Privacy policy
Version dated 29 October 2026.
Current data handling: synchronous and streaming /v1/chat/completions requests use application-level Zero Data Retention (ZDR), including requests made with free API keys. Prompt and response content is not stored in the operational request database or the free prompt collection and is not used for model improvement. Batch jobs and demo endpoints have separate retention rules. Fabryka Commons remains a proposal: enrolment, example contributions and rewards are paused, and the proposed allowance of 10 million tokens is not an active offer.
Controller: Kacper Wikiel, Aleja Jerzego Waszyngtona 12/14 lok. 40, 03-910 Warszawa, NIP 9522079063, REGON 542074504. Contact: k.wikiel@gmail.com.
1. Request content and ZDR scope
Current application-level ZDR covers new synchronous and streaming /v1/chat/completions requests, including requests made with free API keys. Content is processed in memory; prompts and responses are not stored in the operational request database or the free prompt collection. Content within this scope is not used to develop, train, fine-tune, evaluate, benchmark, test or improve models. We do not sell conversation content.
No separate data-policy acknowledgement or special privacy header is required to use POST /v1/chat/completions. Existing keys continue to work; the HTTP 428 gate associated with policy acknowledgement has been removed. Credit, free-request and model limits and shared-capacity constraints remain; ZDR does not mean unlimited access. The data controls and terms describe the scope in detail.
This is the current, temporary application-level mode of operation for chat completions. It does not claim an independent infrastructure audit or deletion of previously retained content. Account, billing and operational metadata are still retained. Stateful features, including batch jobs, demo endpoints, file storage and saved history, are not automatically covered by this ZDR scope.
Batch jobs and demo endpoints may store request content and results to process a job and provide its response. Working request content is deleted when a job completes, is cancelled or fails; a stored result is deleted on the first successful retrieval. The threshold at which uncollected results become eligible for automatic deletion depends on the service configuration. By default, a result becomes eligible 24 hours after job completion; deletion takes place during the next cleanup cycle. Content collection for the free model-improvement programme is disabled across all endpoints. None of these features resumes Commons enrolment.
The free API is not intended for confidential, sensitive or personal information. Do not submit secrets, health information, customer databases or other sensitive personal data.
Contributions to Fabryka Commons
Fabryka Commons enrolment, new example contributions and rewards are paused. The previously described allowance of 10 million tokens per month and limit of 50 submissions per day are proposals, not active benefits. A previous product choice does not currently enable content collection or new Commons contributions. Resuming the programme, the scope of contributed material, rights to that material and any research or model-improvement use would require the terms to be presented separately and the user to make a choice. Changing the current, temporary mode of data handling requires advance presentation of the new rules; it does not automatically expand the scope of previously concluded agreements.
2. Safeguards and data that remain
ZDR for chat completions concerns prompt and response content within the stated application scope. It does not remove data needed for authentication, billing, limits or security. Access to retained data is restricted to authorised people. Automated filters must not be treated as a guarantee that all personal data or secrets will be detected.
- account and access: email address, if provided; password hash; account, session and key identifiers; the full key is shown only when issued;
- billing: user and job identifiers, model, input and output tokens, cost, balance, status and timestamps;
- operation: request identifier, API method and path, response status and duration, throughput calculated from token counts and duration, and infrastructure availability;
- security: an IP-address hash to limit abuse;
- correspondence, complaints and data required by accounting law.
Content retained for stateful features has a separate scope from operational metadata. We do not log plaintext passwords or full API keys. Infrastructure logs may include technical connection data; application-level ZDR does not mean deletion of all metadata or verification of the practices of every infrastructure component.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| account, job execution, balance and billing | Article 6(1)(b) GDPR |
| accounting and legal obligations | Article 6(1)(c) GDPR |
| availability monitoring, necessary diagnostics and quality assessment, security and the defence of claims | Article 6(1)(f) GDPR |
| correspondence and complaints | Article 6(1)(b), (c) or (f) GDPR, depending on the matter |
The model-improvement programme using user content is currently paused. We do not treat a failure to opt out as GDPR consent. Any future use of personal data for an additional purpose would require first establishing an appropriate legal basis and presenting the rules to the user. Using the current API does not constitute such a choice. Effectively anonymised data do not allow people to be identified.
4. Recipients
Hosting and compute providers' systems process request content to generate a response. Authorised people's access to retained data is limited to the stated purposes and applicable terms. Content from requests covered by the stated ZDR scope, whether free or paid, does not enter the free programme's collection. Other data may be received by hosting, email, security, backup, accounting and payment providers, only to the extent needed for their services. Transfers outside the EEA take place on a basis required by the GDPR.
5. Retention periods
- content of new
/v1/chat/completionsrequests covered by the stated ZDR scope, whether free or paid: processing in memory, without storing prompts or responses in the operational request database or free prompt collection; - working request content for a batch or demo job: until the job completes, is cancelled or fails;
- stored batch or demo result: until the first successful retrieval; the threshold at which uncollected results become eligible for automatic deletion depends on the service configuration, by default 24 hours after job completion; deletion takes place during the next cleanup cycle;
- content previously retained in the former free programme: for up to 30 days from storage; this period also covers copies, exports and prepared example datasets; the current change does not claim that historical data have already been deleted;
- free-programme preference history: up to 90 days; the current preference for as long as the key or identifier is used;
- request metadata with an IP-address hash: up to 90 days;
- account and billing metadata: for the duration of the agreement and then until the applicable accounting periods and limitation periods for claims expire;
- accounting documents and correspondence: for the period required by law or needed to conclude the matter.
6. Individual rights
You may request access, rectification, erasure, restriction of processing and data portability, and object to processing based on legitimate interests. Write to the controller's contact address. You may also lodge a complaint with the President of the Personal Data Protection Office: ul. Stanisława Moniuszki 1A, 00-014 Warszawa, uodo.gov.pl.
7. Operation and cookies
The user selects a model and the response is generated automatically. The system may run the selected model on different GPU servers depending on availability. Sign-in uses necessary sessions. Free demo preferences are associated with a random identifier stored locally in the browser. Clearing browser storage or using a different browser creates a separate identifier; API-key preferences are changed separately. The interface describes the rules for other site features.
Fabryka AI robotics mailing list
The form on fabryka.ai/robotyka is used to sign up for information about testing and developing the idea of remote robotics experiments, and to contact us about the described project. An email address is required; a telephone number is optional. For project enquiries, we also store the submitted description. We do not send these data to a form provider or use them to train models. Data are stored on Fabryka AI's server, which the controller can access. The processing basis is consent given by selecting the form's checkbox. You may withdraw consent by writing to k.wikiel@gmail.com. We will delete the data after withdrawal or no later than 12 months after sign-up. Providing data is voluntary but necessary to receive information or a reply.
8. Contact and changes
Questions, requests and incident reports: k.wikiel@gmail.com. Material policy changes will be communicated before taking effect.
Visit statistics — PostHog
With consent, we use PostHog for statistics on visits to public pages and clicks on internal links. Consent is voluntary and can be changed using the “Analytics settings” button. The PostHog script is not loaded without consent. We do not transmit form contents, conversations, email addresses, API keys, query parameters or URL fragments. Session recording and automatic interaction capture are disabled. The consent choice is stored in the browser for up to 180 days; after consent, PostHog may store a local analytics identifier. The project uses the US region. PostHog privacy policy.