Privacy Policy

Last updated: June 1, 2026 · Version 3.1 · Operated by Logorhythms

Plain-language summary: We log every API request you send so we can (1) keep the service running, (2) build private, internal datasets we use to evaluate and benchmark LLM performance, and (3) — only if you opt in — train and fine-tune our models, which unlocks premium models for you. Opting in to training is voluntary and reversible, but content already incorporated into a trained model cannot be removed from that model (see §2c). We do not sell, license, or otherwise distribute your data — or any derivative of it — to anyone. We may publish benchmark results (model rankings, scores, methodology) and open-source the benchmark code, but the underlying dataset built from your prompts is never published or shared. IP addresses, User-Agent strings, and HTTP headers are used only for security and operations. Best-effort PII scrubbing runs on every request at ingest, but it is not perfect — don't submit content you'd regret us retaining.

1. What We Collect

We collect data about every API request. The categories below describe what is received by our infrastructure. At ingest, request and response content is run through an automated best-effort PII scrubber (Microsoft Presidio + spaCy NER with our custom recognizers) before it is written to the trace store. Best-effort means the scrubber runs on every request but is not guaranteed to catch every piece of identifying information — free-form text written by humans in formats the recognizers miss can slip through. See §3a for detail and the important caveat.

The categories of data we collect are:

2. How We Use Your Data

We use collected data for two distinct purposes:

2a. Service operation (always — no opt-out)

Our lawful basis for these activities under GDPR is legitimate interest (Article 6(1)(f)). You cannot opt out of service operation while continuing to use the Service — but the data used for these purposes is never sold or licensed.

2b. Internal evaluation datasets (no third-party distribution)

Post-scrub request and response content may be incorporated into private, held-out datasets that we use internally to evaluate, compare, and benchmark the performance of the LLMs available through the Service. These datasets are confidential and internal — they are not sold, licensed, published, or otherwise disclosed to any third party. We may publish aggregate benchmark results (model scores, rankings, methodology) and may release the evaluation harness as open source; neither discloses the underlying user content. Lawful basis (GDPR): legitimate interest (Art 6(1)(f)) — measuring and improving the quality of the inference we provide. You may object at any time (Art 21); see §5. Evaluation datasets are built from post-scrub content only, are never distributed, and are subject to access controls and a defined retention period.

2c. Model training & fine-tuning (opt-in only)

If — and only if — you opt in at /consent, your post-scrub request and response content may also be used to train and fine-tune the models we operate. Opting in unlocks our premium models (typically newer or larger); declining or withdrawing simply means premium models are unavailable to you, with no effect on the standard (free) tier. Lawful basis (GDPR): consent (Art 6(1)(a)). You may withdraw consent at any time (Art 7(3)) via /consent, which stops future training use and revokes premium access. Content is only eligible for training if you had opted in at the time the request was logged and you have not since withdrawn consent: we tag each logged request with your training-consent state at that moment, and our training-set selection additionally re-checks your current preference, so withdrawing consent removes all of your content — past and future — from any future training run. The unconditional field exclusions in §3a (IPs, headers, account identifiers, sub-day timestamps) apply to training sets too.

Irreversibility — read this before opting in. Training incorporates information from your content into a model's parameters (weights). Unlike a row in a dataset, this cannot be selectively deleted: withdrawing consent or deleting your account stops all future training use and removes your logs and your content from future training sets, but it cannot remove your content's influence from a model that was already trained, and trained models can in rare cases reproduce fragments of their training data. Models we train on opted-in content are used internally to operate the Service; we still never sell, license, or distribute your data, your content, or those models' training data to any third party. If you are not comfortable with this permanence, do not opt in — the standard tier does not require it.

3a. How We Handle and Retain Logged Content

We apply the following steps to logged content. These commitments are part of this Privacy Policy and create a binding obligation; failure to follow them would be a violation of these terms. Nothing in this section should be read as a warranty that the output is perfectly de-identified — see the caveat at the end of this section.

