interest; legal obligations).
- To talk to you: service notices, price or model changes, and replies to your messages (contract; legitimate interest).
We do not use personal data for advertising, we do not sell or rent it, and we do not "share" it for cross-context behavioral advertising.
4. Who else handles it
We use the subprocessors listed in the Data Policy: a cloud GPU provider that runs the models. We may also disclose data when the law requires it (we will push back on requests that are not valid, and can only hand over what we keep), to protect the rights and safety of our users or others, or to a successor if the business is sold or merged, under this policy.
5. How long we keep it
| Data | Kept for |
|---|---|
| Prompts and completions | Not stored. In memory only while a request is answered. |
| Request metadata | 90 days, then deleted. |
| Billing records (usage totals per key per day, invoices, payments) | As long as tax and accounting law requires, generally up to 7 years. |
| Account details and key hashes | While your account is open, then deleted within 30 days of closing, except what billing records must keep. |
| Emails with us | Up to 2 years after the conversation ends. |
6. Security
Traffic to the Service is encrypted with TLS. Keys are stored only as hashes, access to our systems is limited to the people who run them, and the measures in the Data Policy apply. No system is perfectly secure; if a breach affects your personal data, we will tell you without undue delay and as the law requires.
7. Where data is processed
Cynic is based in the United States, and account data and request metadata are kept on servers in the United States. Your requests are processed on the GPU servers of our cloud GPU provider; where that happens outside your country, including for visitors from the European Economic Area, the United Kingdom or Switzerland, we rely on the provider's data processing terms and, where needed, standard contractual clauses.
8. Your rights
Depending on where you live (for example under the GDPR, the UK GDPR or US state laws such as California's CCPA), you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict some processing, and to complain to a data protection authority. We give these rights to every customer, wherever they live. Email [email protected] from the address on your account; we will answer within 30 days and will not treat you differently for asking. We may need to keep some data to meet legal obligations, such as billing records.
9. Children
The Service is for businesses and adults. It is not directed to children under 16 and we do not knowingly collect their personal data; if we learn we have, we delete it.
10. Changes
We will post any change here and update the date at the top. For a material change we will give account holders at least 14 days' notice by email before it takes effect.
11. Contact
Cynic Hosting LLC, United States. Email [email protected] for privacy questions and requests.