Skip to content

Privacy Policy

Effective

On this page

This Privacy Policy explains how Inco AI, Inc. (“Inco,” “we,” “us”) collects, uses, discloses, and protects personal information when you visit our website at inco.ai (the “Site”), use our self-serve inference platform at platform.inco.ai and the Inco API and playground (the “Platform”), apply for a job with us, or otherwise interact with us. The Site and the Platform together are the “Services.” Our address is 1881 Page Mill Road, Palo Alto, California 94304, and you can reach us at legal@inco.ai.

This Policy is written for two audiences at once: people who visit our Site or hold a Platform account, and the people whose information may be contained in the content our customers send through the Platform. Section 3 is the part most people ask about first, so we have put it near the top.

1. Summary

We run an inference platform. Customers send prompts, images, files, and video to AI models through our Platform, and we return the models’ output. Some models we run ourselves. Others we relay to the third-party company that operates them, and some of those companies process data in China; our models page says which is which. By default, we store the content sent through the Platform, and the responses, and use it to improve the performance of our service: to tune routing and caching, detect abuse, run benchmarks, and train internal models that help us serve requests faster. For accounts in the EU, EEA, UK or Switzerland we delete stored content within 30 days; for other accounts we keep it for as long as needed for those purposes and review that at least every 12 months (Section 12). A customer can turn that off. Storage and relayed models are separate choices. For accounts in the EU, EEA, UK or Switzerland, storage starts off and relayed models are not available. We never use content to train models that we release unless the customer turns that on. We also keep the information needed to run an account: who you are, how to bill you, and metadata about each request such as the size and kind of each part, token counts, timing and cost, and a fingerprint used to recognize repeats. We use Google Analytics on our websites, subject to your consent where the law requires it. We process data in several regions, as described in Section 10. You have rights over your personal information, described in Section 9, and you can contact us at any time using the details in Section 15.

2. Our Roles

2.1 Where we decide how data is used (controller). Inco is the controller (or “business” under U.S. state privacy laws) of personal information relating to Site visitors, Platform account holders and their authorized users, job applicants, and people who contact us, and of the usage and security metadata described in Section 4.2. For that information, this Policy is the complete description of our practices.

2.2 Where we act on a customer’s instructions (processor). When a customer submits content to the Platform, that content may contain personal information about the customer’s own users or other people. Except as described in Section 2.3, Inco processes that content only to generate and return the model’s response and for the limited purposes described in Section 3, and only on the customer’s instructions. For that content Inco is a processor (or “service provider”) acting on behalf of the customer, who is the controller. The customer’s own privacy policy governs how that information is collected and used, and requests about it should be directed to the customer. Our obligations to customers as a processor are set out in our Data Processing Addendum, available at inco.ai/legal/dpa.

2.3 Where we decide for ourselves (independent controller). When a customer’s Store & Improve Setting is on, we store the content it sends through the Platform for the period described in Section 12 and use it for our own Improvement Purposes (Section 5.9). When a customer’s Training Setting is on, we also use its content to train models that we release (Section 5.10). For those uses we decide why and how the content is used, so Inco is a controller of any personal information in that content, independently of the customer. Our legal basis for the Improvement Purposes is our legitimate interests in improving the speed, reliability, and safety of the Platform. Our legal basis for training released models is described in Section 5.10. Retention is described in Section 12. A customer can stop these uses at any time by turning the relevant setting off (Section 3.2). Anyone whose personal information is in that content can exercise the rights in Section 9 against us directly for these uses, including the right to object.

3. Content You Send Through the Platform

3.1 What it is. “Customer Content” means the prompts, text, images, files, video, and other inputs that a customer or its users submit to the Platform, including content at a URL the customer asks us to retrieve, and the outputs the models generate in response. “Content Logs” are the copies of Customer Content we store when a customer’s Store & Improve Setting is on (Section 3.3). Some models we run on infrastructure we operate (“Inco-served models”). Others are operated by a third-party company (a “provider”) to which we relay the request (“relayed models”, called Passthrough Models in our Terms of Service).

