Privacy Notice

Last updated 2 October 2026

This notice explains how InferFoundry Ltd handles personal data:

• on our website;
• in our sales and marketing; and
• in running our AI inference services for customers.

In short

• On our website and in sales, we collect the details you give us, such as your name, work email, organisation and what you tell us. We use them to reply to you and to send updates you've asked for. The website sets no tracking cookies and runs no analytics.
• For our customers, we keep the account, billing and usage records we need to run, secure and bill for the service.
• We don't keep your prompts and outputs, and we never train on them. When a customer sends personal data to our models, we process it only on that customer's instructions, as their processor. That customer's own privacy notice covers it (see section 3).
• We don't sell personal data. We share it only with the providers listed on our Sub-processors page, and where the law requires it.
• You have rights over your data. To use them, email privacy@inferfoundry.ai. You can also complain to the UK Information Commissioner's Office (ICO).

1. Who we are

InferFoundry Ltd ("InferFoundry", "we", "us") provides AI inference services from the UK and the EU. For the personal data described in section 2, we are the controller.

We have not appointed a statutory Data Protection Officer, because the law does not require us to. Our privacy contact above handles all data protection matters.

2. Personal data we control

2.1 Visiting our website

The website does not set cookies and does not use analytics or tracking scripts. Fonts and all other files are served from our own hosting, not from third parties.

Our hosting provider, Amazon CloudFront, keeps standard server access logs. These record:

• your IP address;
• the pages you request;
• the date and time;
• your browser type; and
• your approximate country.

We use these logs to keep the site secure and to produce overall traffic statistics. They are stored in AWS's US East region, under the transfer safeguards described in section 5.

2.2 Contacting us, enquiries and sales conversations

When you email us or talk to us about our services, we collect:

• your name;
• your work email;
• your phone number, if you give it;
• your organisation and job title; and
• what you tell us.

We use this to reply, to prepare proposals and to keep track of our conversation with you.

2.3 The "How can we help?" questionnaire and investor updates

If you answer our inference-demand questionnaire, we collect your answers. These cover things like your sector, your expected number of users and your requirements. We also collect your name and work email if you choose to give them so we can follow up.

If you sign up for investor information on our Investors page, we collect your email address.

2.4 Customer accounts and billing

When your organisation becomes a customer, we collect the following for the people who use or manage the account:

• names;
• work email addresses;
• roles; and
• login and API key details.

We also collect billing contact details and the records needed to invoice.

2.5 Service usage and security records

When the service is used, we record operational metadata ("Usage Data"):

• timestamps;
• the model and Region used;
• the number of tokens and requests;
• errors and latency;
• the API key used; and
• the source IP address.

Usage Data does not include the content of prompts or outputs.

2.6 Reports of misuse or security issues

If you report misuse or a vulnerability to us, we collect:

• your contact details;
• your report; and
• the records of how we dealt with it.

2.7 Marketing

We send occasional business updates by email:

• to people who have asked for them; and
• to business contacts where the law allows.

Every email has an unsubscribe link. If you unsubscribe, we keep your email address on a suppression list so that we don't contact you again.

2.8 Suppliers, partners and job applicants

We keep the contact details of people at our suppliers and partners in order to manage those relationships. We keep them for as long as the relationship lasts, plus 6 years. Our lawful basis is legitimate interests.

If you apply for a role, we use your application to assess it. We keep it for 6 months after a decision, unless you agree that we may keep it longer. Our lawful basis is steps taken before a contract, plus legitimate interests.

We don't seek special category data, such as health information or ethnicity, in any of these activities. Please don't send it to us.

3. Data inside our inference services: we act as processor

Customers send prompts, files and other inputs to our models, and receive outputs. Any personal data in that content is processed on the customer's behalf. The customer is the controller. InferFoundry is its processor under our Data Processing Addendum.

For that content:

• we process it only to serve the customer's requests, and only in the UK or EU Region the customer chooses;
• we hold it in memory only. We don't write it to logs or storage, unless the customer chooses to store files or switch on a cache;
• we don't train, fine-tune or evaluate any model on it;
• our staff don't look at it; and
• we don't send it to any third-party model provider.

If your personal data may have been submitted to our services by an organisation that uses them, that organisation's privacy notice applies. Contact it to exercise your rights. If you contact us instead, we will pass your request on to it.

4. Who we share personal data with

We don't sell personal data. We share it only with:

• Service providers who process it for us under contract, such as our website and email hosts. They are listed, with their locations, in Part B of our Sub-processors page.
• Our GPU and data-centre providers, who host the infrastructure that runs the service. They are listed in Part A of the same page. They handle Usage Data only as part of hosting our service.
• Channel partners such as Softcat, where you buy through them. We share order, contact and billing information with them to manage the purchase.
• Professional advisers, such as lawyers, accountants and insurers, where they need it.
• Authorities and regulators, where the law requires it, or to protect our rights or the safety of others.
• A buyer of, or investor in, our business, under confidentiality, if we sell, merge or restructure all or part of our business.

5. International transfers

We keep personal data in the UK and the European Economic Area wherever we can. There are two exceptions:

• our website access logs are stored in the United States (section 2.1); and
• some service providers may access data from elsewhere, for example for technical support.

Where data leaves the UK or EEA, we use a safeguard that UK data protection law recognises, such as:

• UK adequacy regulations; or
• the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

Customer content inside our inference services is never transferred outside the UK and EEA (section 3).

6. How we protect personal data

We use technical and organisational security measures appropriate to the risk. These include:

• encryption in transit and at rest;
• multi-factor authentication;
• least-privilege access; and
• an information security management system aligned with ISO/IEC 27001.

The measures that apply to our services are set out in Annex 2 of our Data Processing Addendum.

7. Your rights

Under UK data protection law, and EU data protection law if it applies to you, you have the right to:

• access the personal data we hold about you;
• have it corrected if it is inaccurate or incomplete;
• have it deleted, in certain circumstances;
• restrict how we use it, in certain circumstances;
• object to our use of it where we rely on legitimate interests. You can always object to direct marketing;
• receive it in a portable format, where we process it by automated means under consent or contract; and
• withdraw consent at any time, where we rely on consent. This doesn't affect what we did before you withdrew it.

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

To exercise any of these rights, email privacy@inferfoundry.ai. We may need to confirm your identity. We will respond within one month. We can extend that by two further months for complex requests, and we will tell you if we do. There is normally no charge.

8. Complaints

If you are unhappy with how we have handled your personal data, please tell us first at privacy@inferfoundry.ai. We will acknowledge your complaint within 30 days and respond without undue delay.

You can also complain to the UK Information Commissioner's Office at ico.org.uk or on 0303 123 1113. If you are in the EU, you can complain to the data protection authority in the country where you live or work.

9. Children

Our website and services are for businesses. They are not intended for children, and we don't knowingly collect children's personal data.

10. Changes to this notice

We will update this notice when our handling of personal data changes. The date at the top shows the latest version. Earlier versions are at /legal/archive/. If we make a significant change that affects customers, we will tell them by email.

11. Contact

InferFoundry Ltd Privacy contact: privacy@inferfoundry.ai 128 City Road, London, EC1V 2NX, United Kingdom Registered in England and Wales, company no. 17255997 · ICO registration ZC175655