Privacy Policy

1. Zero-Data-Retention Inference by Default

Privacy is enforced at the architectural level in Zopyr. When you send requests to /v1/chat/completions, /v1/responses, /v1/messages, /v1/embeddings, or /v1/realtime, your prompt text and model completions pass through memory solely to stream the response back to your application.

By default, payload contents are never written to our database, logs, or analytics tables. If you explicitly opt in to "Content Logging" on a specific API key for debugging, the captured request and response payloads are encrypted at rest using AES-256-GCM envelope encryption.

2. Categories of Information We Process

We collect only the minimum operational and account data necessary to authenticate requests, maintain your double-entry credit ledger, and prevent abuse:

• Account & Identity Data: Name, email address, optional verified phone number, organization memberships, and hashed authentication credentials.
• Operational Request Metadata: Generation ID (gen-...), timestamp, model slug, provider slug, prompt/completion/reasoning/cached token counts, TTFT and total latency in milliseconds, HTTP status code, and nano-USD charge.
• Pseudonymized Network Signals: Client IP addresses are never stored in plain text in request logs; they are hashed with a rotating cryptographic salt (HMAC-SHA256).
• Billing & Ledger Records: Top-up payment intents, transaction references, and append-only ledger entries required for financial accounting.

3. How Requests Are Forwarded to Model Providers

To fulfill an inference call, the model payload is transmitted over TLS 1.3 to the selected upstream provider. Zopyr strips your personal identity (email, name, raw IP address, and Zopyr API key) before forwarding. The optional OpenAI user parameter is replaced with an irreversible cryptographic HMAC of your Organization ID solely for upstream abuse prevention.

4. Cryptographic Controls & Storage Security

All sensitive secrets—including API key hashes, two-factor TOTP secrets, opt-in logged payloads, and uploaded /v1/files buffers—are protected using envelope encryption (AES-256-GCM with per-record data keys wrapped by a master key) and strict key-rotation support.

5. Your Data Rights: Self-Service Export & Account Erasure

Regardless of your jurisdiction (including GDPR, UK GDPR, and CCPA), Zopyr provides built-in self-service privacy controls directly inside /app/settings/privacy:

• Right of Access & Portability: Generate a complete, machine-readable ZIP archive of your profile, organizations, API keys metadata, ledger history, and request logs at any time.
• Right to Erasure (Account Deletion): Schedule permanent account deletion with a 14-day grace period, after which personal identifiers are permanently purged.
• Instant Content Log Purge: Disable content logging on any API key or delete uploaded /v1/files immediately via DELETE /v1/files/:id.