Legal · Privacy policy
Privacy Policy
Last updated: September 24, 2026.
This Privacy Policy explains how Spinf Inc. ("spinf", "we", "us") collects, uses, shares and protects personal data when you use the spinf website, the console and the spinf API (together, the "Service"). It also explains your privacy rights and how the law protects you. Capitalized terms not defined here have the meaning given in our Terms of Service.
Summary
- We collect what we need to run your account: your email and name from sign-in, your organization name, your billing records and the usage of your API keys.
- The content you send to be scored is not stored by default, and it is never used to train models. It is processed to compute your scores and then discarded. Our logs keep token counts only.
- We do not sell your personal data. We measure how our website is used with Google Tag Manager and Google Analytics; we do not use it for advertising.
- Card payments are handled by our payment provider, and we never see your full card number.
- You can ask us at any time to access, correct, export or delete your data: support@spinf.com.
1. Who we are
The data controller for the personal data described in this policy is Spinf Inc., 535 Paris St, San Francisco, CA 94112, United States (support@spinf.com). In this policy, "you" means the person who uses the Service, or the organization that person represents, as applicable. Under the GDPR you are the "data subject".
Content you send to be scored is different. Messages, inputs, templates, options, images and audio are Customer Content. If they include personal data about other people, you decide what is sent and why. For that data you are the controller (a "business" under the CCPA), and we are your processor (a "service provider"). We process it only on your instructions, as described in section 3. A data processing agreement is available on request.
2. Personal data we collect
Account data
- When you sign in: your email address, your name and profile picture if your sign-in method provides them, and the user identifier of our sign-in service. Your password, if you use one, is managed by the sign-in service, and we never see it.
- The organization name you give us, your role in the Account, and when the Account was created.
Billing data
- The history of your Credit purchases, refunds and adjustments, and your balance.
- Our payment provider's customer identifier and a summary of your payment method, such as the card brand, the last four digits and the expiry date. The full card number and security code go directly to the payment provider.
- Invoices and the billing details the payment provider collects, such as a billing address when taxes require it.
API keys
The name of each key, its prefix and last four characters, when it was created, last used, revoked or set to expire, and who created it. We keep only a one-way hash of the key itself, so we cannot show it again.
Usage data
- For each API call: a request identifier, the time, the model, the token counts, the cost and the result status, kept as per-account counters and daily and monthly totals.
- Recent activity used for real-time statistics and limits, such as calls in progress and requests per minute.
- A record of the administrative changes our staff make to your Account.
Technical data
To deliver and protect the Service, our hosting, network and sign-in providers process technical data such as your IP address, browser type and the time of each request. Our sign-in service keeps logs of sign-ins, including IP addresses, for security. We do not use this data to build profiles of you.
Communications
If you write to us, we keep your messages and our replies to handle your request and improve our support.
3. Content you send to be scored
- Processed, not stored. Customer Content is sent over an encrypted connection and processed in memory to compute your scores. It is then discarded. It is not written to our databases or logs: our logs keep token counts only. If you agree with us in writing to retain content, for example for a private deployment, we keep it only for the agreed period.
- Compute providers. To compute scores, Customer Content is sent to the GPU servers that run our models. They may be operated by our compute providers, who process it only transiently and only on our instructions.
- No training. We do not use Customer Content or its Output to train or improve models, and we do not look at it.
- Images and audio (a preview feature) are processed the same way. We do not extract biometric identifiers from them.