Important caveat (read this): We use commercially reasonable efforts and standard industry tooling (Presidio + spaCy NER + custom recognizers, score threshold 0.7) to minimize residual identifiability, but we do not represent, warrant, or guarantee that the output is anonymous, de-identified, or impossible to re-associate with you. We use the phrase "best-effort anonymized" everywhere in this Policy specifically to avoid that overclaim. If you submit content you would not want retained internally even after this pipeline runs — for example, anything you would be uncomfortable seeing surfaced in an internal benchmark — opt out of evaluation-dataset use at /consent and your content will be excluded from evaluation datasets (and do not opt in to model training, which is off by default).

Pre-v2 data: Content collected before May 2, 2026 was collected under our prior Terms of Service. This historical data is retained for internal service operation and quality improvement only. It is internal-only, is never sold, licensed, or distributed to any third party, and is excluded from any evaluation dataset that informs published benchmark results.

3b. Data Sharing

We share data with the following categories of third parties:

We may publish aggregate benchmark results and may open-source the benchmark harness/code. We never share, sell, or publish the underlying dataset of your content.

4. Data Retention

5. Your Rights

Regardless of jurisdiction, you may at any time:

We respond to verifiable DSAR requests within 30 days (45 days under CCPA). We may require verification (e.g., signing a request with your active API key or otherwise confirming control of the account) before fulfilling requests.

5a. Additional Rights for EU/EEA/UK Residents (GDPR)

If you are in the European Economic Area or the United Kingdom, you also have the right to:

Lawful bases: We rely on legitimate interest (Art. 6(1)(f)) for service operation, security, and internal evaluation-dataset creation, and on consent (Art. 6(1)(a)) for the optional use of your content to train and fine-tune models (the premium tier). You may withdraw that consent at any time (Art. 7(3)) without affecting the lawfulness of processing carried out before withdrawal.

International transfers: Logfare's infrastructure is hosted outside the EEA. Where we transfer EEA personal data internationally, we rely on Standard Contractual Clauses (SCCs) or other adequacy mechanisms recognized by the European Commission.

5b. Additional Rights for California Residents (CCPA / CPRA)

If you are a California resident, you have the right to:

5b-1. Notice of Financial Incentive (CCPA §1798.125(b))

The program. Opting in to model-training use of your post-scrub content unlocks access to our premium models. How to opt in: toggle it on at /consent. How to withdraw: toggle it off at the same place at any time — premium access ends and no further training use occurs. Participation is entirely voluntary, and the standard (free) tier is fully available whether or not you participate.

Material terms & good-faith value estimate. There is no price difference between the tiers — both are free; the only difference is which models you may call. We are neither paying nor charging you. We estimate the value of the data made available to us by an opted-in user to be reasonably related to, and not to exceed, the incremental cost of providing premium-model inference to that user, calculated by reference to our marginal inference cost for those models. We do not assign a per-record monetary value to your content and we do not sell it; its only value to us is as internal training signal for the models we operate.

5c. Additional Rights for Australian Residents (Privacy Act 1988)

If you are an Australian resident, you have the right to:

We process some categories of regulated personal information (including any TFN, ABN, or Medicare numbers that may appear in prompts despite our prohibition on submitting such data — see ToS §7). Our PII pipeline attempts to detect these with custom recognizers on a best-effort basis; detected matches are removed at ingest. We do not warrant that every regulated identifier is detected, and you should not submit such data in the first place.

6. Security

We implement reasonable technical and organizational measures to secure stored data, including bcrypt password hashing, SHA-256 API key hashing, TLS in transit, and access controls on the trace store. However, no system is perfectly secure. We make no guarantees about the security or integrity of collected data; use the Service at your own risk.

7. Children

The Service is not directed to children under 18 (or under 16 in the EEA). We do not knowingly collect data from children under these ages. If you are a parent and believe your child has created an account, contact support@logfare.ai for immediate deletion.

8. International Users

Data collected through the Service may be stored and processed in any country where we or our service providers operate. By using the Service, you consent to the transfer of your data to jurisdictions that may not provide the same level of data protection as your home jurisdiction, subject to the safeguards described in §5a.

9. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes that affect your rights — for example, expanding the categories of data collected, adding new categories of data recipients, or changing how we use logged content — we will provide at least 30 days' advance notice via email or a prominent notice on the site, and we will not retroactively apply the new terms to data collected before the change.

10. Contact

For privacy-related questions, DSAR requests, or any other data-related matters, please contact support@logfare.ai or reach out via the Logorhythms Discord server.