Privacy Policy

Gravora LLC (“we”, “us”, or “our”), a Wyoming limited liability company located at 30 N Gould St Ste R, Sheridan, WY 82801, United States, operates www.modelbuff.com (the “Service”), a cloud-based AI model aggregation and management platform. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Service. We are committed to safeguarding your privacy and ensuring transparency in our data practices.

1. Information We Collect

1.1 Information You Provide

1.2 Information Collected Automatically

1.3 Information We Do NOT Collect

• We do not persistently store the content of your API requests or responses. Content is processed in real-time and not retained beyond short-term operational logging (automatically purged within 30 days).
• We do not use your API input or output data to train any AI models.
• We do not use your third-party API keys for any purpose other than routing requests on your behalf.
• We do not sell your personal information to third parties.

2. How We Use Your Information

We use the collected information for the following purposes:

• Service Delivery: To provide, maintain, and improve the platform, including routing API requests through your own provider keys (BYOK) or our included allowance.
• Billing and Payments: To process transactions, manage subscription plans and balance, and send billing-related communications.
• Security and Compliance: To detect, prevent, and address fraud, abuse, security threats, and violations of our Acceptable Use Policy.
• Communication: To send service-related notifications, updates, and respond to support requests. We do not send marketing emails without your explicit opt-in consent.
• Analytics: To analyze usage patterns and improve the Service using aggregated, anonymized data.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.

3. How We Share Your Information

We share your information only in the following limited circumstances:

3.1 Payment Processors (Sub-processors)

Our payment processing is handled by Stripe, Inc. (“Stripe”). When you make a purchase, Stripe collects and processes your payment information in accordance with the Stripe Privacy Policy. We do not have access to your full payment card details.

3.2 AI Model Providers

When you make API requests, your input data is forwarded to the relevant third-party AI model provider to fulfill your request. For allowance-based usage, providers act as sub-processors under our data processing agreements. For BYOK usage, we transmit your API requests to the respective provider using the keys you provided; no additional personal data is shared beyond what is required to fulfill the request. Each provider processes data according to their own privacy policy and terms. We recommend reviewing the privacy policies of the providers you use through our platform.

3.3 Other Circumstances

• Legal Requirements: We may disclose information if required by law, regulation, or legal process.
• Safety: We may share information to protect the rights, safety, or property of Gravora LLC, our users, or the public.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction. We will endeavor to notify you of any such change where reasonably practicable.
• With Your Consent: We may share information with your explicit consent.

We do not share your personal data with advertisers or data brokers.

4. Data Retention

• Account Data: Retained for the duration of your account and deleted within 90 days of account deletion, unless longer retention is required by law, regulation, or to resolve disputes.
• Third-Party API Keys: Stored while active on your account. Deleted from our systems promptly upon your removal of the key or deletion of your account.
• API Logs: Request metadata (timestamps, token counts, model used) is retained for up to 90 days for billing and debugging purposes. Request content (prompts and responses) is not permanently stored and is purged within 30 days.
• Payment Records: Retained as required by applicable tax and financial regulations (typically 7 years), managed by Stripe.
• Server Logs: Automatically purged after 30 days.

5. Data Security

We implement industry-standard security measures to protect your data, including:

• TLS/SSL encryption for all data in transit;
• Encryption of sensitive data at rest;
• Hashed and salted password storage (bcrypt);
• Regular security assessments;
• Access controls limiting employee access to personal data on a need-to-know basis.

Third-party API keys you provide through the BYOK feature are encrypted at rest and in transit, and are accessible only to the systems required to route your API requests.

While we take reasonable steps to protect your information, no method of transmission over the Internet is 100% secure. We encourage you to protect your API keys and account credentials.

6. Cookies

We use the following types of cookies:

You can control cookies through your browser settings. Disabling essential cookies may affect the functionality of the Service.

7. Your Rights

7.1 For All Users

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete personal data.
• Deletion: Request deletion of your personal data and account.
• Data Portability: Request your data in a structured, machine-readable format.
• Objection: Object to the processing of your personal data for certain purposes.

7.2 For EEA/UK Residents (GDPR)

If you are located in the European Economic Area or the United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR):

• Legal Basis: We process your data based on specific legal grounds as detailed in Section 1 above: (a) contractual necessity (to provide the Service you requested), (b) legitimate interest (security, fraud prevention), (c) consent (optional cookies and marketing), or (d) legal obligations.
• Right to Restrict Processing: You may request that we limit the processing of your data.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right to Lodge a Complaint: You may file a complaint with your local data protection authority.
• Data Protection Contact: For GDPR-related inquiries, contact us at [email protected].

7.3 For California Residents (CCPA)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You may request details about the categories and specific pieces of personal information we collect.
• Right to Delete: You may request deletion of your personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
• No Sale of Data: We do not sell personal information as defined under the CCPA.

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days, with the possibility of a 30-day extension for complex requests, in which case we will notify you of the delay.

8. International Data Transfers

Your data may be processed in countries other than your own, including by our AI model provider sub-processors. When we transfer data internationally, we implement appropriate safeguards to ensure your data remains protected, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission;
• Ensuring third-party providers maintain adequate data protection standards;
• Data processing agreements with all sub-processors.

9. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we discover that we have inadvertently collected data from a child, we will promptly delete it.

10. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on our website;
• Updating the “Last Updated” date at the top of this page;
• Sending an email notification for significant changes (where applicable).

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Gravora LLC
30 N Gould St Ste R, Sheridan, WY 82801, United States
Email: [email protected]
Website: www.modelbuff.com