3.2 Your settings. Each customer account has three settings that control what happens to its Customer Content (the “Data Settings”). The account holder can view and change them at any time in the account settings on the Platform:

  1. Store & Improve: whether we store Content Logs and use them for the Improvement Purposes (Section 3.3). On by default, except for European accounts.

  2. Passthrough: whether the account can use relayed models (Section 3.7). On by default. Not available for European accounts.

  3. Training: whether we may use Customer Content to train models that we release (Section 3.4). Off by default for every account. Not available for European accounts.

A European account is an account in the EU, EEA, UK or Switzerland: one whose billing address is in the European Union, the European Economic Area, the United Kingdom, or Switzerland; that has given a VAT or company registration number from one of those countries; or, if neither applies, that signed up from an IP address in one of those countries. The account holder can correct that classification. The settings are linked: turning Store & Improve off also turns Training off; the Passthrough setting is independent. A change applies to requests made after it. Content already stored is not deleted early, but is deleted within 30 days, and once Store & Improve is off we stop using it for the Improvement Purposes.

3.3 What we store and how we use it. When Store & Improve is on, we store the prompts and other inputs and the outputs of each request for the period described in Section 12, including inline image, file, and video bytes and any media retrieved from a URL the customer provides, and including requests to relayed models. We use these Content Logs for the Improvement Purposes described in Section 5.9: routing and cache tuning, abuse detection, benchmarking, and training internal performance models (such as draft models that help us generate responses faster) that are not made available to customers or third parties. We do not use Content Logs to train any model that is made available to customers or third parties unless Training is on. We do not sell Content Logs, share them for advertising, or disclose them except as described in Section 7.

3.4 Training. Training is off by default. If a customer turns it on, we may use its Customer Content to train, fine-tune, or otherwise improve models that we release (Section 5.10). Training can be on only while Store & Improve is on.

3.5 When Store & Improve is off. When Store & Improve is off, Customer Content is kept only for as long as needed to process the request and return the response, except as needed to comply with applicable law, to provide the Services, to provide support, or to carry out safety screening. Except for those purposes, we do not write Customer Content to databases, backups, application logs, error reports, crash dumps, message queues, analytics events, or metrics. Error records contain a request identifier, a status code, and an error class. Inline image and file bytes and any media we retrieve from a customer-supplied URL are handled the same way. Requests to relayed models are sent to the provider and the output returned without our keeping a copy. We keep the request metadata and fingerprints described in Section 4.2(a) whatever the settings; they contain no text or media. Whatever the settings, cached computation used to speed up repeated requests is not persisted beyond the processing window, and we maintain controls designed to prevent cached computation derived from one customer’s content from being used in, influencing, or being disclosed in the outputs generated for any other customer.

3.6 Who can access it. Inco employees and contractors may access Customer Content, including Content Logs, only for the Improvement Purposes (when Store & Improve is on), for training under Section 3.4 (when Training is on), for abuse detection and safety screening, to provide support the customer requests (including reading content included in a support request), and to comply with applicable law, and in each case only under access controls and confidentiality obligations. We do not use session-replay, keystroke-capture, or similar tooling anywhere on the Services, including in the playground.

3.7 Models relayed to third-party providers. When a customer uses a relayed model, we send the prompts and other inputs to the provider that operates that model and receive the output from it. The provider processes that content to generate the response, in its own locations and under its own terms. Our models page states, for each model and mode, whether we run it or relay it, and names the provider. The providers today are DeepSeek, Z.ai, and MiniMax, described in Section 7.7, and some of them process content in the People’s Republic of China. Relayed models are available when Passthrough is on. We keep a copy of those requests only when Store & Improve is also on. Relayed models are not available to European accounts.

3.8 Your responsibilities as a customer. We rely on customers to have the rights and permissions needed to submit Customer Content, to give any notices and obtain any consents that their own users are owed (including notice that their content may be stored and used by us, and relayed to providers, as described in this Section 3), and not to submit the categories of content prohibited by our Terms of Service (for example, government-issued identification numbers, images or other reproductions of identification documents or payment cards, payment card data, account credentials, protected health information subject to HIPAA, biometric identifiers used to identify someone uniquely, and personal data of children under 16, in each case unless we have agreed otherwise in writing).

