Legal
Last updated Oct 2026
How inference data moves through runaii.cloud: what we process to answer a request, what we keep afterwards, and how to get rid of it. The operational detail behind the Privacy Policy.
| Gateway prompt & output bodies | Zero retention. They exist in memory for the duration of the request — never written to storage. | Live |
| Gateway usage metadata | Model, token counts, latency, status, cost — kept for billing and abuse prevention. | Live |
| Console request log | Your own account's prompts and outputs, so you can audit cost and latency. Wipe anytime. | Live |
| Training on your data | Never. Customer prompts and outputs are not used to train shared or public models. | Live |
| Security logs | IP, user agent, approximate country — up to 12 months, fraud and abuse prevention only. | Live |
| API keys | SHA-256 hash only. The secret is shown once at creation and never stored. | Live |
| Billing records | Invoice and payment metadata via Dodo Payments — kept as long as tax law requires. | Live |
| Analytics | PostHog, Plausible and Google Analytics load only after you opt in. | Opt-in |
Requests that arrive through gateway.runaii.cloud — including traffic from routing platforms such as OpenRouter — are served in memory. Prompt and generation bodies are not logged or written to any persistent store. What we keep is metadata: the model used, token counts (including cached-prefix counts), latency, status and cost. That is enough to bill and to detect abuse, and it is all we retain.
When you call the API with your own runaii key, the same request also appears in your console's request log so you can audit cost and latency. That log belongs to your account: wipe it in Settings → Danger zone, or ask for no-log processing on an Enterprise plan. Deleting your account removes it.
Account & billing data: runaii is the controller — we decide how it is processed, under this policy and the Privacy Policy.
Prompts and outputs you send through the API: runaii is a processor — we handle them to serve your request and for nothing else.
Your end users' data inside your app: You are the controller; runaii is your processor. A DPA is available for Enterprise.
We never sell personal data, never train shared models on your prompts, never store API key secrets, and never load third-party analytics before you opt in.
Gateway prompt/output bodies: not retained. Usage metadata: kept for billing and abuse prevention, then aged out with the account. Console request logs: until you delete them or the account. Security logs (IP, user agent, approximate country): up to 12 months. Billing records: as long as tax law requires. Analytics: only if you opt in, and subject to that vendor's retention.
Compute runs on Google Cloud in the regions listed on /subprocessors. Where personal data originating in the EEA, UK or Switzerland leaves those jurisdictions, we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. Ask [email protected] for a copy.
Encryption in transit and at rest, hashed keys, scoped access and an incident process are stated on the Trust Center — live controls marked, in-flight certifications dated, no badge theater.
Access, correction, deletion, portability, restriction, objection and withdrawal of consent — write to [email protected] and we verify identity before acting. California residents additionally have the CCPA rights set out in the Privacy Policy: we do not sell or share personal information, and a verifiable request is answered within 45 days.
The platform is for business use and is not directed to anyone under 16. We do not knowingly collect their data; if we learn we have, we delete it.
Material changes are posted in the changelog with a date, and Enterprise customers get notice at the address on file. Questions, DPAs and data requests: [email protected].