ZalmirBeta
Sign inGet API key

Provider policies

Summaries of each provider's published data policy, not Zalmir's own. Inclusion here does not mean a provider is enabled, available, permitted for your use or verified in a live Zalmir integration.

Draft, awaiting founder and legal review

Who receives your requests?

Independent-seller endpoint: Seller can see prompts. The independent seller receives your request content to run inference; this is not guaranteed seller-blind inference. Seller-blind inference is not guaranteed. This notice does not establish the seller's retention, deletion or training practices.

Listed providers, including providers used with your own API key (BYOK), have their own API/inference data policies. Review the dated provider summaries and primary policy links before sending content.

Any optional permission to use request content to improve Zalmir is separate from processing needed to provide inference. It is not a promise that content stays within Zalmir or that an endpoint's own data policies change.

OpenAI

Provider ID: openai

OpenAI says API data is not used to train or improve its models unless you explicitly opt in. Its API abuse-monitoring logs may contain prompts and responses and are normally retained for up to 30 days, with longer retention for legal or harm-prevention reasons; some API features also store application state. Modified Abuse Monitoring and Zero Data Retention require approval and have endpoint, feature and safety exceptions, so they are not blanket guarantees for every account, model or request.

Source text last verified: Nov 1, 2026. Account settings and live handling not verified.

Primary sources

Scope and unknowns

Direct OpenAI platform API, not ChatGPT, Azure or another host. Organization/project controls, approved retention mode, endpoint/model, opt-in, safety notice, application state, caching and actual regional routing remain unverified. Prompt caching and stored Responses can differ from abuse logs; no uniform `store=false`, no-human-review or regional confinement is established.

Together AI

Provider ID: together

Together AI says it stores inference prompts and responses by default and may use them for product improvements, while model-training data sharing is opt-in and off by default. Together describes an organization privacy setting for zero data retention that stops persisting request content or using it for secondary purposes from the time it is enabled; this is not a confirmation of your account settings. Passthrough models send content to upstream providers under their own data policies, and Together's broader privacy policy includes legal, security and usage-data retention provisions.

Source text last verified: Nov 1, 2026. Account settings and live handling not verified.

Primary sources

Scope and unknowns

Inference/API organization privacy controls; T2 also covers broader services. Training opt-in, request storage and passthrough are different matters. Actual organization versus personal-account state, historical deletion, upstream route/policy, numeric default retention and legal-record interaction with prospective ZDR remain unverified. No verified settings path or data-residency promise is supplied.

SambaNova

Provider ID: sambanova

SambaNova's SambaCloud terms permit processing customer inputs and outputs to provide the service or as required by law. Its Data Processing Addendum prohibits model training or fine-tuning on covered customer personal data and says prompts, inputs, and completions may be retained for up to 30 days solely for security, fraud, and abuse monitoring, except when the customer elects to store them. Account, billing, authentication, and service-usage data have separate retention rules. We have not verified your account's agreement, storage selections, or processing region; review SambaNova's linked terms and Data Processing Addendum.

Source text last verified: Nov 1, 2026. Account settings and live handling not verified.

Primary sources

Scope and unknowns

Hosted SambaCloud; DPA restriction expressly concerns covered customer personal data, not every product/data category. Actual Order/additional documents, elective storage, regional routing, service-usage/query-log duration and any special agreement remain unknown. DPA §9 permits legal retention and separate post-termination active/backup deletion schedules; 30-day content monitoring is not deletion of all records or an unconditional ZDR promise. No training-consent UI verified.

DeepSeek

Provider ID: deepseek

DeepSeek's Open Platform terms cover processing API inputs to generate outputs and incorporate its general Terms of Use. Those general terms permit limited use of inputs and outputs for service or technology improvement after encryption and strict de-identification, and describe an improvement opt-out, but we have not verified how that control applies to API requests. We have not established an API-specific no-training commitment or fixed prompt/response retention period. DeepSeek's linked privacy policy describes training, security and legal uses of personal data and storage in China, but expressly excludes personal-data processing rules for downstream applications' end users; review the Open Platform terms and linked policies for your use.

Source text last verified: Nov 1, 2026. Account settings and live handling not verified.