4. Information We Collect as a Controller

4.1 Information you give us.

  1. Account information: name, email address, organization name, password or single-sign-on identifiers, and any profile details you add. Authentication is provided by Clerk, which processes your credentials on our behalf.

  2. Billing information: billing name and address, tax identifiers, and payment method details. Payments are handled by Stripe; we receive a payment token, the last four digits of your card, card brand and expiry, and transaction records, but not your full card number.

  3. Communications: the content of messages you send us by email, support channels, or forms, and the chat widget on our Site and Platform.

  4. Job applications: see Section 8.

4.2 Information we collect automatically.

  1. Request metadata: for each API or playground request, whatever the customer’s Data Settings, we keep: a request identifier; the account identifier; a timestamp; the model used; the number of parts in the request; for each part, its role, its kind (text, image, file or video), its byte size and its character count; for each image, its pixel dimensions and file size; input, output and reasoning token counts; turn count; modality; the client software identifier sent with the request; latency; cost; and, for errors, a status code and error class. We also keep a one-way fingerprint of each part, which lets us recognize whether we have processed the same part before and cannot be used to reconstruct the part. No text is held for this request, only its shape: the role, size and kind of every part and the counts. This metadata is retained as described in Section 12.

  2. Security data: the IP address and user agent associated with each request and each login, which we keep for 90 days for security and abuse investigation and then delete, or for up to 12 months where they are linked to a security investigation. API keys are stripped from request headers before any log entry is written.

  3. Site and Platform usage data: pages viewed, referring pages, approximate location derived from IP address, browser and device type, and interaction events, collected through the cookies and analytics tools described in Section 6, subject to your consent where required.

4.3 Information from other sources. We receive confirmation of payment outcomes from Stripe.

4.4 Sensitive information. We do not intentionally collect sensitive personal information (such as health, biometric, precise geolocation, or government identification data) about account holders or visitors, and we ask that you not send it to us in communications.

We use the information described in Sections 3 and 4 for the purposes below. Where the GDPR or UK GDPR applies, the legal basis for each purpose is shown in brackets.

5.1 Providing the Services: creating and administering accounts, authenticating users, processing requests, metering usage, billing, and providing support. [Performance of a contract; legitimate interests in operating the Services.]

5.2 Security and abuse prevention: detecting and investigating unauthorized access, credential compromise, fraud, and violations of our Terms of Service, using the metadata in Section 4.2. [Legitimate interests in protecting the Services, our customers, and third parties; legal obligation.]

5.3 Communicating with you: service notices, changes to models, pricing or terms, security alerts, billing messages, and responses to your enquiries. [Performance of a contract; legitimate interests.] We send marketing email only with your consent where required by law, and you can unsubscribe at any time.

5.4 Improving the Services: analyzing usage metadata to understand performance, reliability, and demand, and producing aggregated statistics such as token volumes, latency, and model mix. Aggregated statistics do not identify any customer or person and, except as described in Section 5.9, are not derived from the content of Customer Content. [Legitimate interests in developing our business.]

5.5 Analytics on our websites: understanding how visitors use the Site and Platform, as described in Section 6. [Consent, where required; otherwise legitimate interests.]

5.6 Legal compliance and protection: complying with tax, accounting, export control, sanctions, and other legal obligations; responding to lawful requests; enforcing our Terms; and establishing or defending legal claims. [Legal obligation; legitimate interests.]

5.7 Recruiting: see Section 8. [Legitimate interests; steps preparatory to a contract; legal obligation.]

5.8 No sale, no targeted advertising. We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use personal information for automated decision-making that produces legal or similarly significant effects.

5.9 Improving performance using stored content: where a customer’s Store & Improve Setting is on, using Content Logs for the following purposes (the “Improvement Purposes”): (a) routing and cache tuning; (b) abuse detection; (c) benchmarking; and (d) training Inco’s internal performance models that are not made available to customers or third parties, such as draft models and other serving add-ons. Aggregated statistics we derive from Content Logs are used only for these purposes and never identify any customer or person. [Legitimate interests in improving the speed, reliability, and safety of the Platform.]

