Privacy Notice

Open LLMs is operated by an unregistered sole proprietorship operated by an individual in India. The operator is an individual and not a registered company or other body corporate, and therefore holds no corporate identity number. In the vocabulary of the Digital Personal Data Protection Act, 2023, the operator is the Data Fiduciary for the personal data described in this notice, and you are the Data Principal.

The operator determines the purposes for which your personal data is processed and is the agency that both collects and retains it. The details below are published under Rule 3(2)(a) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, Rule 5(9) of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and Rule 4(3) and Rule 4(5) of the Consumer Protection (E-Commerce) Rules, 2020.

Legal form

Unregistered sole proprietorship operated by an individual in India. Not a company or other body corporate, and it holds no corporate identity number.

Data-protection questions

[email protected]. This person answers questions about how your personal data is processed. We are not a Significant Data Fiduciary and do not employ a statutory Data Protection Officer.

Complaint timelines

Acknowledged within 24 hours. Resolved within 15 days.

Minimum age

18. Clause 12 states our position on children’s data.

Where a fact is missing above, it has not been settled yet and is omitted rather than guessed. Use the privacy request form to reach the Grievance Officer; it is the channel we monitor.

This is the itemised notice. Each row names the personal data in that category, the specified purpose it is processed for, and how long it is kept. We do not collect personal data beyond what these purposes need.

Under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, “sensitive personal data or information” includes passwords, financial information such as card or bank details, health information, biometric information and sexual orientation. Of these, we hold none directly: sign-in uses Google, GitHub or a one-time code by email rather than a password, and payment-instrument details are entered in the payment provider’s own checkout. You may nonetheless place any of those things inside a prompt, which is why clause 4 matters.

Do not send protected health information, cardholder data, or government identity numbers through the API. We hold no certification that would make us a suitable place for them.

This clause is the one most people came here for, so it states the whole path a prompt takes, including the parts that are not flattering.

1. The model sees it. When you call the API, your request — the prompt text and any system or conversation messages you send with it — is transmitted to the model that serves it. Models run on hardware we rent: Amazon Web Services, and GPUs rented from Vast.ai. Your prompt and the model’s response are processed on that hardware.
2. Every request is written to an internal queue. For every API request, without exception and regardless of any setting you hold, our gateway writes the prompt text and the response text to an internal processing queue. The text is written exactly as sent, with no redaction at that stage. The queue is a Valkey cluster we operate in Amazon Web Services, Asia Pacific (Mumbai). It holds roughly the most recent 100,000 entries; older entries are dropped as new ones arrive.
3. That queue is not encrypted. It is encrypted neither in transit nor at rest, and the same cluster also carries session data and rate-limiting counters for this platform and for another project the operator runs. Access to it is restricted to named application security groups, and it is not reachable from the public internet. We state this because we will not describe our systems as encrypted where they are not.
4. A consumer process reads the queue. It records usage metadata — model, token counts, timing, cost — for every request. It writes prompt and response content to our database only where the account that made the request has switched on “store request payloads”. That setting is off by default. The check fails closed: where the setting cannot be read, the content is not written.
5. What is stored, when it is stored. For an account that has switched storage on, we store a redacted snapshot of the request and of the response, together with the source IP address and the user agent of the request. Redaction masks credential-shaped fields, bearer tokens, our own API-key prefixes, email addresses, and 13-to-16-digit card-number patterns. Everything else in the prompt and in the response is stored as you sent it. Each snapshot is capped at 16 KiB; text past the cap is discarded.
6. Stored snapshots are deleted after 14 days. A sweep runs every six hours and deletes snapshots captured more than 14 days earlier.
7. Switching the setting off deletes what was stored. Turning off “store request payloads” at /dashboard/settings deletes every snapshot already held for your account, immediately.
8. Who can read a stored snapshot. Our operators can read stored snapshots for any account, through an internal console, to investigate support requests and abuse. Those reads are permission-gated and recorded in an access log. You can read your own snapshots for requests made after you switched the setting on. We do not claim that no human can see your stored prompts; a human can.
9. What we do not do with it. We do not train, fine-tune or evaluate any model on the prompts you send to the API or on the responses returned to you, and we do not use them for advertising or share them with advertisers.