Primary sources

Scope and unknowns

DeepSeek's own developer Open Platform and incorporated general terms, not third-party hosting of DeepSeek weights. S1 §5.5/S3 downstream-user exclusion must travel with privacy/training/storage descriptions. API-specific improvement control, downstream content treatment, content/log/backup retention duration, enterprise exceptions and actual region/account eligibility remain unknown. China personal-data storage language is not proof of every request's routing or a legal data-transfer conclusion. Unknown is not “always trains.”

Fireworks AI

Provider ID: fireworks

Fireworks AI says open-model inference prompts and generations are not persistently logged or stored by default, and its inference documentation says they are not used to train models. It logs service metadata, may hold prompt caches in memory for several minutes, and permits explicit content-logging opt-ins. Its Response API stores conversation content for up to 30 days when store is true, the default; batch and training workflows can also persist content. Its separate Enterprise account-wide Zero Data Retention policy blocks content-persisting features, but permits legal or abuse-prevention retention exceptions and does not govern connected third parties; we have not verified your account's settings.

Source text last verified: Nov 1, 2026. Account settings and live handling not verified.

Primary sources

Scope and unknowns

Open-model default versus Enterprise enforcement; do not expand to all closed-model/third-party offerings. Enterprise policy activation, prior stored data, logging opt-ins, endpoint, model, region, metadata duration and legal/abuse exception duration remain unverified. Enabling the provider policy does not itself delete old stored content. Connected MCP/search/other third parties have separate handling. No Zalmir `store` setting or enforcement is asserted.

xAI

Provider ID: xai

According to xAI's API Security FAQ, API inputs and outputs are not used for training without explicit permission, and requests and responses are stored for 30 days by default for suspected-abuse or misuse auditing. The FAQ describes optional team-wide Zero Data Retention that avoids persisting prompt/response content to disk, while administrative audit logs remain and stateful or stored-content features are unavailable. Availability and negotiated enterprise agreements can change the applicable retention arrangement, and the global API endpoint does not guarantee a processing region. We have not verified your team's settings or the full enterprise terms' retention exceptions; review the linked API FAQ and enterprise terms.

Source text last verified: Nov 1, 2026. Account settings and live handling not verified.

API FAQ source text last verified: Nov 1, 2026. Full enterprise retention exceptions: not verified; retrieval attempted Nov 1, 2026.

Primary sources

Scope and unknowns

API FAQ, not Grok consumer/Build-mode policy. Registry display name remains xAI despite retrieved pages using “SpaceXSI”; no corporate relationship inferred. Team-level ZDR availability/state, training permission, per-key flags, stored-feature/metadata retention and negotiated terms remain unknown. Full legal/safety/abuse retention exceptions are an explicit fallback, not silently supplied. Global endpoint and limited US regional alternative do not prove actual routing.

Baseten

Provider ID: baseten

Baseten says it processes customer content to run inference workloads, does not use that content for model training or fine-tuning, and does not persist Model API inputs or outputs after real-time processing. Its security practices qualify retention commitments for customer configurations, selected software, enabled logging or abuse monitoring, third-party products, and written directions. Asynchronous inference can queue inputs for up to 72 hours before processing and deletion, and security audit logs have separate retention of up to four years. We have not verified your product, configuration, agreement, or region; review Baseten's linked security practices and terms.

Source text last verified: Nov 1, 2026. Account settings and live handling not verified.

Primary sources

Scope and unknowns

Model APIs, Dedicated Inference and asynchronous processing are distinct from training/weight storage and self-hosted/hybrid features. The 72-hour queue is not synchronous content retention; four years concerns security audit logs, not all prompts. Actual path, software, logging/abuse settings, Order/written directions, region, third-party terms and other telemetry/artifact lifecycles remain unverified. Customer-requested training is not assumed ordinary inference consent.

Moonshot AI (Kimi)

Provider ID: moonshot

Moonshot AI's Kimi OpenPlatform terms allow use of API inputs and outputs to provide, develop, improve and secure the service, and direct customers seeking training or model-improvement restrictions to enterprise or written arrangements. Its API help page says API data is not used for training, but that conflicts with the broader platform terms and privacy wording, so we cannot confirm a universal no-training policy for your account. Its enterprise Zero Data Retention guide describes deleting supported request content when the response is returned, subject to law, while excluding batch jobs, directly uploaded images/videos, operational records and third-party services. Outside a verified arrangement, no fixed API prompt/response retention period is established here; review the linked terms, privacy policy and enterprise guide.