5.10 Training released models: where a customer’s Training Setting is on, using its Customer Content to train, fine-tune, or otherwise improve models that we release. [For the account holder’s own information: consent given through the Training Setting, and performance of our contract with the customer.] [For personal information of other people contained in Customer Content: legitimate interests, as recorded in Inco’s legitimate interests assessment.]

6. Cookies and Analytics

6.1 What we use. We use a small number of cookies and similar technologies on the Site and the Platform:

  1. Strictly necessary: cookies set by our authentication provider (Clerk) and our payment provider (Stripe) to keep you signed in, protect against fraud, and complete payments. These do not require consent.

  2. Analytics: Google Analytics, which uses cookies and similar identifiers to collect information about how visitors use the Site and the Platform, including pages viewed, referrers, approximate location, and device information. We have configured Google Analytics to truncate IP addresses, to operate with Google Signals and all advertising features disabled, and to use Google Consent Mode so that no analytics cookie is set before consent is given. Analytics data is retained for 14 months. Google’s own privacy practices are described at policies.google.com/privacy.

  3. Chat widget: a third-party chat tool we use to answer questions on the Site and Platform. Messages you send through it are communications under Section 4.1(c). Any cookies it sets are subject to the consent choice in Section 6.2.

6.2 Consent. If you are in the European Economic Area, the United Kingdom, Switzerland, or another jurisdiction that requires consent for analytics cookies, we set analytics cookies only after you accept them through the banner shown on your first visit. You can change or withdraw your choice at any time through the “Cookie settings” link in the footer of each site. Declining analytics cookies does not affect your ability to use the Services.

6.3 Logged-in Platform use. When you are signed in to the Platform, analytics events may be associated with your account. We use this only for the purposes in Sections 5.4 and 5.5, we do not use it for advertising, and it is subject to the same consent choice described in Section 6.2.

6.4 Browser controls and signals. You can also block or delete cookies through your browser settings. We honor the Global Privacy Control signal where required by law. We do not currently respond to “Do Not Track” signals.

7. How We Share Information

7.1 Service providers. We share personal information with vendors who process it on our behalf under contracts that restrict their use of it. They fall into the following categories: identity and authentication (Clerk); payment processing (Stripe); infrastructure and hosting providers, including the providers that host the bare-metal GPU servers we operate in the regions described in Section 10; email delivery and customer communications; customer support and chat tooling; analytics (Section 6); recruiting software (Section 8); and professional advisers. Customer Content is not shared with any of these providers other than as it is processed on the bare-metal servers those infrastructure providers host for us, as described in Section 3; those providers host the hardware but do not operate our software.

7.2 Infrastructure providers. We describe our infrastructure providers by category in this Policy. Customers who need the named list of sub-processors for their own compliance can obtain it under our Data Processing Addendum, subject to confidentiality obligations, and will receive notice of changes as the DPA provides.

7.3 Model developers. Developers and licensors of the models we run ourselves receive no Customer Content, request metadata, or account information from us. Where a developer also operates a relayed model as a provider, it receives Customer Content only when a customer uses that relayed model, as described in Section 7.7.

7.4 Legal and safety. We may disclose information if we believe in good faith that disclosure is required by law, subpoena, or governmental request, or is necessary to protect the rights, property, or safety of Inco, our customers, or others, to enforce our Terms, or to detect and address fraud or security issues. Content Logs we hold at the time of such a request may be within its scope.

7.5 Business transfers. If Inco is involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy.

7.6 With your direction. We share information with third parties when you ask us to or consent.

7.7 Model providers for relayed models. When a customer uses a relayed model, we send Customer Content to the provider that operates it, and the provider processes that content to generate the response, under its own terms. The providers are currently DeepSeek, Z.ai, and MiniMax. Each processes relayed content in its own locations, which may include the People’s Republic of China, and under its own terms, including any use for training it discloses; our models page states this for each provider. Relayed models are not available to European accounts.

