1. Overview
This Privacy Policy explains what information InferLayer AI, Inc. ("InferLayer," "we," "us") collects when you use our LLM gateway service (the "Service"), why we collect it, how long we keep it, and the choices you have. We aim to be direct: InferLayer is infrastructure that sits in the request path between your application and language models, so by design it processes the content of the requests you send through it.
2. Information we collect
API requests and responses
When you send requests through the Service, we process and log the prompts you submit and the responses returned, together with associated metadata. This is core to how the Service operates — see "How prompts and responses are handled" below.
Account information
When you or your organization are onboarded, we collect account details such as contact email, company name, and tenant identifiers, and we issue API keys (stored only as salted SHA-256 hashes — we never store the plaintext key).
Usage metrics
We record operational metrics including token counts, request latencies, routing decisions, and computed costs per request, for billing and service operation.
3. Why we process this information
- Service operation — routing, caching, spend governance, and returning responses to your application.
- Billing — metering token usage and request volume.
- Audit and compliance — maintaining a tamper-evident record of activity for dispute resolution and integrity verification.
- Product improvement — only on an aggregated, de-identified basis (e.g. routing accuracy, cache hit rates). We do not use the content of your prompts to train models.
4. How prompts and responses are handled
Prompts and responses ARE logged for audit, billing, and dispute-resolution purposes. Logs are stored encrypted at rest in our AWS account (us-east-1) with restricted IAM access. The audit log uses a tamper-evident SHA-256 hash chain — see our Security overview for details.
We will not claim that we "don't store prompts," because that would not be true: the audit chain exists precisely so that activity can be verified after the fact. What we do commit to is keeping that data encrypted, access-restricted, and retained only as long as described below.
5. Data retention
By default, audit logs (including prompts and responses) are retained for twelve (12) months. Retention is configurable per contract. Enterprise-tier customers may opt for a self-hosted (BYOC) deployment, in which prompts, responses, API key material, tenant identity, and audit data never leave the customer's own infrastructure.
6. Sharing and third parties
- Model providers — when a request is classified as complex and routed to a frontier provider (such as OpenAI or Anthropic), that provider receives the prompt content for that request and processes it under their own terms. Simpler requests are served by local models and are not sent to third-party providers.
- Infrastructure — we use Amazon Web Services (AWS) to host the Service and store data.
- Marketing site analytics and advertising — see "Cookies" below for Cloudflare Web Analytics and the LinkedIn Insight Tag used on our public marketing pages.
- No data brokers, and no sale of personal data or prompt content. We do not share prompt or response content with advertising or analytics vendors.
7. Your rights
Depending on your location, you may have rights under the GDPR, the California Consumer Privacy Act (CCPA/CPRA), and similar laws — including the right to access, correct, export, or delete your data. To exercise these rights, or to request data export, email contact@inferlayer.ai. We will respond within the timeframes required by applicable law. We do not sell personal information.
8. Cookies and third-party analytics/advertising tags
Session cookies are used where authentication is required — namely the /dashboard and /admin interfaces — to keep you signed in.
Our public marketing pages (this site) load two third-party scripts:
- Cloudflare Web Analytics — a privacy-focused page-view beacon that does not use cross-site tracking cookies.
- LinkedIn Insight Tag — an advertising/retargeting tag from LinkedIn Corporation, loaded on every marketing page. It is used to measure the performance of our LinkedIn ad campaigns and to build retargeting audiences of site visitors. It may set cookies and collect your IP address, device and browser information, and the pages you visit. LinkedIn processes this data under its own privacy policy — see LinkedIn's Privacy Policy for details.
The cookie banner on this site currently records your accept/decline preference but does not yet gate the loading of the Cloudflare or LinkedIn scripts — both load on page visit regardless of that choice. We are evaluating consent-based script gating for jurisdictions that require it.
9. Security
Data is encrypted in transit (TLS) and at rest (AES-256, AWS-managed), with access governed by scoped IAM roles and tenant isolation enforced on every request. For a fuller description of our security posture, see the Security overview.
10. Changes to this Policy
We may update this Policy from time to time. Material changes will be reflected by an updated effective date above and, where appropriate, direct notice.
11. Contact
Questions or requests regarding this Policy? Contact us at contact@inferlayer.ai.