Privacy Policy

3.1 What ZDR means

For Developer Pro and Pay-as-you-go, the Service operates in Zero Data Retention mode. This means:

• Inputs and Outputs are processed transiently — primarily in volatile memory — only for as long as needed to generate and return a response, and are not written to our durable application storage (such as our databases, long-term object storage, or backups).

• To improve performance, an inference cache (for example, a prefix/context cache) may hold Inputs, Outputs, or values derived from them in volatile memory. In some configurations this cache may also write content to local solid-state (SSD) storage attached to the inference host; any such on-disk cache content is encrypted at rest through full-disk encryption and is not part of our durable retained-content stores or backups.

• Cached content is evicted on a rolling, space-available basis. We do not currently guarantee deletion of cached content within a fixed time window; cached content may remain on the inference host until it is evicted to make room for new data. Once an entry is evicted or the cache process terminates, the content is no longer retained by us and is not recoverable.

• Inputs and Outputs are never used to train, fine-tune, evaluate, or otherwise improve any model, ours or a third party’s.

“Zero Data Retention” means we do not durably retain Input/Output content in our databases, object storage, or backups, while still allowing transient in-memory and short-lived on-host cache processing and the retention of non-content operational metadata (see 3.3).

3.2 What retention means for Starter and Developer

For Starter and Developer, Inputs and Outputs are retained for the window above to support features such as debugging, abuse prevention, usage history, and customer support. We do not use this content to train or improve models. After the retention window, content is deleted or irreversibly anonymized on a rolling basis.

Access to retained content is restricted to authorized personnel on a need-to-know basis. Starter and Developer customers cannot opt out of retention except by upgrading to a ZDR tier. Retained content is encrypted at rest using AES-256.

3.3 Operational metadata applies to all tiers (including ZDR)

Regardless of tier — including ZDR tiers — we retain limited operational metadata that does not include the substance of your Inputs/Outputs: timestamps, token counts, model and endpoint used, latency, status codes, request IDs, and account identifiers. We use this for billing, security, capacity planning, and legal compliance. Operational metadata is retained for 12 months and then deleted or aggregated.

3.4 Abuse detection and ZDR

Even on ZDR tiers, automated safety and abuse classifiers may inspect Inputs and Outputs in memory at request time. No content is persisted as a result of this inspection unless a request is flagged, in which case the flagged content may be retained for the limited period necessary to investigate the issue and to comply with a legal or safety hold.

4. How We Use Information

We use the information described above to:

• Provide and operate the Service, including routing requests to models and returning Outputs.

• Authenticate users and secure accounts.

• Bill and collect payment, including metering token usage.

• Provide support and respond to your requests.

• Maintain security, prevent fraud and abuse, and enforce our terms and acceptable-use policy.

• Monitor, debug, and improve the reliability and performance of the platform (using telemetry/metadata, and — only for non-ZDR tiers and only as permitted — retained content).

• Comply with legal obligations and respond to lawful requests.

• Communicate with you about service, security, and (where permitted) product updates.

We do not use customer Inputs/Outputs from any tier to train or improve models.

5.Legal Bases for Processing (EEA/UK)

Where the GDPR or UK GDPR applies and we act as a controller, we rely on the following legal bases:

• Performance of a contract — to provide the Service you have signed up for and to bill you.

• Legitimate interests — to secure the Service, prevent abuse and fraud, and improve reliability (balanced against your rights).

• Legal obligation — to meet tax, accounting, and other statutory duties.

• Consent — for optional analytics/marketing cookies and marketing emails, where required.

Where we act as a processor for customer Inputs/Outputs, our customer is responsible for establishing a legal basis for that processing.

6. How We Share Information

We share information only as described here:

• Subprocessors / service providers who process data on our behalf under contract (see Section 7).

• Payment processor to complete transactions.

• Professional advisors (lawyers, auditors, accountants) under confidentiality.

• Legal, safety, and compliance — to comply with law, enforce terms, or protect the rights, property, or safety of the Company, our users, or the public.

• Corporate transactions — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

We do not sell personal data, and we do not share personal data for cross-context behavioral advertising. The Company does not engage in any “sale” or “sharing” of personal data as those terms are defined under the CCPA/CPRA.

7. Subprocessors

We use the following categories of subprocessors. The current list is maintained at https://makora.com/subprocessors and customers may subscribe to update notifications.