# Data and privacy

## Where your request goes

1. Your request reaches our gateway in Sydney. The `x-continuum-region` header on every response tells you where it was processed.
2. The gateway checks your key and credit, then passes the request to the model.
3. The model runs in an Australian data centre and its reply streams back the same way.

## What we keep

| | Kept? |
|---|---|
| What you send (prompts, documents, images) | No |
| What the model replies | No |
| Your email address, keys (scrambled) and credit balance | Yes, to run your account |
| For each request: time, key, model and token counts | Yes, for billing and your usage page |

We do not use your requests to train models.

## Who else is involved

The gateway runs on Vercel, in its Sydney region. Account data is held by Supabase, in its Sydney region. Both are United States companies. Your requests pass through the gateway in Sydney and are not stored there. The [Trust page](/trust) lists every provider and what each one sees.

## Your obligations

If you send personal information, the Privacy Act still applies to you. Keeping processing in Australia helps, because sending personal information overseas brings extra obligations under Australian Privacy Principle 8. It does not replace your own assessment.

A few habits help:

- Send only what the task needs. Remove identifiers where you can.
- Never send tax file numbers. The cookbook's [checks library](https://github.com/continuumlabs-ai/cookbook/blob/main/au/checks.py) can redact them before text reaches a model.
- Have a person review AI output before it affects someone.

For a data processing agreement or security questionnaire, [contact us](/contact?topic=enterprise).