Privacy Policy

Pendra AI Ltd is a company incorporated in Wales that provides managed AI inference — chat, embeddings, image generation, and audio transcription — for open-weight models, from a platform hosted in the United Kingdom. We are the data controller for personal data collected through our website and dashboard, and act as a data processor for inference data submitted via our API.

For any privacy-related enquiries, contact us at privacy@pendra.ai.

Account Data

When you create an account, we collect your email address and organisation name. This data is stored in our UK-hosted database and used solely for authentication and account management.

When you create an organisation, we also ask what brought you to Pendra and what your role is. Answering is optional and you can skip the questions. We store your answers in the same UK-hosted database and use them only to understand who uses Pendra and decide what to build. We never use them for advertising and never share them.

Usage Metadata

We log operational metadata for each API request: timestamp, model ID, token counts, latency, and HTTP status code, plus the verdict (outcome and categories) of each moderation check, from the moderation endpoint or from content filtering on your API keys. This data contains no prompt or completion content and is used for billing, capacity planning, and system health monitoring, and to show you the result of each moderation check.

Inference Data

We do not store, log, or inspect the content of your prompts or model completions. Pendra does not retain inference data. It passes through Pendra only in transit, on its way to and from the GPU worker that serves the request. Inference runs only on that worker, whose prompt cache may keep conversation state in memory and, unless the operator turns it off, on that worker’s own disk; that cached state is never sent back to Pendra. We operate a strict zero-retention policy for all inference content. If you call the moderation endpoint, or turn on content filtering for your API keys (it is off unless you do), the moderation model you choose checks the content on one of your organisation’s workers, which may not be the one that answers the request, and Pendra records the verdict (outcome and categories) with the usual usage metadata for the check, never the content. Like any worker, the one that runs the check may keep the checked text in its prompt cache.

Website Analytics

We use Matomo, an open-source web analytics platform that we host ourselves on Pendra infrastructure. It runs without cookies, so it complies with the UK Digital Use and Accountability Act (DUAA) and the EU General Data Protection Regulation (GDPR) without requiring a cookie consent banner. Your browsing data is not sent to a third-party analytics provider.

We use the data we collect to:

• Provide and maintain the Pendra service
• Authenticate your access to the dashboard and API
• Calculate usage for billing purposes
• Monitor system performance and reliability
• Respond to support requests and security incidents
• Understand who uses Pendra and decide what to build, from the optional questions we ask when you create an organisation

We never use customer data for model training, fine-tuning, evaluation, or any purpose beyond fulfilling the immediate service.

We process personal data under the following lawful bases (UK GDPR Article 6):

• Contract: Processing your account and usage data is necessary to provide the service you have contracted
• Legitimate interest: System monitoring, security, and fraud prevention, and understanding who uses the service from the optional questions we ask when you create an organisation
• Legal obligation: Retaining billing records as required by UK tax law

We do not sell, rent, or share your personal data with third parties for marketing purposes. We share data only in the following circumstances:

• Infrastructure and GPU providers: Our UK-based hosting providers, and the providers of GPUs you rent through Pendra, process data on our behalf under data processing agreements. They are listed in Annex 3 of our Data Processing Agreement
• Payment processing (Stripe): Billing and payment data for the Pro plan is processed by Stripe Payments Europe Ltd. Stripe's sub-processors include entities outside the UK, including the United States, with transfers governed by the UK International Data Transfer Addendum and Stripe's standard contractual clauses
• Federated sign-in (optional): If you choose to sign in with Google, authentication metadata (name, email, profile identifier) is exchanged with Google. This is optional and only occurs if you select Google sign-in
• Legal requirement: Where required by UK law or a valid court order from a court of England and Wales

Our platform, including the API that receives your requests and the database that holds the operational metadata logged for each request, is in the United Kingdom. Inference data (prompts, completions, embeddings, image and audio inputs) is processed on the GPU worker that serves the request, so where it is processed depends on where that worker runs:

• GPUs you rent through Pendra: you choose the location. Choose the UK and your inference data stays in the UK. Choose Europe and it is processed in the UK, the European Economic Area or Switzerland. Choose anywhere and it is processed in the country where the GPU is placed. We never place a rented GPU outside the location you chose; if there is no capacity there, we decline the rental
• Workers you run yourself: inference is processed wherever you run them

The transfers listed above relate only to billing data (Stripe) and, optionally, federated sign-in metadata (Google). They never include inference data.

• Inference data: Zero retention by Pendra, which handles it in transit only. Kept only on the worker that serves the request (and, if you use content filtering or the moderation endpoint, the worker in your organisation that runs the check), in its prompt cache, which that worker’s operator controls
• Account data: Retained for the lifetime of your account and deleted within 30 days of account closure, subject to legal retention requirements
• Usage metadata (per-request token counts, latency, model ID, and the outcome and categories of moderation checks): Retained for 12 months from the date each record is created, then deleted on a rolling basis. This 12-month schedule applies both during an active subscription and after account closure — it is not accelerated on closure, so records age out over the 12 months that follow. Used to support billing, capacity planning, and abuse prevention
• Billing records: Retained for 6 years as required by HMRC

Under UK GDPR, you have the right to:

• Access: Request a copy of the personal data we hold about you
• Rectification: Correct any inaccurate personal data
• Erasure: Request deletion of your personal data
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interest
• Complaint: Lodge a complaint with the Information Commissioner's Office (ICO)

To exercise any of these rights, contact privacy@pendra.ai. We will respond within 30 days.

The Pendra marketing website and dashboard do not set any cookies. Our analytics runs on Matomo, hosted on our own infrastructure and configured to run without cookies, fingerprinting, or tracking identifiers.

The Pendra dashboard stores a short-lived authentication token in your browser's local storage so you stay signed in between page loads. This token is strictly necessary to provide the service you have requested and is removed when you sign out. No identifiers are placed in cookies and no cross-site tracking takes place.

We may update this policy from time to time. Material changes will be communicated via email to registered account holders. The effective date at the top of this page will always reflect the latest version.