Privacy policy
Creekside Compute operates an inference API for open-weight language models. Requests reach us either directly, with an API key bought on our site or issued under a direct agreement, or through a marketplace such as OpenRouter, Poe, NanoGPT, Hugging Face or Vercel. We are an independent controller for the operational data described here and a processor for the content you send.
This policy is issued by Creekside Compute Inc., based in Ontario, Canada. It covers the API at api.creeksidecompute.ai and traffic that reaches us through a marketplace.
Zero data retention
We do not retain your prompts, responses or input files as conversation records, application logs, backups or training datasets. We do not use this content for model training, sale or licensing. Temporary inference caching and request processing, described below, are used only to provide the service. Zero data retention is the only tier we offer, for every new API key and every marketplace route; any stricter customer or marketplace agreement continues to apply.
Temporary processing and caching
Serving a request requires temporary access to its content. To avoid repeating expensive prompt processing, we may keep model working state, including attention key/value (KV) caches, for reuse by follow-up requests. Cache storage may use GPU memory, host RAM or temporary local storage where the applicable customer and marketplace terms permit it. This is an inference cache, not a conversation archive; cached state is sensitive data and is not used for training, sale or licensing. Entries are removed when evicted or expired, and working state is discarded when its serving instance is released.
Customer-content disk caching is not currently enabled. Before enabling it, we require verified isolation, encryption, expiry and deletion controls, and confirmation that the applicable customer and marketplace terms permit that storage. Updating this policy does not override an existing memory-only or no-disk agreement.
If you send an Idempotency-Key header, we hold the response in gateway memory for up to ten minutes so a retry after a dropped connection can return the same answer. For routing affinity, we keep a short digest of a conversation's opening, its serving worker and usage metadata; the digest does not contain the prompt text, but can be matched by someone who already knows the exact opening. This size-bounded routing map may be saved in private cloud storage across gateway restarts. It has no fixed per-entry time limit and older entries are removed as the map fills. It is not a saved conversation.
The retention header
x-creekside-retention: none on a request guarantees that its content is never stored, whatever the key says. Requests on partner accounts and on keys locked to zero retention are never stored, whatever a header says. The header does not disable the temporary processing and caching described above.
What we always keep
For every request: a request id, the API key id, timestamps, the model, the request's settings and size (such as whether it streamed, whether it asked for tools, JSON output or reasoning, and how many messages it held), token counts (prompt, completion, cached), its cost, latency, the server that served it, and status or error codes. No content. Retained for 13 months for billing, abuse prevention, and capacity planning.
Where processing happens
Requests are processed on rented GPU servers in the United States and in other countries. GET /v1/models lists the countries each model runs in. Content reaches them over an encrypted connection, and the same zero-retention rules apply in every country. Rented servers are not under our physical control; no confidential-computing or cryptographic exclusion of host operators is claimed. Account records are stored in Google Cloud in the United States.
Your rights
- Deletion on request. Zero-retention traffic has no conversation archive; temporary caches and operational metadata are handled as described above. Content stored under the retained option we offered earlier, for a key or request that chose it, is deleted within 7 days of a verified request to the address below.
- Access and export. On request, we provide the operational records associated with your key.
- Breach notice. We notify affected customers within 48 hours of confirming a breach involving their data.
Direct accounts
When you buy credit and make keys on our site, we keep:
| What | Why | How long |
|---|---|---|
| Your email address | Signing you in, and contacting you about your account | While the account is open; removed when it closes |
| Your account's credit, spending and limits | Billing | While the account is open |
| Payment records: amount, date and the processor's payment id | Accounting and tax | Six years, as Canada's revenue agency expects business records to be kept |
| Key names, the first and last few characters of each key, and a one-way hash of it; never the key itself | Recognising your requests | Until the key is deleted or the account closes |
| Your acceptance of the terms, and that you are 18 or over | Evidence of the agreement | As long as the payment records |
Card details go directly to Stripe, our payment processor, and never reach us. Sign-in emails are sent through Google Identity Platform. Account records are stored in Google Cloud in the United States. The account page uses no advertising or tracking cookies; your browser keeps your sign-in, and your email address while you wait for the link.
We count visits to our website with Cloudflare Web Analytics, which sets no cookies and builds no profile of a visitor. Cloudflare sees the page address, the referring site, the browser and device type, the country, and how long the page took to load.
Waitlist
When you join the waitlist for a model that is coming soon, you need no account, and we keep:
| What | Why | How long |
|---|---|---|
| Your email address, the models you picked, and any other model you named | To send you one email for each model you picked, when it goes live | Until we have sent that email for every model you picked, or 12 months after you last joined, whichever comes first |
| The sentence you agreed to, and when you agreed | Evidence that you asked for the email | As long as your email address |
Each email says how to be removed. Reply to it, or write to the address below at any time, and we delete your entry sooner. The waitlist is never sold or shared. It is stored in Google Cloud in the United States, with the account records, and joining it sets no cookie.
Marketplaces
When you reach us through a marketplace, that marketplace is the controller of your account and payment data; we receive only the request content and, where the marketplace provides one, an anonymised user id. Poe informs its users that API bots may store conversations; our Poe bot runs with zero data retention.
Changes
We post changes on this page with a new effective date.
How to reach us
Write to [email protected] for deletion or access requests, breach questions, or anything else about how Creekside Compute handles your data.