Privacy, without ambiguity.

Data we process

• Account data: your name, email address, OAuth provider identifier, organization membership, and session metadata.
• API data: project and key identifiers, request IDs, selected model, routing constraints, timestamps, latency, status, and metered usage. API secrets are stored only as one-way hashes.
• Inference content: prompts, files, tool inputs, and model outputs you submit. Direct routes send this content to their inference provider. OpenRouter routes send it through OpenRouter, which selects and forwards it to a downstream inference provider.
• Publisher data: model metadata, artifact references and digests, licenses, runtime declarations, pricing, commercial terms, validation results, and business verification information.
• Technical data: IP address, user agent, security events, error information, and essential cookie data used to operate and protect the service.

How we use data

We use data to authenticate users, route and deliver inference, meter usage, prevent abuse, debug failures, maintain security, administer publisher submissions, calculate amounts owed, and comply with law.

We do not sell personal information. We do not separately disclose customer identities to model publishers. Direct-route prompts go to the configured inference host. For an OpenRouter route, OpenRouter receives the prompt and selects a downstream inference provider; a publisher that operates serving infrastructure processes prompts in its capacity as that provider. We do not use API content to train Instamodel models unless a customer separately opts into a written program that says so.

Inference and service providers

Instamodel uses infrastructure, database, authentication, payment, observability, and inference providers to operate the service. A direct inference request is shared with its configured host. An OpenRouter request is shared with OpenRouter and the downstream provider OpenRouter selects to serve it.

Instamodel treats a route as OpenRouter when its configured provider ID is openrouter or its provider URL uses the openrouter.ai domain. Every such request sets data_collection: "deny", which asks OpenRouter to exclude downstream providers it classifies as collecting data. This is not a zero-retention or regional guarantee. Provider terms and retention policies can differ; route metadata is the authoritative source for constraints supported by a particular deployment, and requests fail closed when a required constraint cannot be satisfied.

Retention and security

We retain account, transaction, security, and publisher records for as long as needed to provide the service, satisfy legal and accounting obligations, resolve disputes, and prevent fraud. Request content retention depends on the selected route; a zero-retention label is applied only when the serving provider supports it.

We use encrypted transport, host-only secure session cookies in production, one-way API-key hashing, access controls, and redacted request records. No system is perfectly secure, so please report suspected issues to security@instamodel.ai.

Your choices

You may revoke API keys and OAuth sessions, stop using a provider route, or request access, correction, or deletion of eligible personal data. Some financial, security, and publisher records must be retained where law or fraud-prevention needs require it.

Contact

Questions and privacy requests can be sent to privacy@instamodel.ai. We may update this policy as the network, providers, and legal requirements evolve; material changes will be posted here.

Effective August 17, 2026