In effect since 2026-10-12.
In effect since 2026-10-12.
Version: 2026-10-12. Effective date: 2026-10-12. Operator: H2O.ai, Inc., 800 W. El Camino Real, Suite 270, Mountain View, CA 94040, USA.
We keep traffic metadata about each request and nothing of what you send or receive. Prompts, inputs, images, image links, outputs and probabilities are processed in memory to answer the request and are then discarded. Nothing you send is used for training.
Content retention: 0 days. The content_retention_days value is 0, and retainsPrompts is false.
Prompts, inputs, images, outputs and probabilities are not stored. The prompts_stored, outputs_stored and images_stored values are false.
Image links are fetched only to answer the request; the downloaded image is held in memory for that request and never stored.
Training: nothing sent to or returned by the API is used to train any model. The training value is false.
Logging: no request or response content is written to any log; logs record statuses and timings only.
Traffic metadata is kept as long as necessary to operate, secure and bill the service. The usage_metadata_stored value is true.
Publication: we do not publish requests or outputs (canPublish is false), and we do not require end-user identifiers (requiresUserIDs is false).
For each request we keep: request timestamp; API key identifier and team identifier; model and decision profile; endpoint called; response status and error class; latency; input and output token counts and number of questions; number and size of images (not the images or their links); client IP address. It contains no request or response content.
We use traffic metadata for operating the service and fixing faults; securing the service and preventing abuse; billing and capacity planning; meeting legal obligations. We never use it to train models.
Traffic metadata only, never request content or responses, is sent to: PostHog (product analytics (metadata only), region US). This list is generated from the service's configuration and changes with it.
The same rules apply when a request fails, times out or is cancelled: the error is recorded as metadata (status and error class), and no request or response content is copied into errors, traces or crash dumps.
These facts apply to every endpoint of the hosted gateway: /v1/decisions, /v1/systemone and chat completions.
Each published version carries a version identifier and an effective date. Version: 2026-10-12. Effective date: 2026-10-12.
The policy a deployment serves is generated from the same configuration that controls its behaviour, and the gateway refuses to start if its settings would keep anything this policy says it does not.
Questions about this policy: privacy@h2o.ai.