Privacy & Data Policy

This policy describes how Arbitr handles information when providing AI inference services.

1. Inference content

Arbitr does not use prompts, responses, tool calls, or other inference content to train models. Our provider gateway is designed not to intentionally persist prompt or response bodies in application logs. Inference content is processed transiently for the purpose of completing the requested inference operation.

2. Data retention

Arbitr's application layer is designed for no intentional retention of prompt and response content after a request completes. Operational and security metadata that does not intentionally contain prompt or response bodies—such as timestamps, request status, latency, token counts, error codes, and infrastructure health information—may be retained for up to 30 days for reliability, abuse prevention, capacity planning, and incident investigation.

If diagnostic troubleshooting ever requires temporary capture of request content, it will be limited to the minimum necessary scope, will not be used for training or advertising, and will be deleted as soon as reasonably practical and no later than 7 days after collection.

3. Infrastructure providers

Requests may be processed through third-party infrastructure used to operate the service, including content-delivery, network-security, tunneling, and rented compute providers. These providers may process network and operational metadata under their own terms and privacy policies. Arbitr selects infrastructure for the purpose of delivering and securing the inference service and does not sell inference content to those providers.

4. Data use

Information processed by Arbitr is used only to provide inference, authenticate requests, maintain service reliability, measure usage, prevent abuse, troubleshoot failures, and meet legal obligations. Arbitr does not sell personal information and does not use inference content for targeted advertising.

5. Security

Provider traffic is intended to use encrypted HTTPS transport to the public gateway. Access to inference endpoints is authenticated, and backend model servers are not intentionally exposed directly to the public Internet.

6. Zero-data-retention status

Arbitr does not currently represent this service as a formally certified or contractually guaranteed zero-data-retention (ZDR) service. The operational design minimizes content retention as described above.

7. Legal requests

Arbitr may preserve or disclose information when required by applicable law, valid legal process, or when reasonably necessary to protect the security and integrity of the service.

8. Changes

This policy may be updated as the service or its infrastructure changes. Material changes will be reflected on this page with an updated effective date.

9. Contact

Privacy and data-policy inquiries: privacy@arbitr.uk.

Provider and infrastructure inquiries: providers@arbitr.uk.