CCPA / CPRA
Position
Under the California Consumer Privacy Act as amended by the California Privacy Rights Act, Infer acts as a service provider. We process personal information only on behalf of the business that directs the request, and only for the purpose of returning an inference response. We do not sell personal information, and we do not share it for cross-context behavioral advertising. We retain no customer content at all: prompts and completions exist only in volatile memory for the life of a request and its transient session cache, are never written to durable storage, never logged, and never used for training.
This is a statement of how the service is built and how we contract, not a certification or an approval anyone issues. It is operative today, and it is part of Infer's compliance program. The underlying architecture is described in the privacy policy and the security overview.
What this means in practice
- No sale, no sharing, ever. Infer does not sell personal information and does not share it for cross-context behavioral advertising, for consideration or otherwise. There is no advertising business, no data broker relationship, and no third-party audience or enrichment pipeline anywhere in the service.
- Content is used solely to provide the service. A prompt is processed to produce its completion and for nothing else. It is not inspected, mined, sampled, used to train or fine-tune models, or retained for product improvement. Debugging uses synthetic traffic only, and no internal tool, console, or export path surfaces customer content to Infer personnel.
- No retention beyond the volatile processing window. Content lives in GPU and host memory for the duration of the request and its transient session cache, and is gone when that window closes. Operational logs are metadata-only by construction (timestamps, token counts, status codes, latency, hashed identifiers) and are retained for 30 days.
- No profiling, no advertising use. Infer builds no consumer profiles, performs no automated decision-making about individuals, and does not use personal information for advertising, targeting, or measurement of any kind.
| CCPA/CPRA concept | Infer's position |
|---|---|
| Role | Service provider, processing personal information on the documented instructions of the business whose request we serve. |
| Sale of personal information | None. No exchange of personal information for monetary or other valuable consideration. |
| Sharing for cross-context advertising | None. No advertising, targeting, or measurement use of any kind. |
| Retention of content | None. Volatile memory for the life of the request and its transient session cache; never written to durable storage. |
| Retention of metadata | Metadata-only operational logs (no content), retained 30 days. |
| Consumer requests (access, deletion, correction) | Directed to the business that collected the information. Because Infer holds no content, there is nothing for us to return, correct, or delete beyond assisting that business with metadata within our 30-day window. |
| Sensitive personal information | No secondary use. Nothing is retained, so no use beyond providing the service is architecturally possible. |
Contractual commitments
The restrictions above are not policy alone: they are contract terms. Service-provider terms reflecting these restrictions are included in our agreements as they are executed. Those terms bind Infer to:
- process personal information only for the specified business purpose of providing inference, and only on the documented instructions of the business;
- refrain from selling or sharing personal information;
- refrain from retaining, using, or disclosing personal information outside the direct business relationship, or combining it with information from other sources;
- flow equivalent restrictions down to any subcontractor that processes personal information on our behalf;
- cooperate with the business in responding to verifiable consumer requests, and notify it if we determine we can no longer meet these obligations.
Requests routed to Infer arrive through a single authorized upstream API caller, our routing partner, rather than from end users directly, so the contractual chain runs from the business, through that partner, to Infer, and on to the infrastructure providers whose hardware executes the request.
A note on applicability
These commitments hold regardless of whether the Act's statutory thresholds make it formally applicable to Infer. We treat them as operating requirements of the service, not as obligations we take on only when a threshold is crossed, and we review that determination on a recurring cadence as the business grows.
Questions and requests
For the service-provider terms, a copy of our data-processing language, or any question about how Infer handles personal information:
contact@infer.industries
Consumers seeking access, deletion, or correction of their personal information should contact the business that collected it; Infer will support that business as its service provider.