Privacy Policy

This Privacy Policy applies to information collected through the BatchIn website (batchin.tech and its subdomains), console, APIs, model-routing services, Playground, batch-processing platform, billing flows, customer support, enterprise delivery, VaaS (Verification as a Service), and all related services.

If your organization has a signed Master Services Agreement (MSA), Order Form, Data Processing Agreement (DPA), Security Addendum, or other written contract with us, that written contract controls to the extent it conflicts with this public Privacy Policy.

(a) Account and Contact Information: name, email address, phone number, company name, job title, login credentials, multi-factor authentication information, preferred language, and records of support, legal, or sales communications.

(b) Commercial and Billing Information: billing contacts, billing addresses, tax details (such as tax identification numbers and invoice headers), payment status, invoice records, credit terms, procurement records, subscription tiers, contract records, and refund or dispute history.

(c) Technical and Usage Information: IP address, browser and device identifiers, access times, geographic region, error logs, performance metrics, request volume, concurrency data, model identifiers, routing metadata, rate-limit events, partial API key identifiers, trace IDs, audit record identifiers, and security event metadata. Essential server-side security and error records may be processed when needed to operate, protect, and troubleshoot the Services. After you choose Accept all in the cookie and analytics notice, browser Sentry error monitoring, performance traces, and session replay, together with Vercel Analytics, Speed Insights, and product behavior events, may also collect the technical information described here. Sentry replay is configured to mask text and form inputs by default, but you should not enter secrets, API keys, payment credentials, or other sensitive content into pages while replay is enabled. We do not intentionally send full API keys, prompt payloads, or response bodies through these optional telemetry tools.

(d) Cookies and Similar Technologies: We use essential cookies, local storage, and similar technologies for session handling, security checks, language settings, form flows, login continuity, and basic site operation. The first time optional telemetry is available, the site asks whether you want Essential only or Accept all. Optional Sentry browser telemetry, session replay, Vercel Analytics, Speed Insights, and product analytics start only after Accept all. You may decline optional telemetry, and may withdraw that choice by clearing BatchIn consent storage in your browser or contacting us. Essential cookies and service records continue to operate after an opt-out.

Zero Data Retention (ZDR) Guarantee: When Zero Data Retention is requested (via workspace policy or the `x-batchin-zdr: true` HTTP request header), BatchIn executes inference using purely ephemeral in-memory processing. No prompt text, system messages, media payloads, function arguments, or model response tokens are saved to persistent storage, application databases, or log files. Once the response stream terminates, volatile memory buffers are cleared immediately.

Standard Processing: When you use our APIs, Playground, batch features, evaluation surfaces, verification features, or other model-related tools without ZDR, we may process prompts, uploaded files or excerpts, system instructions, structured inputs, request context, generated outputs, evaluation results, and replay evidence in order to operate the service, return results, meter usage, troubleshoot incidents, support governance, and prevent abuse.

Unless a product configuration, customer contract, isolated-environment requirement, or applicable law requires otherwise, we do not use customer inputs or outputs to train our own foundation models.

BatchIn is an adult-only developer and enterprise service. Files and media submitted through private API, batch, multimodal, fine-tuning, or deployment workflows are associated with the requesting account and are not published as public posts, comments, profiles, forums, or public media feeds. Access-controlled URLs, processing windows, deletion behavior, and retention may differ across enterprise-dedicated environments, white-label APIs, private deployments, and bring-your-own-key (BYOK) workflows according to the applicable plan or contract documents.

We use information to provide and maintain the Services, authenticate accounts, route requests, generate outputs, render console features, meter and bill usage, fulfill orders, deliver reserved capacity, respond to support tickets, identify risk, prevent fraud and abuse, and improve reliability, performance, security, and observability.

We may also use information for tax compliance, financial auditing, sanctions or export-control screening, sales process management, product planning, capacity planning, and incident review.

If we need to use information for new purposes not described in this Policy, we will seek your consent or provide notice as required by applicable law before doing so.

Depending on the jurisdiction and context, we process information to perform a contract, take steps at your request before providing the Services, comply with legal obligations, protect security and prevent abuse, pursue legitimate operational interests, or with your consent.

Optional browser Sentry errors, performance traces, session replay, Vercel Analytics, Speed Insights, and product events start only after you choose Accept all. Essential authentication, billing, fraud-prevention, security, and service operation records may continue without optional analytics consent.

We may share necessary information with cloud infrastructure providers, CDN vendors, email and support platform vendors, payment processors, identity providers, logging and monitoring tool vendors, security vendors, and other service providers as needed to operate BatchIn. We require service providers to process information only as necessary for the contracted service, protect it with appropriate safeguards, and follow applicable confidentiality and data-protection obligations.

When requests rely on third-party model vendors or external services, those third parties may process limited request-related content or metadata under their own privacy policies and terms. Customers remain responsible for deciding whether such third-party processing is acceptable for their legal, security, or governance requirements.

Payment providers may receive account, billing, transaction, fraud-prevention, and network information needed to authorize and settle a payment. For model routing, a selected model provider or managed routing partner may receive the request content and technical metadata required to fulfill the requested model call. We do not control the privacy practices of those providers and recommend reviewing their current notices for the relevant payment rail or model route.

