AI Data Policy
Effective September 2, 2026
Prompts and completions are not used to train or fine-tune models.
Inference content is transient and is not intentionally stored after completion.
Token counts, timing, status, model, and security signals may be retained up to 30 days.
Personnel are not given routine access to prompt or completion content.
Request processing
Token Labs receives request content only to perform inference and stream the result. Content exists in process and accelerator memory while the request is active and is released through normal service lifecycle management after completion or cancellation.
Logging
Production model servers are configured not to log request prompts or generated completions. Gateway and metrics systems record operational metadata such as timestamp, route, model identifier, token counts, latency, response status, capacity rejection, and pseudonymous credential/account identifiers.
Training and evaluation
Customer and OpenRouter traffic is not used for training, fine-tuning, reinforcement learning, or human evaluation. Separate benchmark prompts are generated or licensed for engineering evaluation and are not sourced from customer requests.
Retention and deletion
Prompt and completion content has no intentional post-request retention period. Operational metadata is normally deleted or aggregated within 30 days. Security incidents, abuse investigations, billing disputes, or legal obligations may require limited metadata to be held longer. Deletion requests can be sent to privacy@tokenlabs.run.
Subprocessors and location
OpenRouter may process data before it reaches Token Labs under OpenRouter’s own policies. Token Labs processes inference on its declared infrastructure and discloses deployment country/region in its provider model document. Infrastructure providers receive only the access technically necessary to operate the service.
Zero data retention
This policy is designed for content-minimizing operation, but Token Labs will advertise OpenRouter’s formal ZDR capability only after the complete technical and contractual ZDR controls have been independently verified.