Privacy Policy

Keep Pushing Forward Ltd (Offices in the UK) runs NeverMetered and is the controller of the personal data described here. For anything about privacy, email legal@nevermetered.com.

We don't store your prompts or the model's outputs, and we never use them to train models. Here is exactly what happens to them:

• Processed in memory. Requests pass through our API gateway to an inference server, which generates the response and streams it back. Content isn't written to our database or to our logs; logs record request metadata such as ids, timings, token counts and the number of messages.
• Short-lived prefix cache. To make follow-up requests faster, inference servers keep the intermediate computation for recent prompts (a “KV cache”) in GPU and system memory. It is not a copy of your text in readable form, is never returned to anyone as output, is overwritten as new requests arrive, and is lost when a server restarts. We route your conversations to the same server for a short time so the cache can help you.
• Responses API objects. If you use the OpenAI Responses API without store: false, the inference server keeps the response in memory so you can continue the conversation with previous_response_id, retrieve it or delete it through the API. Stored responses are only available to your account, are held in a size-limited in-memory store, and disappear when evicted to make room, when you delete them, or when the server restarts. They are never written to disk. We keep a record of which account owns a response id for 7 days.
• Staff access. Our team can see request metadata (for support, capacity planning and abuse prevention) but has no store of your content to look at.

Where laws like the GDPR or UK GDPR apply, we rely on:

• Contract: to provide the service you signed up for, process requests, and handle payments.
• Legitimate interests: to secure the service, prevent fraud and free-tier abuse, and understand and improve performance. We keep this data minimal and don't use it for advertising.
• Legal obligation: to keep tax and accounting records and respond to lawful requests.

All of these are strictly necessary for the service. We don't use advertising cookies or third-party analytics trackers.

We don't sell personal data. We share it only with service providers that help us run NeverMetered, under contracts that limit their use of it to providing their service to us:

We may also disclose data if the law requires it, to protect people or the service from harm or fraud, or as part of a merger or sale of the service (with notice to you).

Our providers may process data in countries other than yours. Where data about people in the UK, EEA or Switzerland is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as standard contractual clauses.

• Account, API key, security and usage data: while your account is open. When you close your account, we delete it along with its keys, sessions, devices and usage records.
• Daily free-request counters: 7 days. Platform performance metrics are aggregate and contain no personal data; we keep them for 90 days.
• Billing records (invoices and payment history, held in Stripe): as long as tax and accounting law requires, typically up to 7 years.
• Abuse prevention: if an account is closed for abuse, we may keep identifiers such as its email address, device ids and network identifiers for up to 12 months to stop the same abuse from returning.

Depending on where you live, you can ask us to:

• give you a copy of your personal data (your usage and request history can also be downloaded as CSV from the dashboard at any time);
• correct inaccurate data (you can change your name in your account settings; contact us to change your email address);
• delete your data and close your account;
• restrict or object to processing based on legitimate interests; and
• transfer your data to another service.

Email legal@nevermetered.com from the address on your account. We'll respond within one month. You also have the right to complain to your local data protection authority. California residents have the rights to know, delete and correct, and we don't sell or share personal information for cross-context behavioural advertising.

Traffic is encrypted with TLS. API keys are stored only as hashes, passwords are hashed, credentials for our inference servers are encrypted at rest, and access to production systems is restricted. Sign-in and sign-up are rate limited. If we become aware of a breach affecting your data, we'll notify you and the relevant authorities as the law requires.

NeverMetered is a developer service and isn't directed at children. You must be at least 16 to create an account. If you believe a child has given us personal data, contact us and we'll delete it.

We'll update this policy when our practices change and revise the “Last updated” date. If a change materially affects how we use your data, we'll email you before it takes effect. See also our Terms of Service.