1. Google Analytics 4, operated by Google LLC, loads on every page of this website under measurement ID G-5CBFHNSE48. It records page views, traffic source, and device and browser characteristics.
2. Microsoft Clarity, operated by Microsoft Corporation, loads on every page under project ID xovktx38wg. Clarity records a replay of your visit — pointer movement, clicks, scrolling and page changes — and builds aggregate heatmaps from it. We have not configured Clarity’s text or input masking, so it runs with Microsoft’s defaults. Microsoft processes that data on its own systems and, on Microsoft’s terms, associates it with its own identifiers.
3. Both load before you sign in, on every public page, whether or not you hold an account.
4. There is no consent banner. We do not currently present a cookie or analytics consent prompt, and neither tool is gated on your consent. This is a statement of what happens today, not a description of what we think is ideal.
5. Error monitoring. This website sends browser error reports to Sentry and is configured to record a replay of approximately 10% of sessions and of every session in which an error occurs. In those replays all text is masked and all media is blocked.
6. Attribution cookies. On your first visit we set eight cookies — sa_ft, sa_landing, sa_ref, sa_utm_source, sa_utm_medium, sa_utm_campaign, sa_utm_term and sa_utm_content — recording where you arrived from. They last 180 days, are set on the .openllms.co domain, and are set while you are logged out. They are marketing-attribution cookies, not cookies necessary to deliver the site. If you create an account later, their values are copied onto your account record.
7. Cookie forwarding. Every cookie on the .openllms.co domain, including the analytics cookies, is sent to our authentication service at auth.openllms.co on each authentication call. That service is ours, not a third party.
8. How to stop it today. Block scripts and cookies from googletagmanager.com and clarity.ms in your browser or with a content blocker, and delete the sa_* cookies from your browser’s cookie settings. Doing so does not affect your ability to use the API.

The Cookie Policy lists every cookie this site and our own services set, with its purpose and duration.

This is the complete list of recipients of the personal data described in this notice. Each row states what that recipient can access and where it processes.

• Amazon Web Services — hosting, database, the queue described in clause 4, object storage, and transactional email, in Asia Pacific (Mumbai).
• Vast.ai — rented GPU hardware on which models run. Prompt text and model responses are processed on it. This is the vendor most people would want named, so it is named first among the ones that see prompt content.
• Cloudflare — authoritative DNS and the CDN in front of openllms.co, www and auth. It terminates TLS at edge locations outside India. The API host api.openllms.co is not proxied through it.
• Google LLC — Google Analytics, and Google sign-in if you use it.
• Microsoft Corporation — Microsoft Clarity, including the session replay described in clause 5.
• GitHub, Inc. — GitHub sign-in if you use it.
• Sentry — browser and server error reports, including the replays described in clause 5.
• New Relic — performance monitoring of our backend services.
• MongoDB Atlas — an archive of payment-provider webhook events.
• Hugging Face — the source we download model weights from. It receives no customer personal data and no prompt content.
• Your payment provider — we integrate Razorpay, Stripe and PayPal. The provider that handles a top-up is the one shown to you in the checkout, and it collects your payment-instrument details directly.

We do not transfer personal data to data brokers or advertising networks, and we do not disclose it to any recipient other than those listed above, except where we are required to do so by law or by a lawful order, or where it is necessary to establish, exercise or defend a legal claim.

Our own infrastructure runs in a single Amazon Web Services region, Asia Pacific (Mumbai), ap-south-1. Our databases, our queues, our object storage and our transactional email all run there.

Personal data is also processed outside India, in these specific ways: Cloudflare terminates TLS at edge locations worldwide; GPU capacity rented from Vast.ai runs on hosts the vendor selects, which are not necessarily in India; and Google, Microsoft, Sentry, New Relic and MongoDB Atlas process on their own infrastructure outside India.

Indian law permits transfer of personal data outside India except to a country or territory that the Central Government restricts by notification. No such notification has been issued. We make no claim that any destination country offers protection equivalent to India’s.

The retention column of the table in clause 3 states the period for each category. This clause states the rule behind it.

Three categories are deleted automatically. Stored prompt and response snapshots are deleted 14 days after capture. The detailed request-metrics table is deleted after 30 days. Per-API-key usage analytics are deleted after 30 days.

Every other category has no automatic deletion schedule. Account records, sign-in records, wallet and payment records, promotional-credit grants, API-key records, per-request usage records, support and privacy requests, and administrative access logs are retained until we erase them in response to a request under clause 10. That includes the record of an erasure request itself.

We erase personal data when you withdraw the consent it rests on, or when the purpose it was collected for is no longer being served, unless we are required to retain it by law or need it to establish, exercise or defend a legal claim. Where we keep something after an erasure request, we tell you what we kept and why.

The Third Schedule to the Digital Personal Data Protection Rules, 2025 imposes fixed retention caps on large e-commerce, social-media and gaming platforms. Those caps do not apply to us, and we do not claim that they do.

Where we ask for your consent, we ask for it free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the personal data necessary for the stated purpose. We do not pre-tick a consent control and we do not treat continued use of the site as consent.

What we ask consent for. Storage of prompt and response content, as described in clause 4. It is off by default. Switching it on is a deliberate action you take at /dashboard/settings.

