This policy covers InfoPlatform.ai ("IP.ai", "we", "us"), formerly operating as ModelForge.
1. Information We Collect
Account Information: Email address, business name, business type, team size, and a hashed password.
Training Data: Files you upload (CSV, JSONL, TXT, PDF, DOCX, code, and archives) used to fine-tune the base model you select. This data is used solely to fine-tune your own models and is never shared with other users or used to train our own or other customers' models.
Usage Data: Inference logs (prompts and responses), feedback ratings, training job metadata, and API usage metrics.
Payment Information: Processed by Stripe. We store only your Stripe customer ID, never your card number.
2. How We Use Your Data
- Fine-tune your chosen open-weight base model on your data
- Serve inference requests via your model's OpenAI-compatible API endpoint
- Run feasibility assessments before training
- Improve model quality through your feedback ratings and corrections
- Process payments and manage your subscription
- Send transactional emails (welcome, training complete, retrain recommendations)
3. Data Sharing & Model Providers
We share data only with the following sub-processors, solely to provide the service:
- Weights & Biases / CoreWeave (W&B): Our default "InfoPlatform Serverless" training provider (successor to OpenPipe, which retires July 30, 2026). When you use this provider, your prepared training data is transmitted to W&B to run the fine-tune; the resulting LoRA adapter is stored as an artifact in our W&B account and served from W&B infrastructure.
- DigitalOcean (our own cloud): Hosting for the InfoPlatform.ai application and database, and our "InfoPlatform Dedicated GPU" training provider. When you choose dedicated-GPU training, a GPU instance is provisioned in our own DigitalOcean account solely for your job and destroyed when it completes, so no third-party training service receives your data.
- Thinking Machines Lab (Tinker): Used only if you choose the Tinker training provider, and only when you have supplied your own Tinker API key. In that case your training runs on Thinking Machines' infrastructure under your own Tinker account, subject to their terms.
- Hugging Face: Source of open-weight base models (e.g. Kimi K2.6, DeepSeek V3.1, Qwen 3.5, Nemotron 3, GPT-OSS); we download base weights, and your raw training files are never sent to Hugging Face. Two narrower uses do transit Hugging Face's inference API: (a) serving, for the few catalog models marked as router-served; and (b) the Knowledge Base, an opt-in feature. If you enable a Knowledge Base, PII-masked text chunks of that data (and PII-masked chat questions asked of that model) are sent to Hugging Face's inference API to compute search embeddings and short retrieval summaries. Skipping the Knowledge Base opt-in keeps your data off this path entirely, and deleting knowledge data removes the stored chunks immediately.
- Anthropic (Claude API): Feasibility analysis, data cleaning, intent parsing (goal descriptions and sampled records, not your full dataset), and document parsing for scanned or image files. When you upload a scanned PDF or an image document, page images of that file are sent to Anthropic's API to transcribe the text so it can be cleaned, indexed for a Knowledge Base, or used for training. Unlike text chunks, whole-page images cannot be PII-masked before transcription, so please do not upload image documents whose full contents you do not want processed this way. We use Anthropic only to analyze and prepare your data, never to fine-tune anyone else's model.
- Stripe: Payment processing
- Resend: Transactional email delivery
We never sell your personal information. We never use your data to train our own or other customers' models.
3a. Export-controlled, CUI, and other restricted data
Read this before uploading anything subject to export controls (EAR/ITAR), or anything that is Controlled Unclassified Information (CUI) under CMMC. It overrides any marketing copy.
Some features send data to third parties. For controlled material that transfer may itself be regulated, so those features are not appropriate. This configuration keeps training data on infrastructure we operate:
- Training provider: Dedicated GPU. An instance in our own cloud account, for your job alone. Serverless and Tinker send prepared data to that provider.
- Knowledge Base: off. On, it sends PII-masked text chunks and chat questions to a third-party embedding API.
- Uploads: text only. Scanned PDFs and images are transcribed by Anthropic, and page images cannot be PII-masked first.
- Feasibility and cleaning: send goal descriptions and sampled records to Anthropic. Ask us to disable this before you upload.
Even then, the data sits on infrastructure we operate, not inside your network. If it must never leave your premises, or only screened persons may access it, the answer is an in-house implementation, available by contract. Ask before uploading.
CUI under CMMC is in-house only. DFARS requires any cloud service that stores or processes CUI to be FedRAMP Moderate at minimum, and our hosted platform is not FedRAMP-authorised. The hosted platform therefore cannot lawfully serve CUI at all. CUI work is available only as an in-house implementation, by contract, where the whole training and inference stack runs inside your own infrastructure. If your data may be CUI, do not upload it to the hosted platform; ask us about an in-house deployment first.
Classifying your data and deciding whether a transfer is permitted is your responsibility. We are not your export-control adviser or your CMMC assessor, and this is not legal advice.
4. Model Ownership
Open-weight models: When you fine-tune an open-weight model, the resulting adapter weights are yours. Under the serverless backend they are stored as artifacts in InfoPlatform.ai's W&B account; under the GPU-droplet backend they are stored in InfoPlatform.ai-controlled object storage; under the Tinker provider they are stored on Thinking Machines' infrastructure under your account. You can request an export to run them in your own environment, subject to the underlying base model's license (e.g. MIT, Apache 2.0). We never train shared models on your data.
5. Data Security
- Passwords hashed with bcrypt (12 salt rounds)
- MCP server credentials encrypted with AES-256-GCM
- On the Dedicated-GPU backend, trained weights stored in encrypted object storage (AES-256)
- Data transmitted to and from the app over TLS
- JWT tokens expire in 24 hours, refresh tokens in 7 days
6. Your Rights (GDPR)
If you are in the EU/EEA, you have the right to:
- Access: Request a copy of all data we hold about you
- Rectification: Update or correct your personal information
- Erasure: Request deletion of your account and all associated data
- Portability: Export your data in a machine-readable format
- Restriction: Request we stop processing your data
- Objection: Object to data processing based on legitimate interests
To exercise any of these rights, email privacy@infoplatform.ai or use the account deletion feature in Settings.
7. Data Retention
We retain your data as long as your account is active. When you request account deletion:
- 30-day grace period to cancel the deletion request
- All personal data, models, datasets, and inference logs permanently deleted after 30 days
- Billing records retained for 7 years as required by law
Automatic training-data deletion. When you create a model you may enable "delete my training data after training." If enabled, the raw files you uploaded for that model are permanently deleted from our servers the moment training completes; you do not need to wait for account deletion. We keep only the dataset's name and non-content metadata (for your own audit trail and billing), never the file contents. Deletion is irreversible; retraining afterward requires uploading data again.
8. Cookies
We use only essential cookies:
- mf_token: Authentication (24-hour expiry)
- mf_refresh_token: Session refresh (7-day expiry)
- modelforge_cookie_consent: Your cookie preference (localStorage)
We do not use third-party tracking cookies or analytics trackers.
9. Children's Privacy
InfoPlatform.ai is not intended for users under 18. We do not knowingly collect data from minors.
10. International Data Transfers
Your data may be processed in the United States. We use Standard Contractual Clauses (SCCs) where required to protect data transferred outside the EU/EEA.
11. Changes to This Policy
We may update this policy from time to time. We'll notify you of material changes via email. Continued use of InfoPlatform.ai after changes constitutes acceptance.