1. Overview
This Privacy Policy explains what information InferLayer AI, Inc. ("InferLayer," "we," "us") collects when you use our LLM gateway service (the "Service"), why we collect it, how long we keep it, and the choices you have. We aim to be direct: InferLayer is infrastructure that sits in the request path between your application and language models, so by design it processes the content of the requests you send through it.
2. Information we collect
API requests and responses
When you send requests through the Service, we process and log the prompts you submit and the responses returned, together with associated metadata. This is core to how the Service operates — see "How prompts and responses are handled" below.
Account information
When you or your organization are onboarded, we collect account details such as contact email, company name, and tenant identifiers, and we issue API keys, random 256-bit values stored only as SHA-256 hashes — we never store the plaintext key.
Usage metrics
We record operational metrics including token counts, request latencies, routing decisions, and computed costs per request, for billing and service operation.
3. Why we process this information
- Service operation — routing, caching, spend governance, and returning responses to your application.
- Billing — metering token usage and request volume.
- Audit and compliance — maintaining a tamper-evident record of activity for dispute resolution and integrity verification.
- Product improvement — only on an aggregated, de-identified basis (e.g. routing accuracy, cache hit rates). We do not use the content of your prompts to train models.
4. How prompts and responses are handled
Prompts and responses ARE logged for audit, billing, and dispute-resolution purposes. Logs are stored encrypted at rest in our AWS account (us-east-1) with restricted IAM access. The audit log uses a tamper-evident SHA-256 hash chain — see our Security overview for details.
We will not claim that we "don't store prompts," because that would not be true: the audit chain exists precisely so that activity can be verified after the fact. What we do commit to is keeping that data encrypted, access-restricted, and retained only as long as described below.
5. Data retention
By default, audit logs (including prompts and responses) are retained for twelve (12) months. Retention is configurable per contract. Enterprise-tier customers may opt for a self-hosted (BYOC) deployment, in which prompts, responses, API key material, tenant identity, and audit data never leave the customer's own infrastructure.
6. Sharing and third parties
- Model providers — requests are served by third-party model providers (such as OpenAI, Anthropic, or Google), which receive the prompt content for that request and process it under their own terms. On the default tier this applies to every request; simple requests are served by local models only on the private-GPU tier or in BYOC deployments.
- Infrastructure — we use Amazon Web Services (AWS) to host the Service and store data.
- Marketing site analytics and advertising — see "Cookies" below for Cloudflare Web Analytics and the LinkedIn Insight Tag used on our public marketing pages.
- No data brokers, and no sale of personal data or prompt content. We do not share prompt or response content with advertising or analytics vendors.
7. Your rights
Depending on your location, you may have rights under the GDPR, the California Consumer Privacy Act (CCPA/CPRA), and similar laws — including the right to access, correct, export, or delete your data, and to know what categories of personal information we collect and why. InferLayer AI, Inc. is incorporated in California. California residents additionally have the right to opt out of the sale or sharing of personal information (including for cross-context behavioral advertising) and to non-discrimination for exercising these rights. We do not sell personal information for money. The LinkedIn Insight Tag described below is a “share” under the CPRA’s definition; use Privacy Choices in the site footer, decline the cookie banner, or browse with Global Privacy Control enabled to opt out of it at any time. To exercise any other right, or to request data export, email contact@inferlayer.ai. We will respond within the timeframes required by applicable law.
8. Cookies and third-party analytics/advertising tags
Session cookies are used where authentication is required — namely the /dashboard and /admin interfaces — to keep you signed in.
Our public marketing pages (this site) can load two third-party scripts, only if you accept them in the cookie banner:
- Cloudflare Web Analytics — a privacy-focused page-view beacon that does not use cross-site tracking cookies.
- LinkedIn Insight Tag — an advertising/retargeting tag from LinkedIn Corporation. It is used to measure the performance of our LinkedIn ad campaigns and to build retargeting audiences of site visitors. It may set cookies and collect your IP address, device and browser information, and the pages you visit. LinkedIn processes this data under its own privacy policy — see LinkedIn's Privacy Policy for details.
Neither script loads until you click Accept on the cookie banner. Declining, ignoring the banner, or browsing with the Global Privacy Control signal enabled keeps both off. You can change your choice at any time using Privacy Choices in the site footer.
9. Security
Data is encrypted in transit (TLS) and at rest (AES-256, AWS-managed), with access governed by scoped IAM roles and tenant isolation enforced on every request. For a fuller description of our security posture, see the Security overview.
10. Changes to this Policy
We may update this Policy from time to time. Material changes will be reflected by an updated effective date above and, where appropriate, direct notice.
11. Contact
Questions or requests regarding this Policy? Contact us at contact@inferlayer.ai.