Draft: pending legal review

Privacy policy

What InferenceIndex collects, why, how long it is kept, and how to use your rights.

Last updated 15 October 2026.

Who we are

The controller for personal data described on this page is Inference Global, Inc., a Delaware corporation, 44 East Ave, Suite 3205, Austin, TX 78701, USA (“InferenceIndex”, “we”). Questions and requests go to privacy@inferenceindex.com.

What we collect

Google sign-in profile

When you join the waitlist with Google, we store the name, email address, and profile photo from that Google account, plus the account identifier Google returns so we can tell signups apart.

Email

We store the email address from that Google account on the waitlist record.

UTM and referrer attribution

Each page stores a first-touch record in your browser under the local storage key inferenceindex_first_touch. That record holds the referrer, utm_source, utm_medium, utm_campaign, and landing path. We also keep those fields for the visit that submits the waitlist, and we save both sets with the waitlist entry.

Consented GA4 analytics

If you consent to analytics and Google Analytics 4 is enabled, we load GA4. It receives a page view, the page address, the referring address, and the campaign parameters on the link you followed (utm_source, utm_medium, utm_campaign). IP anonymization is on. If your browser sends Do Not Track, we do not load analytics.

Waitlist entries

A waitlist entry holds your Google profile fields, your email, the time you signed up, the consent statement “Waitlist access and product updates”, and the attribution fields above.

API usage and logs for customers

If you use the InferenceIndex API, we process the API requests you send, usage records for those requests, and logs we need to run, secure, and support the service. [API data categories and retention — confirm whether request content is stored, which fields are logged, and for how long.]

Why we use it

To give you waitlist access and product updates you asked for.
To see which campaigns and pages led to a signup.
To measure site use with consented GA4 analytics.
To provide the customer API, including usage records and logs, and fallback routing of customer API requests.
To keep the service secure, prevent abuse, and answer privacy requests.

Legal bases (GDPR Article 6)

Article 6(1)(b), contract. Processing needed to provide the waitlist access you requested and, for customers, to provide the API.
Article 6(1)(a), consent. Consented GA4 analytics. Where product updates rely on consent, you can withdraw that consent at any time without affecting processing that already happened.
Article 6(1)(f), legitimate interests. Securing the service, preventing abuse, and keeping operational logs. The interest is running a reliable service. You can object.
Article 6(1)(c), legal obligation. Where the law requires us to keep or disclose information.

[Confirm which Article 6 basis applies to attribution, product updates, and API logs.]

Retention

Waitlist profile, email, and attribution: while you are on the waitlist, then [waitlist retention after the list closes or you ask for deletion — confirm]
Consented GA4 data: the period configured on the GA4 property, currently [GA4 retention setting — confirm]
Customer API usage and logs: [API log retention — confirm]
Deletion requests: [deletion-request retention — confirm], long enough to show how the request was handled.
Backup copies: until the backup cycle removes them. [Backup window — confirm]

Your rights

You can ask us for access, rectification, erasure, and portability, and you can object to processing that relies on legitimate interests. Portability covers the data you provided, in a common machine-readable format. Objection includes the right to object to direct marketing.

Email privacy@inferenceindex.com to use these rights. We record the request and respond within 30 days. You can also lodge a complaint with your supervisory authority. The deletion path is described on the security page.

International transfers

We and our sub-processors may process personal data outside your country, including in the United States. Where the GDPR requires a transfer tool, we use the European Commission’s Standard Contractual Clauses (SCCs). Sub-processors are listed on the subprocessors page.

[Confirm the transfer tool in place for Google Cloud, Google Analytics, and OpenRouter, including whether the EU-US Data Privacy Framework is used as well as SCCs, and which SCC module is signed.]

Cookies and similar storage

Local storage key inferenceindex_first_touch: first-touch referrer, UTM parameters, and landing path. This is not used for advertising.
Google Analytics cookies, including cookies whose names start with _ga, only when consented GA4 is loaded.
Google sign-in can store identifiers in the browser so the session can continue. [Confirm the cookie and storage names used by the live sign-in flow.]

Contact

Email privacy@inferenceindex.com. The controller is Inference Global, Inc., a Delaware corporation, 44 East Ave, Suite 3205, Austin, TX 78701, USA.