api.purelight.uk)Pure Light Ltd (company no. 17433578, England & Wales, registered office: 66 Paul Street, London EC2A 4NA) is the data controller for personal data processed in connection with the Purelight Narrative inference API ("the Service"), a text-generation gateway operated on Cloudflare's network. Contact: [email protected].
This policy covers requests made to our inference endpoints, including requests that OpenRouter routes to us on your behalf. If you access our models through OpenRouter, OpenRouter's own privacy policy also applies to its handling of your data; this policy governs what happens once a request reaches our infrastructure.
| Data | Purpose | Lawful basis (UK GDPR) |
|---|---|---|
| Prompt content and generated output | Processing your inference request in transit and returning the response. Nothing else. | Legitimate interests / contract performance, providing the service you called |
| API authentication keys | Verifying that a request is authorised. | Contract performance; security |
| Request metadata (timestamp, status code, token counts, latency) | Security, abuse prevention, uptime monitoring and billing reconciliation. | Legitimate interests, operating a secure, metered service |
| Technical IP/network data processed by Cloudflare | Delivery, routing and protection of the service. | Legitimate interests; see Cloudflare's own privacy documentation below |
We do not knowingly process special category data, children's data, or use the service for automated decision-making. The service is intended for creative-writing use by adults.
Our gateway code contains no logging, caching or persistence of request or response content. We do not write prompt or completion text to any database, log, object store or analytics system we control. Request metadata (status, timing, token counts) is retained for operational monitoring; your prompt and output text are not part of that metadata.
Your prompts and outputs are never used to train, fine-tune or evaluate our models, and are never used to improve any Pure Light Ltd or third-party service. Our LoRA adapter weights are trained exclusively on public-domain and permissively licensed source material, not on customer traffic.
Our primary infrastructure sub-processor is Cloudflare, Inc. Inference runs on Cloudflare Workers AI, and Cloudflare states in its Workers AI data usage documentation that it does not use Customer Content to train AI models made available through Workers AI, does not use it to improve Cloudflare or third-party services, and does not make customer content available to other Cloudflare customers.
If the primary inference path is unavailable, our gateway can replay the request on a serverless GPU failover operated by Runpod, Inc. in European Union data centres. The failover path applies the same rules: request and response content is not logged by us, not used for training, and not retained beyond the request; failover workers are ephemeral and are discarded after serving. Runpod acts as a processor for that call.
We do not sell personal data, and we share none with advertisers or data brokers. No other sub-processors are used for inference traffic; if that changes, this policy will be updated before the change takes effect.
Cloudflare's network is global; inference may be executed in data centres outside the UK. Cloudflare provides contractual safeguards for such transfers under the UK GDPR (including the UK International Data Transfer Addendum via its standard contractual clauses). Failover inference (Runpod) is executed within European Union data centres. Our model catalogue declares global datacentre routing to downstream partners.
Under the UK GDPR you have rights of access, rectification, erasure, restriction, portability and objection. Because prompt content is never retained, there is ordinarily no prompt-level personal data for us to retrieve or erase; metadata requests can be handled within the 7-day window in which it exists. To exercise any right, email [email protected]; we respond within one month. If you are unhappy with our response you may complain to the Information Commissioner's Office at ico.org.uk.
All endpoints require bearer-token authentication; transport is TLS-terminated by Cloudflare; request content is never written to disk at any point in the request lifecycle. Access to operational dashboards is restricted to authorised personnel of Pure Light Ltd.
We will post any changes to this policy at this URL and update the date above. Material reductions in protection will never apply retroactively to data already processed (which, for prompt content, is nil in any case).