Privacy Policy

1. Overview

P¬P Studio is a visual platform for building, training, exporting, and deploying machine learning models. This policy explains what information we collect when you use the platform, why we collect it, and what controls you have. It applies to studio.pnotp.ai, this site, and related services operated by P¬P.

2. Data We Collect

We collect only what is necessary to run the product:

a) Account data

• Name and email when you sign up or connect an identity provider such as GitHub
• Organization, if you provide one

b) Project & model data

• Project metadata: names, descriptions, class labels, pipeline and architecture configurations
• Training run records and resulting metrics
• Dataset files and assets you choose to register with a project

c) Usage & product analytics

• Operational logs (request paths, timestamps, error traces) for running and debugging the service
• Anonymous and account-linked usage events (pages viewed, features used such as creating a project or starting a training run) and session recordings, used to understand how the product is used and improve it

d) Inference request metadata

For every call to our inference API we keep a record of the call, and none of what was said in it:

• Which API key made it (stored as a one-way hash), when, which endpoint, which model you asked for and which one answered, which provider served it, how many tokens went in and out, how long it took, and whether it succeeded. If we declined the request, the reason code.
• Not your prompt, and not the response. The record has no field that could hold them — not a truncated version, not a redacted one. An automated check fails our build if anyone adds one. We keep this because when a model provider asks us to account for suspected misuse, this is what lets us identify which customer’s key was involved and cut off that key, without keeping what anybody wrote.

e) Billing data

• Subscription and payment information processed by our payment provider (Stripe). We never see or store full card numbers.

3. How We Use Data

• To provide the training, evaluation, export, and deployment features you use in the product
• To authenticate you, manage your subscription, and prevent abuse
• To understand product usage and improve performance and reliability
• To send transactional emails (password reset, receipts, important account changes). We do not send marketing emails unless you opt in.

4. Data Ownership

You retain ownership of your projects, datasets, and trained models. You can export your project and training artifacts at any time through the in-app export feature. We do not use the datasets you upload to train our own models, and we do not share them with third parties.

5. Data Sharing

We do not sell your data. We share data only with the service providers we depend on to run P¬P Studio:

• Supabase (authentication and database)
• Render (application hosting)
• Cloudflare (content delivery and static hosting)
• Brevo (transactional email)
• Stripe (payments)
• PostHog (product analytics and session recording)
• Vibiz (website analytics and ad attribution on pnotp.ai; no contact details without your consent)
• Fireworks AI (LLM inference) — under a zero-retention agreement: your prompts and completions are not stored at all, including for abuse monitoring.
• Google Cloud Vertex AI (LLM inference) — under a zero-retention agreement: your prompts and completions are not stored at all, including for abuse monitoring. Google approved our exception to its prompt-logging policy on September 15, 2026; before that date content could be retained for a limited period for abuse detection, and never for training.
• Amazon Web Services, through Amazon Bedrock (LLM inference for the Claude models, and for Gemma when Google Cloud cannot serve a request) — your prompts and completions are not stored or logged, and the model’s developer has no access to them. AWS’s automated abuse detection keeps one exception: apparent child sexual abuse material in an image may be stored, reviewed and reported to the authorities. Claude requests may be processed in any supported commercial AWS Region.
• Prompt caching. Where a model supports it, the provider may keep the beginning of a prompt for a short time, scoped to your account, so a request repeating it costs less: in volatile memory only on Google Cloud, and for five minutes after its last use on the Claude models. You can turn it off for any request with "prompt_cache": false.
• We no longer offer OpenAI models: they were removed on November 3, 2026, because OpenAI’s terms did not provide zero retention. No request reaches OpenAI.
• Screening, and where it applies. Only requests to a provider without a zero-retention basis may be classified before they are forwarded. None is used today, so no request is classified. Requests to any zero-retention model are never classified, and we will not extend screening to them: inspecting that content would contradict the agreement that makes those models zero-retention in the first place.
• If a provider reports misuse. We can tell them which API key was involved, how much traffic it sent and when, and we can revoke that key immediately. We cannot give them the requests themselves, because we do not have them. We may also suspend a key automatically if it crosses an abuse threshold; that is reviewed by a person and can be reversed, and we will tell you it happened.
• The operator that served your call is named on each receipt, and Schedule 3 of our DPA states the current basis for each one.
• Brevo (transactional email)
• The hosting providers that run our backend and this site
• Legal authorities, if required by law

6. Data Retention

We retain your account and project data while your account is active. After account deletion, residual logs may persist for up to 30 days for operational reasons, after which they are removed.

The inference request metadata described in section 2(d), and any record of an automated suspension, are kept for twelve months and then deleted. That length is set by what it is for: a model provider investigating misuse may reach us well after the requests in question. Your prompts and completions are not part of these records and are not retained at all — see section 5.

7. Security

We implement reasonable safeguards to protect your data, but no system is completely secure.

8. Your Rights & Choices

Depending on your jurisdiction, you may request to access, correct, or delete your data. You can also:

• Permanently delete your account, all projects, and all uploaded data from your account settings (this is irreversible)
• Opt out of product analytics and session recording at any time by enabling your browser’s “Do Not Track” or Global Privacy Control setting—we honor it automatically and stop collecting analytics for that browser

9. Cookies / Tracking

We use cookies and similar technologies for:

• Authentication and keeping you signed in
• Product analytics (PostHog), subject to the opt-out above
• Website analytics and ad attribution (Vibiz) on pnotp.ai, subject to the opt-out above

10. Contact

Questions about privacy can be sent to [email protected].