TAO-1 API: privacy and data retention

Effective: October 14, 2026 (03:12 UTC) · Operator: Tao Synergies Inc. · Contact: support@tao1.ai

In short

• For requests made through the API, we do not keep the text of your prompts or of TAO-1's answers. We keep only per-request details: request id, model, token counts, timing, status and cost, plus a short fingerprint of the API key.
• We never use API requests to improve TAO-1, and we do not train or fine-tune any model on your prompts or answers. There is no opt-in.
• Your prompts are processed by the model providers listed in section 4, which we choose for their no-retention terms.
• We do not sell prompts and do not share them for advertising.

1. What this covers

The TAO-1 API (/v1/chat/completions and related endpoints), whether you call it directly with a TAO-1 key or through a router, marketplace or reseller that forwards your request to us. If a router calls us for you, the router's own terms also apply to what it keeps. Our apps (tao1.ai and jtao.ai: chat and Code) have their own privacy page; the 100-day retention described there applies to app traffic only.

2. What we keep for each API request

• Request details: time, request id, model route, token counts, latency, status, cost, safety verdicts (labels only) and a short fingerprint of the API key (not the key itself). No prompt or answer text. Kept for billing, abuse control and reliability.
• Prompt and answer text: not stored. The request is processed to produce the answer and then dropped.
• Billing records: top-ups, holds and usage by key. They contain no request text. Kept for legal and accounting reasons.
• Our application logs do not contain request bodies. Our hosting providers keep their own platform logs (IP address, path, status code) for a short time.

Before October 14, 2026 (03:12 UTC). Requests made earlier were stored for up to 100 days and are deleted on that schedule. They may remain in encrypted backups for up to 8 weeks after deletion (section 5).

3. Training and improvement

• No model training. We do not use customer prompts or answers to train or fine-tune a model. Benchmarks and evaluations use public datasets.
• No learning from API traffic. API requests are never added to our improvement data. The improvement setting in our apps does not apply to the API. Request flags such as metadata.no_improve and metadata.learn_opt_in are still accepted and change nothing: the answer is already no.

4. Who processes your prompts

To answer a request we send its content to the provider that serves it. Today:

• Engy (api.engy.ai), our main model host. Engy states in writing that it does not store prompts or outputs and does not use them for training (zero retention by default, on every machine that serves requests). It keeps usage details such as time, model, tokens, cost and latency.
• OpenRouter, a fallback and safety route that forwards to the underlying model vendors. Every request we send to OpenRouter asks for providers that do not store or train on requests.
• Images (only when a request asks for an image): image prompts are generated on our own servers. If those are unavailable, the prompt may be sent to Chutes, our backup image provider.
• Web search (when a request needs current information): Desearch, with Serper and SerpAPI as fallbacks, receive a search query derived from the request, not the whole conversation.
• Public data sources (weather, prices, filings and similar) receive only the name or ticker needed.

We update this list when it changes.

5. Backups and security

Data is stored in managed PostgreSQL databases on our hosting providers. Nightly backups are encrypted and deleted after up to 8 weeks (14 daily and 8 weekly copies). Anything deleted from the live database may therefore remain in an encrypted backup for up to 8 weeks, and is restored only for disaster recovery. Access is limited to the operating team and service credentials. API keys are never stored in request records, only a short fingerprint.

6. Deletion and your rights

• Because API request text is not stored, there is no prompt or answer text for us to delete. To delete request details or billing records tied to your account, or to delete your account, write to support@tao1.ai; billing numbers needed for accounting remain.
• Router users: ask the router to forward the request to us, or write to us with your account or request id.
• Where the law gives you them (EU, UK, Switzerland, California), you may ask for access, correction, deletion and portability.

7. Changes and contact

We will update this page and its effective date when our practices change. Questions and requests: support@tao1.ai. See also our Terms of Service.