Source text last verified: Nov 1, 2026. Account settings and live handling not verified.

Primary sources

Scope and unknowns

International business/developer Kimi OpenPlatform, not mainland consumer Kimi chat. Enterprise ZDR is on request/evaluation, not standard-account default. Conflicting S1/S2 and S4 training statements remain unresolved for the actual account. S3's automated safety reviews still apply; ZDR does not disable usage safeguards. Ordinary retention, legal/security record duration, actual arrangement/settings and applicable routing remain unknown; Singapore personal-data storage does not establish all inference location. No invented training toggle.

Anthropic

Provider ID: anthropic

Anthropic says commercial API inputs and outputs are not used for model training by default, but feedback or other permission can allow training use. It says standard API inputs and outputs are deleted within 30 days, with exceptions for longer-lived features, different agreements, law and Usage Policy enforcement; flagged content can be retained for up to two years and safety classification scores for up to seven years. Zero-retention arrangements require approval, retain safety classifier results and have product and Covered Model exceptions, so no account-wide zero-retention guarantee is established here.

Source text last verified: Nov 1, 2026. Account settings and live handling not verified.

Primary sources

Scope and unknowns

Direct commercial API, not consumer Claude sign-ins or other cloud hosts. Actual agreement, feedback permission, eligible API/model, Covered Model notice, organization approval and region remain unknown. Feedback data can have five-year retention (A1/A2); Files API, legal/anti-misuse retention and contract-permitted anonymization mean standard 30 days is not an all-data maximum. The founder's consumer improvement choice does not establish API settings or intermediary rights.

Nebius Token Factory

Provider ID: nebius

Nebius Token Factory's guide and Nebius Inc. Data Processing Agreement describe no model training or improvement except customer-requested training, but its Supplemental Terms also permit training smaller speculative-decoding models subject to the DPA, so we cannot confirm a universal no-training rule for your account. Its current documentation describes retaining inputs and outputs for speculative decoding by default and organization-level Zero Data Retention for supported chat-completion content, excluding metadata, observability data and other feature-specific storage. Data Lab separately describes retaining raw completions for one year and datasets until deleted; its processing is in Finland, while public inference endpoints do not guarantee a processing region. We have not verified your account's contracting entity, agreement, retention settings or enabled features; review the applicable Supplemental Terms, DPA and product policies.

Source text last verified: Nov 1, 2026. Account settings and live handling not verified.

Primary sources

Scope and unknowns

S1 is nonbinding; S2 is Nebius Inc.'s DPA, not proven applicable to every entity. Training tension remains explicit, including S6's “subject to DPA” qualifier; no legal precedence/entity determination is made. Supported chat-completion ZDR is not all-feature/all-metadata ZDR; deletions do not individually purge backups. Data Lab's one-year raw-completion schedule is not the ordinary API lifetime. Account entity/agreement, legacy reserve status, feature use, non-ZDR content duration, metadata/security/backup duration and actual region/settings remain unverified.

DeepInfra

Provider ID: deepinfra

DeepInfra says it processes API content to provide inference and does not use Customer Data to train or improve models except as necessary to provide the service, such as customer-requested fine-tuning. Its terms describe zero data retention for DeepInfra-hosted models, with exceptions for authorized support, operational metadata, legal/security/abuse records, and elected features such as batch, media outputs and paid cache retention. Third-party models have separate provider terms; DeepInfra's API privacy documentation specifically identifies Google and Anthropic exceptions.

Source text last verified: Nov 1, 2026. Account settings and live handling not verified.

Primary sources

Scope and unknowns

DeepInfra-hosted models versus third-party routes under §18; standard inference versus elected batch/media/cache, GPU/agent features. Actual agreement/Order/DPA, selected model host, support permission, numeric feature/log/abuse retention and region remain unknown. Support data at written request can be held until deletion within 30 days after issue resolution (§7(b)); narrow in-memory/no-content-log docs do not erase contractual exceptions. No unconditional zero-retention/no-human-access or key-transfer permission is established.

