The main points
Chat saves your conversations so you can return to your work. New native inference API requests do not create persistent prompt or response history in NotHoly. Account, usage, billing and security records follow separate retention rules.
NotHoly integrates hosted models. We do not train the underlying model weights. Requests, conversation context and selected sources may contain personal information even when they are sent without account identifiers.
Who operates NotHoly
NotHoly is operated by 59.611.478 MATHEUS DE MORAIS CAETANO - ME, Brazil, CNPJ 59.611.478/0001-09. Contact support@notholy.com for privacy questions or requests about your information.
We determine how accounts, billing and service security are administered. If you submit information on behalf of an organization or about other people, the responsibilities of each party depend on the processing activity and any applicable agreement.
Information we process
We process account information such as your name, email, authentication records and preferences. Workspace information can include conversations, uploads, selected sources, evidence and action approvals. Support messages contain the information you choose to send.
Usage and payment records include identifiers, token counts, rate versions, reservations, charges, subscription status, invoices, refunds and disputes. Operational records can include request identifiers, timestamps, route, status, duration and IP-related security controls. The application request logger records operational metadata rather than prompt or response bodies.
Why we use information
We use information to provide the requested service, authenticate and protect accounts, measure and bill usage, investigate failures, answer support requests and meet legal obligations or handle claims. Depending on the activity, the applicable basis may include performing a contract, complying with law, exercising legal rights or proportionate legitimate security interests. Where consent is required, you may withdraw it as provided by law.
Submit only information needed for your work. You are responsible for having an appropriate basis to share information about other people. Security research does not remove those responsibilities.
Native API prompts and responses
The native inference endpoints are /v1/chat/completions, /v1/completions, /v1/responses and /v1/messages. New requests through these endpoints use encrypted processing caches instead of persistent prompt or response history. Cache access expires no later than 15 minutes after acceptance; reads and writes do not extend that limit. Caches may be removed earlier when transmission ends and the run is terminal.
Content-free usage, payment, request-status, security and duplicate-prevention records remain. An expired or unavailable result is not automatically generated again. This policy does not erase records created before it took effect or their historical backup copies.
An API key or /v1 prefix alone does not define this policy. Owned /api/runs and /v1/runs workflows, including CLI conversations, keep their normal history. Your application, SDK logs or browser may also keep copies under your control.
Chat, files and workspace history
Chat conversations are stored so you can reopen them. Workspace features can retain uploaded material, extracted text, evidence and specific action approvals. Selected sources and enabled memories may be included in later model context.
Use the supported account data controls to request export or deletion. Deleting a source can remove derived content and stop dependent work. Active-content deletion, queued object removal and backup expiration are separate steps; deletion is not an immediate physical wipe of every independent copy.
Processors and international processing
Service providers can process information for hosting, storage, model inference, payments, email delivery and support. NotHoly sends model requests from its servers. We do not add your customer IP, email, account identifier or NotHoly API key to the model provider headers; submitted content can still contain that information.
Processing locations and downstream providers depend on the services and model route used, and may be outside Brazil. Upstream retention and caching are not covered by an unconditional NotHoly zero-retention guarantee. Contact support@notholy.com to request information about recipients, processing locations and applicable transfer safeguards.
Retention
We retain information for the purpose that justifies it. Chat history supports ongoing workspace use. Authentication challenges and sessions expire under their security settings. Financial, fraud-prevention and legal-claim records may remain after content or an account is removed where an applicable basis allows or requires this.
Backups are recovery copies and can outlast deletion from active systems. Restored data must respect completed deletion requests. A processing-cache access limit is not proof that every physical storage copy, external processor copy or older backup has disappeared. Contact us about retention for a particular category or request.
Your choices and rights
Under applicable data-protection law, including Brazil's LGPD, you may request confirmation of processing, access, correction and information about sharing. Applicable rights also include portability, anonymization, blocking or deletion, withdrawal of consent, objection and review or explanation of qualifying automated decisions. Legal exceptions may limit deletion or require certain records to remain; a refusal or limitation must be explained.
Use the account data controls or email support@notholy.com. We may request proportionate information to verify your identity and protect the account. Exercising applicable data rights is free. You may also approach the ANPD or the competent consumer authority. The applicable legal deadline depends on the type of request.
Cookies and local storage
Session and security cookies support sign-in. A language preference can remember your selected locale. Browser storage can retain local drafts and preferences. Blocking a mechanism can affect the feature that uses it.
Services involved in authentication, security or measurement may have their own cookie and storage behavior. Contact support@notholy.com for information about a particular interaction. Optional processing that requires consent must remain subject to that requirement.
Security and incidents
Access controls, credential protection, scoped keys, authentication factors, usage limits and permission checks help protect the service. Platform-executed actions remain subject to their actual scope and approval rules. No system can guarantee perfect security.
Report suspected exposure to support@notholy.com without sending passwords, full keys or unnecessary sensitive content. We assess incidents and the notification obligations that apply to them.
Changes and contact
This policy takes effect when published. We identify the version and publish material changes with the notice or further steps required by applicable law. New purposes or consent-dependent processing remain subject to the relevant legal requirements.
For privacy questions, contact support@notholy.com. The operator's identity appears above. The same channel accepts requests about processing responsibilities, recipients, international transfers and retention.