Data and Privacy
Define processing, retention, training use, and deletion for prompts, outputs, files, logs, and provider routing.
An aggregation platform routes requests to inference nodes. Its data policy must explain both APIQIK's own handling and the boundaries of underlying providers.
Policy status: pending legal and platform confirmation. This page lists questions official privacy documentation must answer. It does not promise zero data retention, processing regions, or compliance certifications.
Data lifecycle
| Stage | Required details |
|---|---|
| Collection | Fields collected from requests, responses, files, IPs, accounts, usage, and error logs. |
| Processing | Provider types receiving data and whether providers may retain it or use it for training. |
| Storage | Retention periods and regions for content logs, metadata, caches, backups, and billing. |
| Access | Roles allowed to view content, support-access conditions, and audit procedures. |
| Deletion | User deletion entry point, completion deadlines, backup cleanup, and statutory exceptions. |
Zero data retention
If ZDR is offered, define exactly which content is not persisted, whether usage and security metadata remain, eligible models and providers, effects on caching and diagnostics, and how to enable it in the console or contract.
Developer responsibilities
- Send only the minimum data needed; redact or substitute placeholders beforehand.
- Never put keys, passwords, payment credentials, or unnecessary identity data in prompts.
- Provide transparent user notices, a lawful processing basis, and deletion paths.
- Review regions, subprocessors, contracts, and regulatory requirements before sensitive-industry deployments.
Release checklist
Publish the privacy policy, subprocessor list, data-processing agreement, security statement, vulnerability-reporting channel, and certification status together. Do not imply certifications that have not been obtained.