Loading page
Gondola is built so that the most sensitive thing you send us, your prompts, is something we never keep. This page says exactly what we store, what we do not, and who else touches your data.
Last updated: September 5, 2026
Prompts and completions are never written to disk. That includes your chat messages, system prompts, tool inputs and outputs, generated text, the contents of images you send, audio you upload for transcription, documents you submit for text extraction, text you submit for speech generation, and the audio bytes we return. We do not store this content, and we do not store hashes of it (the only hashed request value we keep is the optional client cache-routing key described below). Requests are processed in memory, forwarded to the model, and the content is gone once the response finishes. For a transcription request we keep the clip's length in seconds, because that is what the request is priced on; never the recording or the transcript. For speech we keep the input's character count, never the text.
Naturally, the messages you submit for inference are sent to our gateway and on to the model provider so they can be answered. They are processed, not stored.
Account data: the wallet address you sign in with. For lenders, an encrypted copy of the Venice API key you deposit and the payout address you set.
Notification email: if you opt in to low-balance alerts, the email address you add (encrypted at rest), whether it is verified, and when we last emailed you. It is used only for the alerts you asked for, and you can remove it at any time from /wallet, which stops the emails.
API keys: a one-way hash of each key (we cannot recover the key itself), its label, optional expiry and spend limits, and when it was last used.
Per request: the model, token counts, timestamps, latency, cost and settlement amounts and fee rates, and the model id used. On a failed request we also store a hash of the upstream error text and a structural fingerprint of the request shape (how many messages and their roles, which parameters were present), never the content itself. If your client sends its own prompt_cache_key (an optional cache-routing hint), we store a 12-character one-way hash of that value so cache problems can be diagnosed: never the key itself, and nothing at all when Gondola derives the key for you. Pick a key that does not embed sensitive data; a session or conversation id is ideal.
Payments: on-chain deposit and payout transactions. These are public on the Base blockchain by their nature, independent of us.
Video generation: the model provider holds a finished clip for a short window until your client confirms it was delivered, then deletes it (roughly a day at most if your client never confirms). We store the job id, never the media.
Secrets we hold at rest (deposited Venice keys, and the private keys of the deposit addresses used to receive top-ups) are encrypted with AES-256-GCM.
We use the data above only to run the service: to authenticate you, meter and settle usage, pay lenders, keep the marketplace secure, measure aggregate site traffic, and publish aggregate solvency figures at /transparency. We do not sell your data or use it for advertising.
We use first-party cookies only: a session cookie to keep you signed in (gondola_wallet, up to 7 days), a short-lived login nonce, and a referral-attribution cookie (gondola_ref, up to 90 days). We do not use advertising trackers. Site traffic is measured with Vercel Web Analytics, which is cookieless and stores no persistent identifier; see the next section for what it processes.
Venice AI runs the inference, so it receives the content of your requests. Venice is built around a no-logging model; Gondola does not add logging on top.
Vercel hosts and fronts the application, and provides our site analytics: aggregate page views (page URL with any non-campaign query parameters stripped before sending, referrer, country-level location, browser and device class, timestamp), collected without cookies or any persistent identifier, and never involving prompt or completion content. Railway hosts the database. Privy handles wallet and email sign-in. Resend delivers the optional notification emails, so it receives your address and the alert text when we send one. A Base RPC provider relays on-chain reads and transactions.
Your browser loads fonts from Google Fonts, so it contacts Google when a page renders. The Base blockchain records deposits and payouts publicly.
The providers above may process data in countries other than yours. Using the service means you accept that cross-border processing.
We keep account and usage records for as long as needed to run the service and to keep our accounting and solvency reporting correct; there is no fixed deletion schedule. You can deactivate API keys at any time from /keys, and lenders can revoke a deposited key from /lend, after which its encrypted key material is deleted once the last in-flight request settles. To request access to, correction of, or deletion of your data where applicable, contact us and we will handle it directly after verifying you control the wallet in question.
Secrets are encrypted at rest and access is limited to what the service needs to operate. No system is perfectly secure; if a breach affects your data, we will notify affected users and the relevant authorities where the law requires it.
Gondola is not intended for anyone under 18, and we do not knowingly collect their data.
We may update this policy as the service evolves; the date at the top changes when we do.
support@gondola-ai.com