No training on requests
The Tsubasa application does not use customer prompts or outputs to train models, build advertising profiles, or sell behavioral data.
Loading page
PRIVACY MODEL
Tsubasa processes request content to generate a response. The application does not intentionally write prompt, completion, source-code, repository, patch, or tool-call bodies to usage history or normal structured application logs. Provider processing and retention are described below.
Tsubasa is operated by Cenab Batu Bora, an individual in Canada. Contact: [email protected].
Effective policy. Version 2026-10-09-v1.
0
request-content fields in the Tsubasa usage-event schema
CONTENT HANDLING
OPERATIONAL METADATA
These records authenticate requests, reserve and settle credit, enforce limits, diagnose failures, and reconcile payments. They are not a place to copy free-form request content.
The Tsubasa application does not use customer prompts or outputs to train models, build advertising profiles, or sell behavioral data.
Request content passes through network and application infrastructure to an inference provider. Worker memory can include temporary inference caches. RunPod asynchronous job results remain retrievable for 30 minutes after completion. This is not a promise of zero provider retention or confidential computing.
Structured application logs redact content-bearing and credential fields. Raw request and response logging must remain disabled across every deployed proxy and observability hop.
PROVIDERS AND LOCATIONS
The production database is in AWS US West (Oregon), and the application configuration selects Vercel's Portland region. Inference workers are selected from provider pools and marketplace hosts; their locations can vary internationally. Processing can occur outside Canada, subject to the laws of those locations. Tsubasa does not offer Canada-only data residency.
The information a provider receives depends on its role. Ordinary payment processing does not send card details to inference workers. This card-only rollout does not submit Bitcoin transactions to a screening service. Providers also process information under their own applicable policies and service terms.
RETENTION AND REQUESTS
Contact [email protected] to request access, correction, or account closure, or to raise a privacy concern. The operator verifies account ownership before disclosing or changing personal information. Do not send passwords, API keys, or unrelated customer content with your request.
Signed-in customers can download their application records from the dashboard. The download excludes credentials and does not complete a full privacy request: provider records, support correspondence, and edge or security records still require operator review.
Session authentication expires after seven days unless refreshed. Expiry is not immediate erasure of the associated records. Account closure includes review of outstanding credit, payments, disputes, and any documented legal or security hold. Required accounting and contract evidence can remain after account identity and credentials are removed.
Versioned policy acceptance records include the account, accepted versions, attestations, acceptance method, source revision, and time. They do not contain prompts or outputs.
Vercel runtime logs are retained for 30 days under the current Observability Plus configuration. No Vercel log drains are configured. Application logging and tracing are disabled on the Cloudflare origin proxy workers; this does not cover Cloudflare's separate security and service records.
The retention targets are 12 months for usage records and security or access events; account life plus six years for policy acceptance; and at least six years after the relevant tax year for required accounting records. Longer retention requires a documented purpose or legal obligation. Support correspondence is intended to be removed within 24 months after closure of the request.
Daily database retention is enabled. The operator handles privacy requests and external provider records manually. After database restoration, the operator reconciles completed erasures and preservation holds before resuming traffic. Production database recovery retains seven days of history, so deletion from the active database does not immediately remove every recovery copy. This policy does not promise universal immediate deletion or self-service closure.
Report a privacy concern without including prompts, API keys, access tokens, or customer content.