LEGAL
Privacy notice
What Modelvia holds, what it deliberately does not hold, where it is kept, and how to ask for a copy or a deletion. The short version: account and billing records are kept; prompts and completions are not stored by Modelvia, but they are processed by the suppliers that serve each request.
Who is responsible
Modelvia is operated by Yo-Da Lai (ABN 84 992 526 369), who is responsible for the handling described here. We are bound by the Australian Privacy Principles under the Privacy Act 1988 (Cth).
Where you are a client serving your own customers through Modelvia, you decide what your customers' data is used for and we handle it on your instructions. Your customers should ask you first; we will refer them to you.
Account data we hold
- Identity. Email address, name if you give one, a password hash, and second-factor enrolment. Used to sign you in and to know who did what in a workspace.
- Account email. When we send an invitation or password recovery message, Resend receives your email address, the one-time setup link and its expiry, and the message text. It also receives redacted operational alerts sent to our support contact.
- Account structure. Client, customer and project records, memberships and roles, spending caps. This is what keeps one account's data out of another's.
- Keys. A hash of each API key, its scope, when it was created and when it was last used. Never the key itself.
- Request records. For each request: identifiers, the model route served, token counts, the price, the time, and the outcome. A keyed fingerprint binds a request to its idempotency key without storing the request.
- Billing records. Rate-card acceptances, invoices, statements, payment and refund events, and the ordered ledger those sit in.
- Operational records. Server logs for errors and abuse, and backup archives of the databases above. Creating a backup writes a temporary plaintext database dump to gateway disk before encryption; the process attempts to remove temporary files during cleanup, which a crash could interrupt.
What happens to a prompt
We do not retain prompts or completions. There is no database or file to read them from, no copy in a log, and no training on them. A request is admitted, priced, sent through OpenRouter to the zero-data-retention host serving that model, and the response is streamed back. The accounting record that survives holds identifiers, counts and money — never the text.
One short-lived exception, in memory only. When Claude Sonnet 5.5 calls one of your tools, Claude requires its own signed reasoning for that step to be sent back with the tool result. The gateway keeps that reasoning in its working memory, scoped to your project, for at most 6 hours after it was last used, so the next step of the same tool loop can continue. It is never written to disk, a database or a log, never shown to you or anyone else, and it is gone when the gateway restarts.
Prompts and completions are not stored by Modelvia, but request content is processed by the routing classifier (TypeSafe) when automatic routing applies, and by OpenRouter and the host serving the model, in order to serve the request. We would rather you hear the detail from us than discover it:
- OpenRouter and the model's host process the request. Prompts go through OpenRouter, over TLS, to the reviewed host(s) listed for the model that serves them, with fallback limited to that list: DeepSeek's own endpoint serves DeepSeek V4.1 Flash, and Amazon Web Services (Bedrock) serves Claude Sonnet 5.5, with Google (Vertex AI) as a same-price fallback. Every request except DeepSeek V4.1 Flash requires an endpoint with zero data retention and denies data collection, and we disable OpenRouter's response cache. Claude Sonnet 5.5 asks its host to keep the prompt prefix for up to 5 minutes so the next turn of the same conversation is faster; that cache is keyed to one tenant's conversation. Zero data retention is the host's own policy as OpenRouter lists it: we choose hosts by it and require it on those requests, but we cannot inspect a host's systems to verify it. Anthropic develops Claude and does not receive your requests.
- DeepSeek V4.1 Flash is not zero data retention. Requests on this model go to DeepSeek's own endpoint, which OpenRouter does not list as zero data retention, with data collection allowed. DeepSeek may retain the content and use it under its own terms.
- One decisions model is not zero data retention. Computer-use decisions (
/v1/decisions) can use GPT-6 Luna Decisions, served by OpenAI's own endpoint, which is not zero data retention: OpenAI may keep the state and questions sent to it, which can include screen or page text, for up to 30 days for abuse monitoring. Data collection for training is denied. Jev, the other decisions model, is zero data retention. - Automatic routing reads the conversation. When a request asks for the
automodel and more than one route could serve it, the conversation messages, a flag saying whether tools are available, and the output ceiling are sent to our routing classifier, Jev, run by TypeSafe, so it can pick a route. Tool definitions and any earlier private reasoning are not sent. Name a specific model instead ofautoif you would rather that step never happen.
Where each of these runs, and what each one receives, is set out in subprocessors and data residency.
How long we keep things
| Record | Kept for | Why |
|---|---|---|
| Prompts and completions | Not kept | Never written to Modelvia's storage. Processed in transit by the classifier, OpenRouter and the model host to serve the request. |
| Claude tool-loop reasoning | Up to 6 hours, in memory | Only Claude Sonnet 5.5's signed reasoning for a step that called a tool, held in the gateway's memory so the tool loop can continue. Never written to storage; lost on restart. |
| Invoices, statements, payments, ledger events | 7 years | Record-keeping obligations. These survive account closure. |
| Request and usage records | Life of the account, then 12 months | They substantiate invoices and support disputes. |
| Identity and membership records | Life of the account, then 90 days | Long enough to reverse a mistaken closure. |
| Server logs | 90 days | Error diagnosis and abuse handling. |
| Backup archives | Per backup schedule | Deletions reach backups as those archives expire, not sooner. |
Who else sees it
Only the suppliers we need, each listed with its purpose, its region and the data it receives on the subprocessors page. For request content that means TypeSafe (automatic routing only), OpenRouter, and the host serving the model: Amazon Web Services (Bedrock) or Google (Vertex AI), both zero data retention; DeepSeek, for DeepSeek V4.1 Flash only, which is not; or, for GPT-6 Luna Decisions only, OpenAI. We do not sell personal information, we do not share it for advertising, and we do not use your data to train models.
We will disclose information if the law requires it. Unless we are prohibited from doing so, we will tell you first so you can respond.
Access, correction and deletion
Email yoda@yodalai.xyz from the address on the account and say what you want: a copy of what we hold, a correction, or deletion. We may ask one question to confirm you are who you say you are; we will not ask for identity documents.
- We acknowledge within 5 business days and respond within 30 days.
- Usage and analytics can be exported from the workspace yourself at any time; you do not need to ask us.
- On a deletion request we remove identity, membership and request records on the schedule above, and confirm when it is done.
- We cannot delete invoices, payments or ledger events within their retention period, and we will say so plainly rather than quietly keeping them.
- If you are a customer of one of our clients, ask that client. They hold the relationship and can act on their own account.
If you are not satisfied with our answer you can complain to the Office of the Australian Information Commissioner.
Security and contact
How we protect this, what we log, and what happens in an incident is on the security page. Report a vulnerability or a suspected breach to yoda@yodalai.xyz. Privacy questions go to yoda@yodalai.xyz.
If we change this notice we will publish the new version here with its date and tell account contacts by email.