AI inference API
Privacy Policy
Last updated: June 13, 2026
Plain English summary
- We run inference-only open-weight models on self-hosted NVIDIA DGX Spark hardware in Portugal.
- Prompt and completion content is processed transiently in memory and is not persisted to disk.
- We do not train, fine-tune, evaluate, sell, share, or license user prompt or completion data.
- Request metadata is retained for 30 days for billing reconciliation and abuse detection, then deleted.
1. Who we are
Lucidmaze is a small, technically focused EU-based AI inference provider operating dedicated hardware infrastructure in Portugal. We serve open-weight language models through an OpenAI-compatible API built on a vLLM and LiteLLM stack.
Our initial hosted model is Qwen3.6-35B-A3B-FP8 running on NVIDIA DGX Spark hardware with a GB10 Superchip and 128GB unified memory. For privacy questions, contact us at privacy@lucidmaze.co.
2. What data we collect
We collect the minimum operational data needed to run a reliable, billable API service and detect misuse of shared infrastructure:
- API request metadata, including timestamp, endpoint called, model requested, input token count, output token count, latency, and HTTP status code.
- Authentication tokens, stored only as cryptographic hashes and never in plaintext.
- Billing and usage metrics associated with each API key.
- Standard server access logs, including IP address, user agent, and request path.
- Prompt and completion content, transiently processed in memory during inference and not persisted to disk.
3. What we do NOT collect
This is the core of our privacy posture: inference content is not retained after the request completes.
- We do not store prompt content or completion content after the request completes.
- We do not use any prompt or completion data for model training, fine-tuning, or evaluation.
- We do not sell, share, or license user data to any third party.
- We do not use third-party analytics, tracking pixels, or advertising SDKs in our API.
4. Data retention
- Request metadata and usage logs are retained for 30 days for billing reconciliation and abuse detection, then permanently deleted.
- API key hashes are retained until the key is revoked by the user or we terminate the account.
- No prompt or completion content is retained beyond the duration of the HTTP request.
5. Infrastructure and data residency
- All inference runs on hardware physically located in the EU, specifically Portugal.
- No API request data is transferred outside the EU for processing.
- We use end-to-end TLS for all API communications.
- Our inference stack is fully self-hosted; no cloud provider sub-processors handle inference workloads.
6. Legal basis and GDPR
Lucidmaze is subject to the General Data Protection Regulation as an EU-based operator. Our legal basis for processing operational metadata is legitimate interests, including operating the service, securing infrastructure, and preventing abuse. Our legal basis for billing and account-related usage data is contractual necessity.
Users have the right to access, rectify, and delete their personal data by contacting privacy@lucidmaze.co. We will respond to GDPR requests within 30 days.
7. Security
- API keys are stored as cryptographic hashes.
- TLS 1.2+ is enforced on all endpoints.
- Infrastructure access is restricted to authorized personnel only.
- No prompt data is written to persistent storage.
8. Changes to this policy
We will notify API users of material changes to this policy by email with 14 days notice before those changes take effect.