Draft pending counsel review. This document is published for review and is not yet in force. Remove this notice when counsel has signed off.
Privacy Policy
The short version: we do not store your prompts or the models' responses, we never use them to train anything, and we keep the metadata we need to bill you and keep the service up. The rest of this page is the detail.
1. Who is responsible
Computation Frontier Labs Pte. Ltd., a company incorporated in Singapore, is the controller for the personal data described in this policy. Reach us at privacy@cflabs.ai.
When you send us content through the API, we act as a processor for the personal data inside that content: you decide what to send and why, and we process it on your instructions. Our data processing agreement governs that relationship and is available on request.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Email address, hashed password, organisation name, role, verification status | You |
| Billing data | Billing name and address, tax identifiers, invoice records, payment method type and last four digits, transaction references | You, our payment processor |
| Usage metadata | Request id, timestamp, model, endpoint, input/output/cached token counts, latency, status code, cost, key identifier, selected route | Generated by the service |
| Technical data | IP address, user agent, API key prefix, registration IP | Your client |
| Support data | Messages you send us and what we reply | You |
| Security events | Sign-in attempts, administrative actions, key creation and revocation, rate-limit and abuse signals | Generated by the service |
We do not ask for and do not want special categories of personal data in your account or billing information.
3. Prompts and outputs
By default we do not store the content of your requests or the models' responses. They are processed in memory to produce a response and to count tokens, and are not written to a durable store by us.
Three exceptions, each narrow:
- Debug capture. Off by default. You may turn it on for a specific API key when you need to investigate a problem. Captured content is retained for 7 days and then deleted. Your organisation can see it; our support staff can see it only after you raise a ticket and we grant a time-boxed, logged authorisation.
- Transient buffering. Content may sit briefly in memory or in an in-flight buffer while a streaming response is relayed. This is not retention and is not written to disk by us.
- Legal obligation or abuse investigation. Where the law requires it, or where we must investigate a specific, serious abuse of the service, we may retain the minimum necessary content for as long as necessary, and we will tell you unless we are prohibited from doing so.
Where you choose a route labelled as a vendor API, a cloud provider or a licensed third party, your request is sent to that provider and their retention and training practices apply to it. We publish the source label for every model so you can choose, and we do not route a request to a provider other than the one your selected model names.
Credentials — the Authorization header, your API keys, upstream credentials and cookies — are filtered out at the entry point and discarded. They are not written to logs or metadata.
4. Why we process it, and on what basis
| Purpose | Data | Basis (GDPR, where it applies) |
|---|---|---|
| Provide the service, route and meter requests | Account, usage metadata, technical | Performance of a contract |
| Bill you, collect payment, issue invoices | Billing, usage metadata | Performance of a contract; legal obligation |
| Keep the service secure and prevent abuse | Technical, security events | Legitimate interests |
| Support you | Support, account, usage metadata | Performance of a contract |
| Improve reliability and capacity planning | Aggregated usage metadata | Legitimate interests |
| Meet legal and tax obligations | Billing, account | Legal obligation |
| Product announcements and service notices | Account | Legitimate interests; consent for marketing |
5. We do not train on your data
We do not use your prompts, your outputs or your usage content to train, fine-tune or evaluate any model — ours or anyone else's. There is no setting that changes this, and we do not offer a discount in exchange for it.
For self-hosted models, the weights we serve come from their publishers and are not modified with your data. For third-party routes, the provider's own policy applies; we publish the source label so you can avoid a provider whose policy you do not accept.
6. Who we share it with
We do not sell personal data. We share it with service providers who help us run the service, each under a contract limiting them to our instructions:
| Sub-processor | Purpose | Data |
|---|---|---|
| Payment processor | Card and wallet payments, invoicing, tax calculation | Billing data |
| Cloud infrastructure providers | Hosting the API, console and databases | Account, usage metadata, technical |
| Email delivery provider | Verification, security and billing notices | Email address |
| Bot-protection provider | Protecting sign-up and sign-in | Technical |
| Error and performance monitoring | Diagnosing faults | Technical, usage metadata |
| Model providers (for third-party routes only) | Producing the response for the model you selected | The content of that request |
The current named list, with each provider's location, is available at privacy@cflabs.ai and in our data processing agreement. Customers on that list's notification feed receive at least 30 days' notice before we add a sub-processor, and may object.
We may also disclose data to comply with a binding legal request, to enforce our terms, or in connection with a merger or acquisition — in which case we will tell you before your data becomes subject to a different policy.
7. Where it is processed
Account and billing records are processed in Singapore. Inference runs in the region you select or that your contract specifies — North America, Southeast Asia or East Asia. Some sub-processors operate in other countries.
For transfers out of the EEA, the UK or Switzerland we rely on an adequacy decision where one applies, and otherwise on the European Commission's Standard Contractual Clauses with the UK Addendum or Swiss equivalent, together with technical measures. A copy of the clauses we use is available on request.
8. How long we keep it
| Data | Retention |
|---|---|
| Prompts and outputs | Not stored |
| Debug capture (opt-in) | 7 days |
| Usage and billing metadata | 13 months, then aggregated |
| Invoices and accounting records | As required by Singapore law |
| Security audit events | 12 months |
| Account data | While the account is open, then 90 days |
| Support correspondence | 24 months |
When you ask us to delete data, we complete the deletion across datastores and backups within 30 days, except where we must keep a record to meet a legal or accounting obligation.
9. Security
Encryption in transit and at rest; credentials filtered at the entry point; API keys stored only as hashes; role-based access with administrative actions logged; least-privilege access for staff with review; separate production and development environments; backups with restore testing. We notify you of a security incident affecting your data within 72 hours of becoming aware of it. Report a vulnerability to security@cflabs.ai.
10. Your rights
Depending on where you are, you may have the right to access, correct, delete or port your personal data, to object to or restrict processing, and to withdraw consent. Under Singapore's Personal Data Protection Act you may request access to and correction of your personal data, and withdraw consent.
Write to privacy@cflabs.ai. We may ask for information to verify your identity, and will respond within 30 days. If you are in the EEA or the UK you may also complain to your supervisory authority; in Singapore, to the Personal Data Protection Commission.
Where we process personal data on your behalf as a processor, direct requests from the individuals concerned should go to you, and we will assist you in responding.
11. Cookies
We use strictly necessary cookies for sign-in sessions and bot protection. We do not use advertising cookies or third-party tracking pixels. Any analytics we run is aggregated and does not profile individual visitors. Blocking necessary cookies will prevent sign-in.
12. Children
The service is for organisations and people aged 18 or over. We do not knowingly collect personal data from children. If you believe a child has provided us data, write to privacy@cflabs.ai and we will delete it.
13. Changes
We will post any change here with a new version and date. For a change that materially affects how we handle your personal data we will give at least 30 days' notice by email and in the console.
14. Contact
Computation Frontier Labs Pte. Ltd., Singapore.
Privacy: privacy@cflabs.ai · Security: security@cflabs.ai · Legal: legal@cflabs.ai