Groq

Provider ID: groq

Groq says it processes inputs and outputs to provide GroqCloud and does not use them for model training or fine-tuning unless the customer explicitly permits or instructs it. Groq says inference content is not retained by default, but reliability or suspected-abuse logs may contain inputs and outputs for up to 30 days, or longer if legally required. Groq retains usage metadata separately; batch files are retained for 30 days unless deleted earlier, and fine-tuning data is retained until deleted. Groq documents organization-level or per-feature zero-data-retention controls, but their activation for your account is not verified here; retained customer data is stored in the United States.

Source text last verified: Nov 1, 2026. Account settings and live handling not verified.

Primary sources

Scope and unknowns

GroqCloud developer/business API, not consumer chat; offline agreement may govern. G1 describes controls for all customers but G2 specifies eligible customers, so contractual eligibility is not assumed. Actual permissions/settings, model conditions, legal preservation duration and metadata-deletion schedule remain unverified. US retained-data storage is not proof of all inference location.

Novita AI

Provider ID: novita

Novita AI's service terms cover AI inference APIs and permit it to reproduce, view and use inputs and outputs to provide the service. Novita states that, by default, it will not use that content to train its own models or improve the services, and describes a qualified “Zero Data Retention” policy: no content logging for human review or retention beyond generating and delivering output, unless required by law or necessary to provide services or technical support. Novita reserves automated safety screening; these provider statements do not establish an unconditional no-access or zero-retention guarantee, a numeric exception-retention period, or the settings and upstream processing applicable to your account.

Source text last verified: Nov 1, 2026. Account settings and live handling not verified.

Primary sources

Scope and unknowns

N2 covers inference APIs and defines both Input/Output as Content. N1 excludes customer-processed content; its personal-information statement cannot replace the API terms. Own-model/default training limit does not independently establish upstream handling. Numeric law/service/support exception retention, operational/abuse detail beyond screening, opt-ins, deletion, selected host/model, region and contract deviations remain unknown. License expressly permits viewing; no no-access or industry-specific compliance claim is made.

Google Gemini (OpenAI endpoint)

Provider ID: gemini

Google's Gemini API terms distinguish unpaid from paid services: unpaid inputs and outputs may be used to improve Google's products and machine-learning technologies, and human reviewers may process them, so Google warns against submitting sensitive, confidential or personal information. For paid services, Google says prompts and responses are not used to improve its products, but content is logged for a limited period for abuse prevention and required legal or regulatory disclosures. API paid status depends on using a Cloud project with active billing, and the terms apply paid-service data-use rules to all services in the EEA, Switzerland and UK; feature-specific terms and international processing still apply.

Source text last verified: Nov 1, 2026. Account settings and live handling not verified.

Primary sources

Scope and unknowns

Gemini developer API/AI Studio, including the registry's OpenAI-compatible endpoint label, not consumer Gemini or Vertex Cloud. Region-specific data-use treatment is not data residency; the requirement to use paid services for API clients available to EEA/Switzerland/UK users is distinct. Actual project billing, location/entitlement, abuse-log duration beyond “limited period,” feature settings, optional choices and routing remain unknown. Grounding/tuning/cache exceptions matter; Maps grounding's 30 days is not every API's retention period. Age/business/deployment eligibility remains a separate professional-review question.

Mistral

Provider ID: mistral

Mistral's commercial terms permit processing customer data and outputs to provide, maintain and optimize its products, including debugging. Those terms allow model training in specified circumstances, including product training preferences, feedback, order-form terms and Labs or Preview Models; do not assume all API traffic is excluded from training. Mistral says zero data retention requires approval, is available only with pay-as-you-go for supported stateless API endpoints, and excludes stateful products such as agents, files and batch processing. Training opt-out and zero data retention are separate controls; your API settings, contract, applicable default retention and processing region have not been verified here.

Source text last verified: Nov 1, 2026. Account settings and live handling not verified.

Primary sources

Scope and unknowns

Commercial Studio/API and contractual product distinctions. Approved pay-as-you-go ZDR covers supported stateless APIs, not agents/files/batch. M2 excludes business processor use, so its 30-day abuse rule cannot establish every business customer's contractual retention. M5's agreement-duration criterion is not a request-log schedule. Actual product training default/toggle, Labs/Preview status, order form, approval, regional processing and business retention/log/legal-preservation schedule remain unknown.

