What we do not store
Texts, questions and options sent to /decide are forwarded to our model service, answered in memory, and discarded. They are not written to a database, a log, a cache, or an error message, there or here.
Our request log records a request id, the API key id, which model ran, and counts (texts, questions and billed tokens). It does not record your text, and it does not record a hash of your text.
What we do store
Account data: the email address and name your sign-in provider gives us, and which organisations you belong to.
API keys: the public id prefix in plain text so a key can be looked up without scanning, and the secret only as a SHA-256 hash. We cannot recover a key secret, which is why a lost key must be rotated rather than retrieved.
Usage counters: per key, day and model, request, text and question counts, billed tokens and their cost — never the text, questions or options. Counters from past compression requests (request and byte totals with content-free dimensions, never payload text) are kept on the same terms. Your balance is computed from all of these counters; the usage dashboard shows the decision counters.
Credit balance and the ledger of top-ups and debits against it.
Billing alert settings: the balance thresholds you want warned about, and an optional email address to send those warnings to instead of every owner and admin.
Who else processes data
Stripe, for payments. Credit purchases are sold through Link, Stripe's merchant of record, which receives your name, email, billing address and payment details to take the payment, charge any tax and send the receipt. Card details go to Stripe directly and never reach our servers.
Resend, for transactional email — organisation invitations, low-balance credit alerts, and other account mail. They receive the recipient address and the message.
Our hosting and database providers, which run the API and store the account data described above.
Modal Labs, which runs the GPU containers that serve the decision models and train fine-tuned models. Text sent to /decide passes through those containers for the duration of the request.
RunInfra, which provides AI processing for fine-tune jobs, under zero data retention.
Freestyle, which provides the temporary machines fine-tune jobs run on.
We do not sell data and we do not share it with advertisers. Text sent to /decide is not used to train anything, and no generative model is called on it. The decision engine runs our own OpenDecision encoder models, which score options and cannot generate text. Our public models are not trained on your data. Fine Tune is the one exception, and only when you start a job, as described below.
Fine Tune
This section applies only when you start a fine-tune. Everything above about /decide is unchanged, including for models you fine-tune once they are running. When you start one, you ask us to use the text you send to build a model for you.
To build it, the text you send is processed by RunInfra, Freestyle and Modal Labs, listed above, only for that job. The machines a job runs on are deleted when it ends, and the text is not saved with your model.
Your text trains only your model. It is not used to train our public models or any other customer's model. Text you send to a fine-tuned model afterwards is handled like any other /decide request.
We keep a finished model's files until you delete it, so you can use and download it. Files from a job that fails or is canceled are deleted. We also keep the model's name, the question it answers, its labels, your description and its scores. When you delete a model we erase the question, labels and description and keep its name, scores and any charge, because they are part of your billing record. Model files do not contain your text as written, but a model trained on text can reflect what it was trained on.
A fine-tuned model you call through our API runs on our own server, and your text is not stored. If you run it on your own machine, your text stays there, and we learn only that your key asked about the model.
Retention
Account and organisation records are kept while the account exists, and deleted on request.
Usage counters are retained for billing and dispute resolution. They contain no content.
Request text has no retention period because it is never written down.
Your rights
Tokz Labs, Inc., a Delaware corporation, is responsible for the account data described above.
You can request a copy of the account data we hold, ask for it to be corrected, or ask for the account and its data to be deleted. Write to the privacy address below and we will action it.
If you are in the UK or EU, the usual GDPR rights apply, including the right to complain to your supervisory authority.
Security
Key secrets are stored as SHA-256 hashes and compared in constant time, so a timing difference cannot be used to guess one. Keys are looked up by their public prefix so there is no table scan and no timing oracle on the secret.
If you find a vulnerability, please report it to the security address below rather than filing a public issue. We will not pursue anyone acting in good faith.
Contact
- Privacy and data requests
- privacytokzdev
- Legal and terms
- legaltokzdev
- Security disclosure
- securitytokzdev
- Everything else
- supporttokzdev