Privacy Policy
This policy explains what Cambrian (“Cambrian”, “we”) collects when you use our website at cambrianinfra.com and our inference API at api.cambrianinfra.com (together, the “Services”), how we use it, whom we share it with, and the rights you have over it.
1. Zero data retention
We do not store the content of your requests or of the model’s responses. Zero data retention is not an option you enable; it is how the Service is built. A prompt is forwarded to an inference server we operate, held in memory only for as long as it takes to generate the response, streamed back to you, and discarded. We keep no copy. Content is never written to disk, never logged, never reviewed by a person, and never used to train, fine-tune, evaluate, or improve any model.
One technical detail, stated plainly: inference servers keep a prefix cache, the intermediate numerical state of recently processed prompts, in GPU memory so that a repeated prefix is not recomputed. That state is not text, cannot be read back as a record of what was sent, is never persisted, and is cleared when the server restarts.
2. Information we collect
Account information. The name and email address you give us, and a reference to your billing record with our payment processor.
Usage metadata. For each API request: the time it was made and how long it took; the model requested; the number of input tokens, of input tokens served from the prefix cache, and of output tokens; the response status and whether it was streamed; the identifier (never the secret) of the API key used; and the cost of the request. This is the record from which your invoice is computed.
API keys. Stored only as a one-way cryptographic hash. We cannot recover a key after it is issued.
Website data. Our website sets no tracking cookies and runs no analytics. Our hosting provider keeps standard, short-lived access logs (IP address, user agent, time, path) under its own policy.
3. How we use information
- to provide the Services, authenticate requests, and enforce the limits on your keys;
- to compute invoices and collect payment;
- to plan capacity and detect abuse, outages, and errors;
- to communicate with you about your account, changes to the Services, or these policies;
- to comply with law.
We do not sell personal information and we do not use any of it for advertising.
4. Who we share information with
We share information only with the providers that operate the infrastructure the Services run on, and only what each needs:
- Google Cloud (GPU machines that run inference): request content passes through in memory; standard network logs.
- Modal (hosting for the API gateway): request content passes through in memory; usage metadata is stored here.
- Vercel (edge network and website hosting): request content passes through in memory; short-lived access logs.
- Stripe (payments): your billing contact, payment details, and our per-period usage totals. We never see card numbers.
We may also disclose information if required by law or legal process, to protect the rights and safety of Cambrian or others, or as part of a merger or acquisition, in which case this policy continues to apply to it.
5. Retention
- Request and response content: not retained (section 1).
- Usage metadata: twelve months, because it is the basis of invoices already issued and of any dispute about them.
- Account information: for as long as you have an account, then deleted on request.
- Hashed API keys: until revoked, then deleted with the account.
6. Security
All traffic to the Services is encrypted in transit. Access to the machines that run inference is restricted to a shared secret held only by our gateway. Keys are hashed at rest. Usage metadata lives in a single store with no public access.
7. International transfers
The Services are operated from the United States and the providers in section 4 process data there. If you use the Services from elsewhere, you are transferring information to the United States, where the protections may differ from those of your jurisdiction.
8. Your rights
Depending on where you live (including under the GDPR, the UK GDPR, and the CCPA), you may have the right to access the personal information we hold about you, to correct it, to delete it, to receive a copy of it, to object to or restrict its processing, and to complain to a supervisory authority. Write to us (section 11) and we will act within thirty days. We will not treat you differently for exercising a right.
9. Children
The Services are for businesses and developers and are not directed at children. We do not knowingly collect information from anyone under 18.
10. Changes
We may update this policy. The date at the top is the date of the version in force. Material changes are sent to the email on your account before they take effect. We will never change section 1 to retain content without your explicit, opt-in agreement.