Perplexity (Orchestrator)

Provider ID: perplexity

Perplexity says its API platform processes customer content to provide the requested service and, under its API terms, does not use that content to train generative AI models, subject to product-specific terms. Perplexity says zero data retention is not the default: it requires an eligible account, written agreement and account-level configuration, and not every model supports it. Third-party model terms may require limited retention, and Perplexity collects usage and account metadata to operate and bill its API. Search Services have separate terms allowing retention and use of Search Data for lawful business purposes, including product development; the reviewed material does not establish a single retention or abuse-log duration for all APIs.

Source text last verified: Nov 1, 2026. Account settings and live handling not verified.

Primary sources

Scope and unknowns

Registry name Orchestrator is not technical availability or proof that legacy Sonar/Agentic Research contract promises cover every Orchestrator model. P1 defers to actual contract/product/model terms. Search `/search` is a separate service; no chat policy or other product's ZDR is silently transferred. Actual Orchestrator contract, upstream provider/model, ordinary content/abuse/legal/metadata retention, approval/settings and region remain unverified. P3 is a third-party terms directory, not verification of every linked contract.

Featherless AI

Provider ID: featherless

Featherless AI says chats, prompts and completions sent through its API are processed in real time without being logged or stored on its servers. Its privacy policy says it collects account and payment details, model-usage counts and token volumes, and may store sampler settings. The reviewed API and privacy pages do not establish an explicit model-training policy or detailed abuse, legal-retention or regional exceptions; review the linked policies before sending sensitive content.

Source text last verified: Nov 1, 2026. Account settings and live handling not verified.

Primary sources

Scope and unknowns

F1 expressly covers API, not solely chat. No contract/plan/model/region was checked. Explicit API-content training clause, detailed abuse/legal/caching/operator-access rules and metadata-deletion schedule remain unknown. Trust Center production-development/debugging controls do not fill those gaps. Non-storage does not establish a separate no-training or operator-inaccessibility guarantee.

Chutes

Provider ID: chutes

Chutes says public LLM API models hosted by its system user do not log or persist prompt or response content, although standard API mode may read request bodies transiently in memory to route and execute requests. Chutes says it computes short-lived prompt-prefix hashes and collects operational and billing metadata, with ephemeral IP processing for rate limiting and abuse prevention. Its first-party applications may store content for application functionality, while private or user-created chutes run third-party code whose data handling Chutes does not guarantee. The reviewed policy's explicit no-training statement concerns stored application content; it does not establish a separate API-wide training commitment or fixed metadata-deletion period.

Source text last verified: Nov 1, 2026. Account settings and live handling not verified.

Primary sources

Scope and unknowns

Only public LLM models hosted by the Chutes system user for the no-content-logging statement. Standard API is not automatically optional E2E/TEE mode. Actual prospective route/model, explicit API-wide training commitment, numeric hash/metadata/log deletion, detailed content legal/abuse exceptions, contract and region remain unverified. C1 separately retains metadata for operation/support/security/law/financial records. No attestation, cryptographic enforcement, seller blindness or no-operator-access guarantee is established.

Parasail

Provider ID: parasail

Parasail says it uses customer inputs and outputs to provide inference and does not use that content to train its own models or improve its platform; its security overview says optional model-training use requires explicit customer agreement. For serverless and dedicated services, Parasail's terms say content is retained only long enough to generate and deliver output and is not inspected without permission, while masked prompt and usage metadata may be inspected for service delivery or support. Batch inputs and outputs are generally stored for 30 days, with timing that may vary. Parasail also collects operational metadata, and its privacy policy permits personal-data preservation for legal, security and enforcement purposes with variable retention periods. Your applicable model terms, processing region, metadata-deletion schedule and customer-specific arrangements have not been verified here.

Source text last verified: Nov 1, 2026. Account settings and live handling not verified.

Primary sources

Scope and unknowns

On-demand inference, differentiated serverless/dedicated/batch. PA3 §8 permits access/disclosure/preservation for law, security, wrongdoing, rights and enforcement; §9 allows US/EU/other-country facilities, not a selected inference region. Section 10 gives variable purpose/legal retention and separately serverless/dedicated input handling versus generally 30-day batch input. These general personal-data rules do not establish a single prompt lifetime or resolve legal hierarchy with PA1. Exact batch timing, metadata/security-log deletion, model EULA/upstream terms, optional training agreement, actual region and customer agreement remain unverified.