Privacy Policy
Who we are
This policy covers the website cifund.xyz and the inference API at api.cifund.xyz (together, the "Service"), operated by Creative Insight Quant Trading Ltd, an International Business Company registered in the Republic of Seychelles under IBC No. 251741 ("CIFUND", "we", "us"). Contact: will@cifund.xyz.
Requests that reach us through a routing partner
Most API traffic reaches us through model routers such as OpenRouter. In that case the router is our customer: it holds the relationship with the end user and decides what it sends us, and we process each request only on its behalf, to return the requested completion. We do not receive end users' names or account details. Questions about an individual's data should go to the router first; we will assist it as needed.
What we do with prompts and completions (zero data retention)
- Prompts, inputs and generated completions are processed in memory on our GPU server in Goiânia, Brazil, only to produce the response.
- They are never logged, written to disk, stored, sold, shared, or used to train or improve any model.
- The inference engine keeps two caches, both in memory only, never written to persistent storage, and evicted automatically: recently processed prompt prefixes in GPU memory, which speed up repeated prompts, and compiled structured-output grammars (built from the JSON schemas callers send) in RAM.
Request metadata
For each API request we record operational metadata: timestamp, request identifier, endpoint, model, whether the response was streamed, token counts (prompt, cached prompt, completion), timings, response status, finish or error reason and the resulting charge. Our servers also keep operational logs of the inference engine and the TLS front end (start-up, throughput, errors) without request content or caller details. We use these for billing, capacity planning, abuse prevention and reliability, and delete them after 30 days. None of them contains request content.
Access records
Brazil's Marco Civil da Internet (Law 12.965/2014, art. 15) requires application providers to keep access records. For each request to our completion endpoints (/v1/chat/completions and /v1/completions), including rejected ones, we therefore keep the date and time, the network address of the system that called us (for routed traffic this is the router's server, not the end user's device), the request identifier and the endpoint, for 6 months, under restricted access, and then delete them, unless a Brazilian police or administrative authority or the Public Prosecutor's Office (Ministério Público) asks us to keep them longer, as art. 15 §2 allows. We disclose them only under a court order.
Website
The website is static. It sets no cookies and uses no analytics or advertising trackers. It is hosted on Amazon Web Services, whose edge network processes visitors' IP addresses to deliver pages, and the home page loads fonts from Google Fonts, which receives the visitor's IP address when the fonts are fetched.
Mail to our contact address is received by Amazon Web Services, which keeps the raw message for up to 90 days, and forwarded to a Google (Gmail) mailbox. If you write to us, we keep the correspondence as long as needed to handle your request and our business records.
Service providers and locations
- GPU inference: our own server in Brazil.
- Amazon Web Services (United States, with CloudFront edge locations worldwide): website hosting, DNS, inbound email, and the network edge for the API endpoint.
- Google (United States): mailbox for forwarded email.
Requests may originate anywhere in the world and are processed in Brazil. Where personal data is involved, we handle international transfers in line with Brazil's General Data Protection Law (LGPD) and other laws that apply.
Security
API traffic is encrypted with TLS on every hop: from the caller to our network edge (Amazon CloudFront, which decrypts requests in memory only to route them, without logging or caching them) and again from the edge to our server. The website is served over HTTPS. API access requires a secret key. The inference engine listens only on the server's local interface, so it is reachable only through our gateway, and administrative access is restricted to authorized personnel.
Your rights
Depending on where you live, including under the LGPD and the GDPR, you may have the right to access, correct, delete, or port personal data, to object to or restrict processing, and to complain to a data-protection authority. Because we do not keep request content, we usually hold no personal data about API end users beyond the metadata and access records above. To exercise a right, email will@cifund.xyz.
Children
The Service is offered to businesses and is not directed to children.
Changes
We will post any change to this policy on this page and update the effective date above.
13 October 2026: added access records and Google as email processor; described the metadata we record, the engine's in-memory caches, operational logs, email retention and TLS at the network edge.