4. How we use personal data, and our legal bases
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Provide the Service: sign-in, the console, API keys, scoring your calls | account, API key, usage and technical data | performance of our contract with you |
| Charge calls, sell Credit, issue invoices, keep accounting records | billing and usage data | contract; legal obligation |
| Enforce limits; prevent fraud, abuse and misuse of free credit; keep the Service secure | usage, technical and account data | our legitimate interests in a secure and fair Service |
| Send service messages: security alerts, low balance, changes to the Service or these policies | account data | contract; legitimate interests |
| Answer your requests and give support | account data, communications, and usage data as needed | contract; legitimate interests |
| Understand and improve the Service, using aggregated usage metrics (never Customer Content) | usage data | legitimate interests |
| Measure and improve the website with analytics (section 5) | website analytics data | consent where required; otherwise legitimate interests |
| Send news about spinf, if you agree or where the law allows; you can opt out at any time | email address | consent, or legitimate interests where allowed |
| Comply with the law, respond to lawful requests, and establish or defend legal claims | any of the above, as needed | legal obligation; legitimate interests |
We do not use personal data for purposes that are unrelated to, or incompatible with, those listed above without telling you first. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
5. Cookies and similar technologies
We do not use advertising cookies or social media pixels.
- Sign-in. Our sign-in service sets cookies on its own login pages to keep you signed in and protect your account. The website keeps your sign-in session in your browser's storage. They are strictly necessary: without them, you cannot sign in.
- Preferences. The website remembers settings such as light or dark mode in your browser's storage.
- Analytics. The website uses Google Tag Manager, which loads Google Analytics (both by Google LLC). They set cookies and collect data such as the pages you visit, how you reach them, your browser and device, and your approximate location derived from your IP address. We use this data only to understand how the website is used and to improve it, not for advertising. Google processes it in the United States, under its own privacy policy. You can opt out with Google's browser add-on, or by blocking these cookies in your browser.
You can block or delete cookies in your browser settings. Blocking the analytics cookies has no effect on the Service, but without the sign-in cookies you cannot sign in. The Service does not respond to "Do Not Track" signals.
6. Who we share personal data with
We do not sell personal data, and we do not share it for cross-context behavioral advertising. We share it only with:
-
Service providers that process it on our behalf, under contracts that require them to protect it and use it only to provide their services to us:
- cloud hosting and content delivery (Amazon Web Services);
- sign-in and user management (Auth0, by Okta);
- payment processing and invoicing (Stripe);
- website analytics (Google, see section 5);
- GPU compute providers, for Customer Content only (see section 3);
- email delivery and support tools.
We can give you the current list of our subprocessors on request.
-
Business transfers. If we are involved in a merger, acquisition, financing or sale of assets, personal data may be transferred as part of it. We will tell you before your data becomes subject to a different privacy policy.
-
Legal requirements. We may disclose personal data if the law, a court order or a valid request from a public authority requires it. We may also disclose it when we believe in good faith that this is necessary to protect the rights, property or safety of spinf, our users or the public, or to investigate fraud or security issues.
-
With your consent, or at your direction.
7. International transfers
We are based in the United States, and the Service is hosted in the United States. If you use the Service from outside the United States, your personal data is transferred to the United States, where data protection laws may differ from those of your country. For transfers from the European Economic Area, the United Kingdom and Switzerland, we rely on the European Commission's Standard Contractual Clauses (and their UK and Swiss equivalents), or on another lawful transfer mechanism.
8. How long we keep personal data
| Data | Kept |
|---|---|
| Customer Content | not stored (only during processing), unless agreed otherwise in writing |
| Account data and API key records | while your Account is open; deleted within 90 days after it is closed |
| Billing records: purchases, invoices, the ledger of charges | as long as tax and accounting laws require (generally up to 7 years) |
| Usage totals per account and day | with the billing records they support |
| Application logs (token counts and errors, no content) | 30 days |
| Records of repeated requests (idempotency) | 24 hours |
| Support communications | up to 3 years after the last message |
We may keep data longer when the law requires it, or to establish or defend legal claims. When a retention period ends, the data is deleted or anonymized. Deleted data may remain in encrypted backups for a limited time, until they are overwritten. After deletion, your rights of access, erasure, rectification and portability can no longer be exercised for that data.
9. Security
We protect personal data with technical and organizational measures appropriate to the risk:
- encryption in transit (TLS) and at rest;
- API keys stored only as one-way hashes;
- access limited to authorized staff who need it, with strong authentication and a log of administrative actions;
- isolated networks for our databases and caches.
