Data retention and logging

Numes keeps metadata about every request so it can bill you exactly, route around failing endpoints and show you Activity. It doesn't keep your prompts or model responses.

Chat requests may explicitly send store: false, which is equivalent to omitting it. Stored completions aren't supported: store: true, null and other types return 400. The field isn't forwarded and doesn't change billing metadata or provider retention policies. For provider retention and collection requirements, use provider.zdr: true and provider.data_collection: "deny"; see Provider data policies.

What is recorded for each request

Each request leaves a metadata record with:

• the requested model, and the provider, endpoint and price that served each try;

• the outcome, timing and finish reason, including whether you cancelled;

• usage and the exact cost, including any cache discount;

• the API key that made the request and the person who created it;

• the request ID and generation ID;

• the app origin from HTTP-Referer, such as https://app.example-store.io, for app attribution;

• the regions you requested and, when known, where the request ran.

This is what you see in Logs, Activity and GET /generation. Records are kept for billing, disputes and integrity, and contain no content.

What is never stored

Operational logs exclude content, credentials, full URLs and personal identifiers such as email addresses.

Conversations in the dashboard chat are stored in your browser, not on the platform.

Routing hints

When you send prompt_cache_key, session_id or X-Session-Id, related requests prefer the same endpoint so its prompt cache stays useful. The provider receives only an opaque hint with no content or account identifiers, never your raw value. See Sessions.

Media you send

When a message contains an image, PDF or audio URL, Numes fetches it and forwards the content to the provider, so the provider never contacts your URL. Media isn't kept after the request finishes.

What providers see

A provider receives what it needs to serve the request and nothing that identifies you:

Providers connect to Numes, not to your client, so they never see your network address. What a provider does with request content is governed by its declared data policy; see Provider data policies.

Hosted tools, such as web search, run on the provider's side. Only their results, citations and artifacts come back to you; Numes doesn't keep their queries, code or call traces.

How long records are kept

Deleting your account

When you delete your account, Numes erases your names, email address, profile image, email preferences, saved Activity views and support tickets, ends your access and revokes the keys you created. Financial and audit records are kept for integrity, with past email addresses in protected form. Organizations you belonged to keep their own history.

Limit what leaves your control

• Require zero retention with provider.zdr: true, so only endpoints that declare no retention serve the request.

• Refuse data collection with provider.data_collection: "deny".

• Pin geography with provider.regions, for example ["DE", "FR"].

• Keep secrets out of prompts. Numes doesn't store content, but the provider receives it.

• Use opaque values for session_id and prompt_cache_key, never personal data.

• Use separate keys for workloads with different sensitivity.

Each filter narrows the set of endpoints. If none qualifies, the request fails instead of falling back to a less private endpoint. See Provider data policies.

Next steps