8. Job Applicants

8.1 Our careers page uses Ashby, a recruiting platform, to collect applications. When you apply, we collect the information you provide (name, contact details, resume, work history, links, and answers to application questions), information from referees or public professional profiles where you have provided them, and interview notes and assessments we create. Ashby processes this information on our behalf.

8.2 We use applicant information to evaluate your application, communicate with you, comply with legal obligations (including equal opportunity reporting where required), and, with your consent, consider you for future roles. We retain applicant information for four years where California law applies, and 24 months for applicants elsewhere, after the recruiting process ends unless you ask us to delete it sooner or we are required to keep it longer, and for the duration of employment if you are hired.

8.3 If you are a California resident, the notice at collection required by the CCPA for applicants is provided in this Section 8 together with Sections 4, 5, 7, and 9. If you are in the EEA or UK, the legal bases for processing applicant information are our legitimate interests in recruiting, steps taken at your request prior to entering into a contract, and compliance with legal obligations, and Section 10 describes the international transfer that occurs when you apply.

9. Your Rights and Choices

9.1 All users. You can access and update your account information in your account settings, revoke API keys at any time, unsubscribe from marketing email using the link in each message, manage cookie choices as described in Section 6, and delete your account. When you delete your account, we remove your account information from production systems within 30 days and from backups within 90 days, except for usage metadata retained as described in Section 12 and records we must keep for billing, tax, security, or legal purposes, which we continue to protect and delete when the requirement ends.

9.2 European Economic Area, United Kingdom, and Switzerland. You have the right to request access to, rectification or erasure of, or restriction of processing of your personal information; to object to processing based on legitimate interests; to data portability; to withdraw consent at any time where processing is based on consent, without affecting processing before withdrawal; and to lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner’s Office). Where we rely on legitimate interests, you can ask us for the balancing assessment. Our representative in the EU is Euverify Limited, Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork, T23 AT2P, Ireland, gdpr@euverify.com, and in the UK is Euverify Ltd, 3rd Floor, 86-90 Paul Street, London, EC2A 4NE, United Kingdom, gdpr@euverify.com.

9.3 United States. Depending on your state of residence, you may have the right to know what personal information we have collected about you and to access it; to correct inaccurate information; to delete your information; to obtain a portable copy; to opt out of the sale or sharing of personal information, targeted advertising, and certain profiling (we do not engage in these); to limit the use of sensitive personal information (we do not collect it); and not to be discriminated against for exercising your rights. If we deny a request, you may appeal by replying to our response, and, if the appeal is denied, contact your state attorney general. California residents: we have not sold or shared personal information in the preceding 12 months; the categories of personal information we collect, the purposes, and the categories of recipients are set out in Sections 4, 5, and 7; and you may designate an authorized agent to make a request on your behalf.

9.4 Exercising your rights. Contact us at legal@inco.ai or through your account settings. If you are in the EEA, the UK or Switzerland, you may also submit a request through our representative’s portal at gdpr.euverify.com/verify/fad5ab93-f9eb-4794-98be-a63f474cc99d; requests received there are passed to us and handled under this Section 9. We will verify your identity, typically by confirming control of the email address on your account, and respond within the time required by applicable law (generally 30 days in the EEA and UK and 45 days in the United States, extendable where the law permits). Requests about personal information contained in Customer Content should be directed to the customer that submitted it, except that we handle requests about our own uses described in Section 2.3, including objections, ourselves. Where a customer’s Store & Improve Setting is off, we generally hold no Customer Content to produce, correct, or delete.

10. International Transfers and Processing Locations

10.1 Where we process. Inco is based in the United States. The infrastructure we operate to run Inco-served models is located in several regions, which may include North America, Europe, and the Asia-Pacific region, and a request may be routed to any of them. We do not operate inference infrastructure in the People’s Republic of China, Taiwan, or Hong Kong. Content Logs are stored on infrastructure we operate. When a customer uses a relayed model, the provider processes the content in its own locations, which may include the People’s Republic of China (Section 7.7). Account, billing, and usage metadata is stored in the United States. Our service providers may process information in the United States and other countries where they operate. Transfers of personal information from the EEA, the UK, or Switzerland are covered by the Standard Contractual Clauses where applicable, as described in Section 10.2.

