Geodd designs its Services to minimize unnecessary data storage and reduce customer data exposure.
For AI model API services, Geodd processes prompts, inputs, outputs, request bodies, and response bodies transiently to provide the requested inference response. Unless separately agreed in writing, Geodd does not store API prompts, API inputs, API outputs, completions, API request bodies, API response bodies, uploaded files, embeddings, customer datasets, or fine-tuning data.
Geodd does not use API data for model training and does not conduct human review of prompts or outputs by default.
This page applies to Geodd Services, including:
Data handling may differ depending on the Service, customer configuration, infrastructure region, and Order.
For AI model API services, Customer may submit prompts, inputs, or other request data to receive model outputs or completions.
By default:
| Data Type | Geodd Handling |
|---|---|
| API prompts / inputs | Processed transiently; not stored |
| API outputs / completions | Processed transiently; not stored |
| API request bodies | Not stored |
| API response bodies | Not stored |
| Uploaded files | Not supported / not stored unless separately agreed |
| Embeddings | Not stored unless separately agreed |
| Customer datasets | Not stored unless separately agreed |
| Fine-tuning data | Not supported unless separately agreed |
| API payload caching | No |
| API data used for training | No |
| Human review of prompts / outputs | No, by default |
API data is processed to provide the requested inference response and is discarded after processing, unless a different arrangement is expressly agreed in writing.
Although Geodd does not store API request bodies or response bodies by default, Geodd may retain limited metadata for legitimate operational purposes.
This metadata may include:
Geodd may use this metadata for:
This metadata does not include the text of API prompts, API inputs, API outputs, request bodies, or response bodies by default.
Customers are responsible for securing their API keys, credentials, tokens, dashboard access, applications, and account permissions.
Geodd does not store full API keys. Geodd stores only a hash of the API key for authentication and security purposes.
Customers should:
Geodd may disable, rotate, suspend, revoke, or require replacement of API keys where necessary for security, abuse prevention, legal compliance, service protection, or suspected compromise.
Geodd does not use API prompts, inputs, outputs, completions, request bodies, response bodies, uploaded files, embeddings, customer datasets, or fine-tuning data for model training by default.
Geodd also does not use API data for fine-tuning by default.
If any customer-specific training, fine-tuning, evaluation, or dataset processing is offered in the future, it should be governed by a separate written agreement or Order.
Geodd does not conduct human review of API prompts or outputs by default.
Geodd personnel may access limited account, usage, technical, operational, billing, support, or security information where reasonably necessary to:
Such access is limited based on role, operational need, and applicable security controls.
Geodd may process account, administrative, billing, support, legal, security, and usage data to operate the Services and manage its relationship with customers.
This may include:
Geodd processes this data as an independent controller, as described in its Privacy Policy.
Customers are responsible for determining whether data submitted through the Services contains personal data.
Where Geodd processes Customer Personal Data submitted by or on behalf of a Customer through the Services, Geodd generally acts as a processor and processes that data under the Customer’s instructions.
Customers are responsible for ensuring that they have:
Geodd’s Data Protection Addendum is available at: geodd.io/legal/data-protection-addendum
Geodd does not require customers to submit sensitive, special category, regulated, or high-risk personal data in order to use the Services.
Customers should avoid submitting sensitive or regulated data unless they have confirmed that their use case is lawful, appropriate, and supported by the applicable Order and agreements.
Unless expressly agreed in writing, Geodd does not provide Services specifically intended for:
If a customer submits sensitive, special category, regulated, or high-risk personal data, the customer is responsible for ensuring that it has all required lawful bases, notices, consents, authorizations, permissions, safeguards, and contractual rights.
For Dedicated Inferencing, Geodd may provide dedicated AI model endpoint infrastructure for Customer’s inference workloads.
Geodd’s default API data handling position still applies unless expressly agreed otherwise:
Dedicated Inferencing may provide stronger workload isolation compared with shared infrastructure, depending on the service configuration and Order.
For Dedicated GPU and Bare Metal Infrastructure, Customer may have direct control over workloads, applications, models, datasets, credentials, operating environments, access permissions, and network exposure.
Customer is responsible for:
Unless expressly agreed in writing, Geodd does not provide customer workload backup, model backup, dataset backup, file backup, or disaster recovery services.
