Last updated: 6 September 2026
This policy explains what OffRail ("we", "us") does with personal information when you use the OffRail API, dashboard, and related services (the "Service").
It sits alongside the Terms of Use.
1. What we collect
Account information. Your email address, the name you supply, and authentication data. Passwords are stored only as a hash. If you sign in with a third-party identity provider or a passkey, we receive an identifier from that method rather than a password.
Organisation and billing information. Organisation name, billing email, billing address and tax identifier where you supply them, credit balance, and transaction history. We do not receive or store full card numbers; our payment processor returns a token plus the card brand, last four digits, and expiry, which is what we hold.
Request data. For every API request we record metadata: timestamp, model and provider used, token or unit counts, latency, cost, finish reason, API key, source, and a request identifier. Whether we also retain the request and response bodies depends on the retention setting on your organisation, described in section 4.
Technical data. IP address, user agent, and similar information from your connections to the API and dashboard. We use this for security, abuse prevention, and rate limiting.
Product usage. Pages viewed and actions taken in the dashboard, collected through our analytics provider.
We do not ask for special category data, and you should not send it in prompts.
2. Why we use it
- To provide the Service: authenticate you, route your request to a provider, return the result, and meter usage.
- To bill you: process credit purchases, calculate charges, issue invoices, and handle refunds and disputes.
- To keep the Service secure: detect and investigate abuse, fraud, credential compromise, and breaches of the Terms of Use.
- To support you: respond to enquiries and diagnose problems you report.
- To comply with law: meet accounting, tax, and reporting obligations, and respond to lawful requests.
- To communicate: send service notices. Product updates are sent only if you opt in, and you can withdraw consent at any time.
Where the GDPR or a comparable law applies, we rely on performance of a contract for the first two purposes, legitimate interests for security and support, legal obligation for compliance, and consent for marketing email.
3. What we do not do
We do not train models on your content. Not our own models, and we do not grant upstream providers the right to do so on our behalf.
We do not sell personal information, and we do not share it for cross-context behavioural advertising.
4. Retention
Metadata for each request is retained so that usage and billing can be reconciled and disputes resolved.
Request and response bodies are governed by the retention level set on your organisation. When retention is disabled, bodies are not written to durable storage: the request is served, metered, and the content discarded. When retention is enabled, bodies are stored for the configured window and then pruned automatically. You can change this setting in the dashboard, and the change applies to requests made after it.
Account and billing records are kept for as long as the account is open, and afterwards for the period required by tax and accounting law.
Records connected to a suspected breach of the prohibited content rules in the Terms of Use are preserved for as long as the law requires, regardless of your retention setting.
5. Who we share it with
We share personal information only with parties that need it to deliver the Service:
Model providers. Your prompt, any uploaded content, and the generated output are sent to the third-party provider serving that request. Each provider handles the data under its own terms. The provider that served a request is identified in the response metadata, and we will supply the provider set for a given model on request.
Payment processing. Our payment processors handle card and cryptocurrency payments, receiving the transaction details necessary to take payment. They act as controllers for the payment data they hold.
Infrastructure and operations. Providers of hosting, databases, transactional email, error monitoring, and product analytics process data on our instructions under written terms.
Legal and corporate. Authorities where we are legally required to disclose, and a counterparty in a merger or acquisition, subject to this policy continuing to apply.
6. International transfers
The Service and its providers operate across multiple jurisdictions, so your data is likely to be processed outside the country where you are located. Write to contact@offrail.ai if you need to know where a given model's requests are served before you send them.
Where we transfer personal data out of the UK, EEA, or another region with transfer restrictions, we rely on an adequacy decision where one exists, and otherwise on standard contractual clauses.
7. Your rights
Depending on where you live, you may have the right to access your personal information, correct it, delete it, restrict or object to processing, receive it in a portable format, and withdraw consent.
Much of this is self-service: account and organisation details are editable in the dashboard, retention is configurable, marketing email can be turned off, and closing your account removes it.
For anything else, write to contact@offrail.ai. We respond within one month and will tell you if we need longer. You can also complain to your local data protection authority.
8. Security
Credentials are hashed, API keys are stored in a form that does not allow us to display them again after creation, and transport is encrypted. Access to production data is limited to the people who need it to operate the Service.
No system is perfectly secure. If a breach affects your personal information and the law requires notification, we will notify you and the relevant authority within the required period.
9. Cookies
The dashboard uses cookies that are necessary for it to work: session authentication, and preferences such as theme and the last project you opened. Our analytics provider sets cookies to measure product usage.
You can block cookies in your browser, but the dashboard will not keep you signed in without the session cookie.
10. Children
The Service is not available to anyone under 18. We do not knowingly collect personal information from a child. If you believe a child has provided us with personal information, write to contact@offrail.ai and we will delete it.
11. Changes
We may update this policy. Material changes are announced on this page with a revised date, and where we hold your email address, by email.