Privacy Policy

# Privacy Policy

**Last updated:** 2026-07-03
**Status:** Draft pending legal review.

Graphene (operated by Tokenomik Australia Pty Ltd, "Graphene", "we", "us") provides an orchestration layer for AI inference: a single API that routes requests to AI models running on owned, partner and spot GPU capacity. This policy explains what we collect, why, and your choices. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and with other laws that apply where you are located.

## What we collect

**Account and workspace data.** Name, email address, authentication identifiers, workspace membership and roles, and settings you configure.

**API usage metadata.** For every request routed through Graphene we record metadata needed to operate, meter and bill the service: model requested, token counts, latency, routing decision, workspace and API key identifiers, timestamps, and error states. Routing decisions are retained in an auditable ledger so that usage and residency posture can be verified.

**Prompt and completion content.** Your prompts and model outputs transit our infrastructure so we can route them to the selected model provider or GPU capacity. We do not use your prompts or outputs to train models. Content handling and retention windows are documented in your agreement and in the docs; enterprise agreements can specify residency constraints for content in transit and at rest.

**Billing data.** Payments are processed by Stripe. We do not store full card numbers. We retain billing records (invoices, usage statements) as required by tax and corporations law.

**Analytics and cookies.** When analytics is configured, we may load a third-party analytics script. Where consent is required, a banner is shown before any analytics script loads, and your choice is stored in a first-party cookie (`graphene_consumer_analytics_consent`). Declining does not affect the product.

## Why we process it

To provide and secure the service; to meter usage and bill accurately; to enforce routing and residency policy you configure; to prevent abuse and fraud; to meet legal obligations; and, with your consent where required, to understand product usage. We do not sell personal information. We do not use customer prompt or completion content for advertising or model training.

## Disclosure

We disclose data to the subprocessors needed to run the service: model providers your requests are routed to, GPU capacity partners (workload content only as needed to execute your request under the routing policy in force), Stripe (billing), our cloud hosting providers, and analytics providers when enabled. A current subprocessor list is available on request and, when published, at /docs. Some subprocessors are located outside Australia; where they are, we take steps required by APP 8 regarding cross-border disclosure. Workloads routed under a sovereign residency profile are constrained to in-region capacity per your agreement.

## Security and retention

Data is encrypted in transit. Access is role-based and logged. We retain account and billing records for as long as your account is active plus periods required by law, and API usage metadata for operational and audit purposes as described in the docs. You can request deletion of your account data subject to legal retention obligations.

## Your rights

You may request access to, correction of, or deletion of your personal information, and complain to us or to the Office of the Australian Information Commissioner (OAIC). Where GDPR, the CCPA or comparable laws apply to you, you have the rights those laws provide, including portability and objection.

## Contact

Privacy enquiries: use the Contact page or write to the privacy contact listed there. We respond to verified requests within the timeframe required by applicable law.