Geodd’s retention practices depend on the type of data.
| Data Type | Retention / Handling |
|---|---|
| API prompts / inputs | Not stored |
| API outputs / completions | Not stored |
| API request bodies | Not stored |
| API response bodies | Not stored |
| Uploaded files | Not supported / not stored unless separately agreed |
| Embeddings | Not stored unless separately agreed |
| Customer datasets | Not stored unless separately agreed |
| Fine-tuning data | Not supported unless separately agreed |
| Limited API metadata | Retained as needed for billing, usage measurement, security, troubleshooting, service operation, fraud prevention, legal, and compliance purposes |
| Billing / financial usage records | 7 years |
| Billing / tax records | 7 years |
| Security logs | 12 months unless longer retention is required |
| Support tickets | 12 months unless longer retention is required |
| Marketing records | Until unsubscribe plus 2 years |
| Marketing consent records | 6 years |
| Database backups | 30-day rolling backups |
| Deleted account data | Deleted within 30 days, except lawful retained records and backup expiry |
Backup deletion occurs through normal backup expiry cycles and not by immediate deletion from all backups.
Customers may request account deletion by contacting [email protected] or by using deletion functionality made available in the Services.
Where a customer requests account deletion, Geodd will delete or deactivate the account within a reasonable period and, where applicable, delete associated account data within 30 days, except for records that Geodd is required or permitted to retain for legal, tax, billing, security, fraud prevention, dispute, compliance, or legitimate business purposes.
API prompts, inputs, outputs, completions, request bodies, and response bodies are not available for export, correction, deletion, backup, or restoration after processing where Geodd does not store them.
Geodd uses technical and organizational measures designed to protect personal data and systems against unauthorized access, loss, misuse, alteration, disclosure, or destruction.
Security measures may include:
Geodd’s Security Measures page is available at: geodd.io/trust-center/security-measures
Support and administrative access may occur where necessary for:
Support and administrative access may occur from Geodd operational locations, including Sri Lanka, where necessary for support, security, debugging, service operations, billing, legal, and compliance.
Safeguards may include:
Geodd LLC is established in the United States.
For EU customers, API inference is hosted in EU data center infrastructure by default. EU/UK customers may also choose non-EU infrastructure, in which case API requests may be routed outside the EU/UK for inference processing.
Support and administrative access may occur from Geodd operational locations where necessary for support, security, debugging, service operations, billing, legal, compliance, abuse prevention, and fraud prevention.
Where personal data is transferred to or accessed from a country that has not been recognized as providing an adequate level of protection, Geodd uses appropriate transfer safeguards as described in its Data Protection Addendum and International Data Transfers page.
Geodd’s International Data Transfers page is available at: geodd.io/legal/international-data-transfers
Geodd may use vendors and subprocessors to provide, secure, support, and operate the Services.
Geodd’s Subprocessor List is available at: geodd.io/legal/subprocessors
The Subprocessor List describes vendors, purposes, categories of data processed, region or processing location information, transfer mechanisms, and notes.
Geodd may use third-party suppliers for physical hardware, rack space, power, cooling, connectivity, physical maintenance, and physical security.
Geodd does not treat physical infrastructure suppliers as subprocessors unless they process Customer Personal Data on behalf of Geodd.
Physical infrastructure suppliers are not treated as subprocessors where they do not have logical, administrative, operational, support, storage, backup, monitoring, encryption-key, or readable access to Customer Personal Data, workloads, prompts, outputs, logs, backups, storage, or runtime environments.
Emergency access by physical infrastructure suppliers is limited to physical premises, rack, cabling, power, hardware replacement, cooling, connectivity, and physical security. It does not include logical access to systems, workloads, storage, logs, encryption keys, or Customer Personal Data.
Customers are responsible for:
Geodd may update this Data Handling page from time to time to reflect changes in Services, infrastructure, law, security measures, vendors, or operational practices.
If changes are material, Geodd will provide notice by reasonable means, such as through the website, dashboard, email, or other electronic notice.
The “Last Updated” date shows when this page was last revised.
For privacy questions: [email protected]
For security questions: [email protected]
For support: [email protected]
For legal notices: [email protected]