How to withdraw it. Turn the same switch off. Withdrawal is exactly as easy as giving it, and it takes effect at once: processing of that content stops, and every snapshot already stored for your account is deleted. You can also ask us to do it through the privacy request form.

What withdrawal costs you. You bear the consequences of a withdrawal. For prompt storage, the consequence is that you can no longer read the content of your own past requests. If you withdraw consent to processing that is necessary to operate your account or to bill you, we cannot continue to provide the service and the account will be closed.

Consent Managers. We are not a registered Consent Manager under the Digital Personal Data Protection Act, 2023 and we do not hold ourselves out as one. Once the Consent Manager registry is operational, you may be able to give, manage, review and withdraw consent through a registered Consent Manager. We do not operate that route today.

You hold the rights below. Every one of them is exercised through the same route: the privacy request form. Supply the email address of your account so we can identify you, and — where the request is about API usage — the visible prefix of the API key or the request identifier concerned. We may ask for more information if we cannot identify you from what you send.

• Access. You can ask for a summary of the personal data we are processing about you, a summary of what we do with it, and the identities of every other Data Fiduciary and Data Processor we have shared it with, together with a description of what was shared.
• Correction, completion and updating. You can ask us to correct inaccurate or misleading personal data, to complete data that is incomplete, and to update data that has changed.
• Erasure. You can ask us to erase your personal data. Two things are true about this today and we would rather you heard them from us: the product has no self-service account-deletion control, and an erasure request is actioned by a person rather than by an automated pipeline. Where a record must be kept — payment and accounting records, and records we need to comply with law or to establish, exercise or defend a legal claim — we keep it and tell you what we kept.
• Grievance redressal. You can complain about how we have handled your personal data or your request. Clause 11 states how.
• Nomination. You can nominate one or more individuals to exercise these rights on your behalf if you die or become unable to exercise them yourself. Make the nomination through the request form, naming the nominee and a contact address for them. We record it and act on it after we have proof of death or incapacity and proof of the nominee’s identity. We do not operate an automated nomination register.

Withdraw consent

Turn off prompt storage at /dashboard/settings, or ask through the request form.

Exercise a right

/privacy/request — access, correction, completion, updating, erasure, nomination and grievance.

Complain to the Board

You may complain to the Data Protection Board of India under the Digital Personal Data Protection Act, 2023. Raise the matter with our Grievance Officer first — clause 11.

We acknowledge a request within 24 hours and resolve it within 15 days. The Digital Personal Data Protection Rules, 2025 set an outer limit of 90 days for a grievance response; our published commitment is shorter and it is the one we are held to.

The Digital Personal Data Protection Act, 2023 does not grant a right to data portability, a standalone right to object to processing, or a right against automated decision-making. We do not offer those, and this notice does not pretend otherwise.

The Grievance Officer named in clause 1 handles complaints about privacy, about this notice, and about how a request under clause 10 was handled. Send a grievance through the privacy request form; that form is the channel we monitor. The Grievance Officer’s contact address of record is [email protected], and the postal address is published in clause 1.

We acknowledge every grievance within 24 hours of receiving it and dispose of it within 15 days. Those periods satisfy Rule 3(2)(a) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, Rule 5(9) of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and Rule 4(5) of the Consumer Protection (E-Commerce) Rules, 2020. We publish one pair of numbers and use it everywhere.

If you are not satisfied with how we handled your complaint, you may complain to the Data Protection Board of India in the manner prescribed under the Digital Personal Data Protection Act, 2023 and the rules made under it. You must raise the matter with our Grievance Officer first. We do not operate the Board's complaint channel and cannot file a complaint on your behalf.

We do not publish a complaint channel for the Data Protection Board of India here. We will publish one once we have verified it ourselves; we will not print an address for a statutory body that we have not checked.

Open LLMs is not offered to anyone under 18. The Digital Personal Data Protection Act, 2023 defines a child as anyone under 18 and requires verifiable consent from a parent or lawful guardian before a child’s personal data is processed. We operate no mechanism capable of verifying parental consent, which is precisely why we do not offer the service to children. A contract with a minor is also void under section 11 of the Indian Contract Act, 1872.

We do not knowingly collect the personal data of a child. We do not build behavioural profiles for advertising, we direct no advertising at children, and we operate no advertising system at all.

We will not soften the following. The analytics and session-recording tools described in clause 5 load for every visitor to this website, before any account exists and before we know anything about who is visiting. We cannot determine a visitor’s age, so we cannot state that no person under 18 has ever been recorded by them. What we can state is that the service requires you to be 18, and that if you are under 18 you must not use this website or the API.

If you believe a child has created an account or that a child’s personal data has reached us, tell us through the privacy request form. We will close the account and erase the personal data associated with it.