We may disclose necessary information where required for legal compliance, law-enforcement requests, court orders, dispute resolution, protection of rights, fraud prevention, sanctions compliance, security investigations, or corporate transactions such as financing, merger, or acquisition activity.

Because the Services may involve global access, failover, cross-regional support coordination, payment processing, or third-party model vendors located in different jurisdictions, information may be transferred to or stored in more than one country or region.

Where required by law, we use a combination of Standard Contractual Clauses (SCCs), least-privilege access controls, encryption in transit and at rest, isolation measures, and other reasonable safeguards intended to reduce transfer-related risk.

Zero Data Retention (ZDR) Lifecycles: For requests where Zero Data Retention is active, payload retention is strictly 0 seconds; prompt and output content is completely wiped from volatile memory upon connection termination and is never stored.

Standard Retention: For standard API requests without ZDR, operational logs containing request metadata and safety diagnostics are retained for up to 30 days for operational reliability, security monitoring, abuse prevention, and billing metering, after which they are permanently deleted.

We retain business and account information based on data type, product configuration, subscription tier, customer contract, legal obligations, dispute-preservation needs, and security or billing requirements. Account, invoice, tax, risk, and enterprise audit records are retained as required by applicable tax, commercial, and financial laws (typically 7 years).

Optional browser Sentry events, performance traces, session replay, Vercel Analytics, Speed Insights, and product events are collected only after Accept all and are retained according to the relevant provider configuration and our operational needs. We do not promise a fixed retention period for every product or enterprise configuration; applicable Order Forms, DPAs, and security addenda may specify shorter periods or deletion deadlines.

When information is no longer needed, we delete, anonymize, or aggregate it unless continued retention is necessary to comply with law, resolve disputes, enforce contracts, or protect the security and integrity of the Services. You may request deletion or export subject to identity verification, legal retention duties, active-account requirements, and enterprise-customer instructions.

You can control optional telemetry through the BatchIn cookie and analytics notice. Selecting Essential only prevents optional browser analytics from starting. Clearing the BatchIn consent storage or contacting hello@batchin.tech withdraws the optional choice for future collection, subject to technical limitations and records already processed.

Browser settings, extension controls, and network-level blocking can affect whether optional tools load. Blocking essential cookies or security storage can prevent login, checkout, consent recording, or other core features from working.

We use measures including encryption in transit (TLS), access controls, credential management, environment isolation, role separation, change management, audit logging, vulnerability patching, and incident-response processes designed to reduce the risk of unauthorized access, disclosure, misuse, or interruption.

No internet service can guarantee absolute security. If a security event is reasonably likely to have a material effect on you or your organization, we will evaluate, respond, and provide notice as required by applicable law, contract, or incident-response procedure.

Depending on applicable law, you may have rights under the EU General Data Protection Regulation (GDPR), UK GDPR, California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), Texas Data Privacy and Security Act (TDPSA), and other state and international frameworks. These include rights to access, correct, delete, restrict, object to, withdraw consent for, port, or file a complaint regarding personal information.

Under Article 50 of the EU AI Act, individuals also have rights to be informed when they are interacting with an AI system or exposed to synthetic content generated or manipulated by AI.

You may submit requests through the contact details below, and we will process them subject to applicable law and identity-verification requirements. To withdraw optional analytics consent, select Essential only when the notice is presented, clear BatchIn consent storage in your browser, or contact us. Withdrawal does not affect processing that occurred before withdrawal or essential processing needed to provide and secure the Services.

If the relevant data is controlled by an enterprise customer, we may direct your request to that customer or process the request according to that customer's instructions.

If you use the Services on behalf of an enterprise, team, or customer organization, much of the input, output, logging, and configuration data may be controlled by that organization. Depending on the service arrangement, we may act as a processor, service provider, or independent controller for different categories of data.

Enterprise customers may negotiate more specific rules for retention, export, deletion, security, and isolation through Order Forms, Data Processing Agreements (DPAs), Security Addenda, or white-label contracts.

The Services are strictly designed and offered exclusively to business entities and adult individuals aged 18 and older. We do not permit accounts for anyone under 18, and do not knowingly collect personal information from minors.

Signup requires an affirmative date-of-birth age confirmation and legal acknowledgment; account creation is blocked if these criteria are not satisfied. If we discover or are notified that an account belongs to a minor under 18, we will immediately suspend the account, revoke API keys, and permanently delete all associated personal data from our systems.

We may update this Privacy Policy from time to time. If an update materially affects your rights or obligations, we will provide notice through the service, by email, through the console, or by another reasonable method at least 30 days before the change takes effect. The updated version applies from the effective date shown on this page.

For privacy, data protection, enterprise compliance, subprocessor, DPA, or security-material requests, contact: hello@batchin.tech.

LuminaPath Inc., a Delaware C Corporation, d/b/a BatchIn. Registered DBA in the State of Texas.

Mailing address: West Tower, 1106 Clayton Ln, Suite 500W, 5th Floor, Austin, TX 78723.

If you access the Services under an enterprise contract, you may also contact your account team or the legal or support channel identified in that contract.

This Privacy Policy and any disputes arising out of or relating to it shall be governed by and construed in accordance with the laws of the State of Texas, without regard to its conflict-of-laws principles. Any litigation shall be brought exclusively in the state or federal courts located in Texas.