Privacy Policy

Last updated: March 31, 2026

Introduction

Casola ("we", "us", or "our") operates an AI inference routing platform that provides access to large language models, image generation, video, and voice AI services. This Privacy Policy describes how we collect, use, and protect information when you use casola.ai and our API.

Information We Collect

• Account information: name, email address, and OAuth identity (GitHub or Google) when you sign up.
• Organization data: organization name, billing address, and payment method (processed by Stripe — we do not store raw card data).
• API usage: job inputs and outputs (prompts, generated images/video/audio, model parameters), request timestamps, token counts, and error logs.
• Technical data: IP address, user agent, and session cookies used for authentication and abuse prevention.

How We Use Information

• Authenticate your identity and maintain your session.
• Route inference jobs to GPU workers and return results.
• Calculate usage-based billing and generate invoices.
• Detect abuse, rate-limit requests, and enforce acceptable use.
• Send transactional emails (billing receipts, org invitations).
• Improve platform reliability through anonymized aggregate metrics.

We do not sell your data, use your inputs to train AI models, or share your content with third parties except as described below.

AI-Generated Content

Inputs you send to AI models (prompts, images, audio) and the outputs returned are your data. We transmit them to third-party GPU providers solely to fulfill your request and do not retain them beyond the data retention period described below. Ownership of outputs is governed by our Terms of Service. You are responsible for ensuring your inputs comply with applicable laws and our Acceptable Use Policy.

Data Retention

We retain different data categories for different periods:

• In-flight jobs and results (including workflow intermediate outputs): up to 24 hours, then permanently deleted.
• Batch job data and data from deleted organizations or users: up to 30 days, then permanently deleted.
• Library content (assets saved to an organization's library): retained for the lifetime of the organization.
• Account and billing records: retained for the life of your account plus 7 years for tax and legal compliance.

You may request earlier deletion of your account data by contacting us.

Data Regions

You may select a data region (US or EU) for your organization. Job payloads are processed and stored in Durable Objects located in the selected region. Account metadata is stored globally via Cloudflare D1. If you require strict data residency, select the appropriate region before submitting jobs.

Third-Party Services

• Cloudflare: infrastructure provider. Data transits and is stored on Cloudflare's network.
• Stripe: payment processing. Subject to Stripe's privacy policy.
• GPU providers (e.g., Vast.ai): inference compute. Job inputs are transmitted to worker instances to execute your request and are not retained by the provider beyond request completion.
• GitHub / Google: OAuth identity providers used during sign-in.

Security

We use TLS for all data in transit, short-lived API tokens with scoped permissions, and HttpOnly session cookies. We do not store passwords. If you believe you have found a security vulnerability, please contact us at security@casola.ai before public disclosure.

Your Rights

Depending on your jurisdiction you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Rectification: request correction of inaccurate or incomplete data.
• Erasure: request deletion of your personal data ("right to be forgotten").
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interests.
• Restrict processing: request that we limit how we use your data in certain circumstances.

To exercise these rights, contact us at legal@casola.ai. We will respond within 30 days.

Children's Privacy

Casola is not directed at children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us personal data, contact us and we will delete it.

Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email or an in-app notice. Continued use after the effective date constitutes acceptance of the updated policy.

Contact

Questions about this policy? Email legal@casola.ai.