10.2 Transfer mechanisms. When we transfer personal information from the EEA, the UK, or Switzerland to a country that has not been found to provide an adequate level of protection, we rely on the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum or Swiss equivalent, as applicable), supplemented where appropriate by additional safeguards. You can request a copy of the relevant safeguards by contacting us.

10.3 Customers. Customers in the EEA, UK, or Switzerland sending Customer Content through the Platform are covered by the transfer terms in our Data Processing Addendum, which incorporates the Standard Contractual Clauses. Customers who require inference to remain in a specific region should contact us about an enterprise arrangement.

11. Security

11.1 We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, encryption of stored account data at rest, encryption of Content Logs at rest, role-based access controls, logging of personnel access to Content Logs, API-key hashing, network segmentation of inference infrastructure, removal of API keys and other credentials from request headers before any log entry is written, confidentiality obligations on personnel authorized to access systems processing personal data, controls on inference caches designed to prevent cached computation derived from one customer’s content from being used in, influencing, or being disclosed in the outputs generated for any other customer, and access to Customer Content, including Content Logs, limited to the purposes described in Section 3.6 and to personnel who need it for those purposes. Where a customer’s Store & Improve Setting is off, we do not retain its Customer Content beyond processing, except as described in Section 3.5. No system is perfectly secure, and you are responsible for keeping your credentials and API keys confidential.

11.2 If we become aware of a security incident affecting personal information for which we are the controller, we will notify affected individuals and regulators as required by applicable law. Notification obligations to customers for Customer Content are set out in the Data Processing Addendum.

12. Retention

We keep personal information only as long as needed for the purposes in Section 5. In summary: Content Logs of European accounts are deleted no later than 30 days after creation; Content Logs of other accounts are kept for as long as necessary for the Improvement Purposes, reviewed at least every 12 months, and deleted when no longer necessary; for every account, Content Logs are deleted within 30 days after Store & Improve is turned off and within 30 days after account deletion; where it is off, Customer Content is not retained beyond processing, except as described in Section 3.5; IP addresses and user agents are kept for 90 days, or for up to 12 months where they are linked to a security investigation; request metadata, including part fingerprints, is kept in identifiable form for the life of the account plus six years and is then anonymized; billing records are kept for ten years; account information is deleted within 30 days of account deletion and purged from backups within 90 days; applicant information is retained as described in Section 8; and analytics data is retained for 14 months, as described in Section 6. Where we need to keep information longer to comply with law, resolve disputes, or enforce our agreements, we do so only for that purpose.

13. Children

The Services are not directed to anyone under 18, we do not knowingly collect personal information from anyone under 18, and our Terms of Service require users to be at least 18. If you believe a person under 18 has provided us with personal information, contact us and we will delete it.

14. Changes to this Policy

We may update this Policy from time to time. We will post the updated Policy with a new effective date, and for material changes we will notify account holders by email at least 30 days before the change takes effect. Previous versions are archived at inco.ai/legal/privacy/versions. A change to the default position of any Data Setting, and the addition of a provider of relayed models, are material changes. Engaging any third party to receive Customer Content for training would be a material change. Otherwise, adding or changing a vendor in a category already described in this Policy, or adding a tool to Section 6 that is subject to the same consent controls, is not a material change. Customers that have accepted our Data Processing Addendum will nonetheless receive at least 30 days’ notice before a new Subprocessor begins processing personal data on their behalf, as that addendum provides.

15. Contact Us

Inco AI, Inc., 1881 Page Mill Road, Palo Alto, California 94304, United States. Email: legal@inco.ai. To report a security or privacy concern, email security@inco.ai. EU representative: Euverify Limited, Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork, T23 AT2P, Ireland, gdpr@euverify.com. UK representative: Euverify Ltd, 3rd Floor, 86-90 Paul Street, London, EC2A 4NE, United Kingdom, gdpr@euverify.com. If you have an unresolved concern, you may contact your local data protection authority.