No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your personal data, we will notify you and the authorities as the law requires.
10. Your rights
Depending on where you live, you may have the right to:
- access your personal data and receive a copy;
- correct inaccurate or incomplete data;
- delete your data, when there is no good reason for us to keep it;
- restrict the processing of your data;
- object to processing based on our legitimate interests, and at any time to direct marketing;
- receive your data in a structured, commonly used, machine-readable format, and have it sent to another provider (portability);
- withdraw your consent at any time, where processing is based on consent, without affecting the processing done before;
- complain to a data protection authority, in particular in the country where you live or work.
You can see and update much of your data in the Console. For everything else, including closing your Account and deleting its data, write to support@spinf.com. We may ask you to verify your identity first. We answer within one month, and may extend this by two further months for complex requests, in which case we will tell you. Exercising your rights is free.
If your request is about Customer Content that one of our customers sent us, please contact that customer: they control that data, and we will help them answer you.
11. California residents
This section applies to California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the "CCPA").
Categories of personal information
In the last 12 months we have collected the following categories of personal information:
| Category | Examples | Collected |
|---|---|---|
| A. Identifiers | name, email address, account and user identifiers, IP address | Yes |
| B. Customer records (Cal. Civ. Code § 1798.80(e)) | name, billing details; card data is held by our payment provider | Yes |
| C. Protected classification characteristics | age, race, sex, religion | No |
| D. Commercial information | Credit purchases and billing history | Yes |
| E. Biometric information | fingerprints, faceprints, voiceprints | No |
| F. Internet or other network activity | API calls, use of the console and the website, sign-in logs | Yes |
| G. Geolocation data | precise location | No |
| H. Sensory data | audio or images | No (only as Customer Content, processed and not stored) |
| I. Professional or employment information | job history | No |
| J. Non-public education information | education records | No |
| K. Inferences | profiles about preferences or characteristics | No |
| L. Sensitive personal information | account login credentials | Yes (used only to sign you in) |
We collect this information from you directly, automatically when you use the Service, and from our service providers (for example, the sign-in and payment providers). We use it for the business purposes described in section 4. We disclose it to the categories of recipients listed in section 6 for those purposes, and we keep it for the periods listed in section 8.
We do not sell or share personal information (as the CCPA defines these terms), including the personal information of consumers under 16. We use sensitive personal information only as needed to provide the Service.
Your rights under the CCPA
- Right to know the categories and specific pieces of personal information we collect, its sources, our purposes, and the categories of third parties we disclose it to.
- Right to delete your personal information, with the exceptions the law allows. For example, we may keep records needed to complete transactions, detect security incidents and fraud, fix errors, or comply with a legal obligation.
- Right to correct inaccurate personal information.
- Right to opt out of the sale or sharing of personal information. We do not sell or share it.
- Right to limit the use of sensitive personal information. We use it only as the CCPA permits.
- Right not to be discriminated against for exercising your rights. We will not deny you the Service, charge you different prices, or give you a different level of service because you exercised them.
To exercise your rights, write to support@spinf.com. You can also have an authorized agent make the request for you, with your written permission. We will verify the request by matching it with the information in your Account. We respond within 45 days. We may extend this once by another 45 days when reasonably necessary, and we will tell you if we do. Our disclosures cover the 12 months before the request, unless you ask for a longer period and the law allows it.
Shine the Light. We do not disclose personal information to third parties for their direct marketing purposes.
12. Children
The Service is for adults only and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe that a child has given us personal data, contact us and we will delete it.
13. Links to other websites
The Service may link to other websites and services, such as the pages of our sign-in and payment providers. Their own privacy policies apply, and we encourage you to read them.
14. Changes to this policy
We may update this policy. We will publish the new version on this page with a new date. If a change is material, we will notify you by email or in the Console before it takes effect. If a change would allow us to disclose personal data that you asked us not to disclose, we will ask for your consent first.
15. Contact
For any question or request about privacy, write to support@spinf.com, or to Spinf Inc., 535 Paris St, San Francisco, CA 94112, United States.