API privacy: what uttapen stores and what it never logs

This page is our technical commitment, not a legal document. The legal text lives in the privacy policy and the terms of use; if the two ever disagree, the legal text wins. Here we say precisely what is recorded on the API path and what is not.

What is not stored

Prompt and response content on the API path is never stored. Not in the database, not in logs, not in a cache. The gateway reads the request body to learn the model, the parameters and the approximate size, forwards it to the provider, relays the response to you as it arrives, and once the request ends no copy of the content remains in memory or on disk. That includes images, files, tool call arguments and reasoning text.

Server logs are structured and contain only the fields listed below. If we ever need the content of a request to debug something, you have to send it to us yourself — we cannot recover it.

What is stored (metadata)

One row per request is recorded with these fields, and shown back to you in dashboard → usage:

Field	Why
Request id (X-Uttapen-Request-Id)	Error tracing and matching against the wallet
User id and key id	Billing and monthly caps
Model, endpoint, whether it streamed	Usage reporting
Input, output, reasoning and cached token counts	Billing
Held amount, final amount in toman, state (held, settled, released, reconciling)	Billing
Start time, time to first byte, duration	Service quality
Error code, if any	Debugging
Client IP	Abuse prevention
Provider-side generation id	Reconciling usage after a disconnect

These rows are tied to the wallet and the ledger and are kept so that any invoice can be defended. Deleting your account detaches the rows from your identity, but the amounts stay in the ledger (an accounting requirement).

Exception: the dashboard chat

The dashboard chat and the playground are side tools for trying models out. In both, the conversation history is your own data and is stored so you can come back to it; the same goes for files you upload in chat. You can delete any conversation individually, and deleting your account wipes every conversation and file. To title a conversation automatically, its first message is sent to a cheap model; the output is stored only as the conversation title.

If you do not want any content stored, use the API rather than the chat.

The traffic path

Your request reaches the uttapen server in Iran over TLS. The gateway swaps your key for ours, strips the headers that identify you (IP, cookies, X-Forwarded-*) and sends the request on to the model maker through our own infrastructure outside Iran. That part of the infrastructure only passes traffic through: no data, no keys and no content logs live on it. The other side sees the request coming from our infrastructure's IP, not yours, and knows nothing about your identity. The response comes back along the same path. This path adds roughly 100 milliseconds of latency.

The result: from the model maker's point of view, all uttapen users are a single customer. From your point of view, uttapen neither sees nor keeps your content.

The destination provider's policy

Request content does reach the model maker (OpenAI, Anthropic, Google and others) and their data retention policy applies to it. For API traffic the large providers generally do not use content for training and delete it after a short abuse-prevention window, but that is their commitment, not ours. For sensitive data:

• Strip or pseudonymize personally identifying information (names, national ID numbers, phone numbers) before sending, and put it back after the response.
• Prefer providers with an explicit retention policy; each model page names its provider.
• For organizations under a legal requirement, open-weight models on your own infrastructure are the right answer — not any cloud API.

Keys and accounts

• API keys are stored only as a hash; not even we can see the full key.
• Your mobile number is used for sign-in and account notifications (top-up receipts, low-balance alerts); it is never given to a provider or a third party.
• Payments go through Zibal; card details never reach our servers.
• Account deletion is done through support: identity data, keys, conversations and files are deleted, and only the de-identified accounting rows remain.