Skip to main content

Privacy Policy

Zero prompt storage, UK/EU GDPR roles, UK IDTA & EU SCC transfers, and 7-year HMRC/Companies Act ledger retention

Effective Date: November 12, 2026 · Data Controller: MAGICFORGE LTD (England and Wales · Company No. 16211132) · Registered Office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

Key Summary

MAGICFORGE LTD (Company No. 16211132, London, United Kingdom) acts as Data Controller for account and billing records under the UK GDPR, the UK Data Protection Act 2018, and the EU GDPR, and acts as Data Processor (/legal/dpa) for transient API inference requests. bf16 stores 0 bytes of prompts or completions, routes exclusively to contractually verified zero-training endpoints, and retains statutory accounting ledgers for 7 years under UK law.

1. Separated Data Protection Roles & Zero-Prompt Retention

  • Data Controller: MAGICFORGE LTD (registered in England and Wales, Company No. 16211132, registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom; Data Protection contact: hello@bf16.ai) determines the purposes and means of processing developer registration, OAuth/email login, SHA-256 API key hashes, billing records, and abuse-prevention metadata.
  • Data Processor (/legal/dpa): For /v1/*, POST /mcp, and Playground inference requests, bf16 processes transient request payloads solely in volatile memory (RAM) to stream model completions and never writes user prompts, system instructions, tool payloads, reasoning traces, or completions to databases, object storage, or application logs.

2. Operational Metadata, MoR Billing & UK Statutory Retention

  1. Merchant of Record Payment Processing: Checkout payments and local VAT/GST/sales tax collection are processed by our authorized Merchant of Record partners (Waffo and Dodo Payments); MAGICFORGE LTD never receives or stores raw payment card numbers or CVV codes.
  2. Retention Schedule: Prompts and completions are retained for 0 seconds on bf16 storage; non-content operational request telemetry (token counts, latency, HTTP status, model slug, and keyed end_user_hash) is retained for a rolling 90 days; double-entry credit ledgers, top-up orders, refund records, and Prepaid Credit Statements are retained for 7 years to comply with statutory recordkeeping obligations under the UK Companies Act 2006 (Section 388) and HM Revenue & Customs (HMRC) rules.

3. Verified Sub-Processors & International Data Transfers (uk_idta_scc)

Every active upstream inference sub-processor must pass bf16's pre-activation gate (commercial_resale_permitted = true and zdr_no_training_verified = true, contractual ban on model training, and documented retention posture on each /models/$slug page). Where personal data is transferred outside the United Kingdom or the European Economic Area, MAGICFORGE LTD safeguards cross-border transfers under the UK International Data Transfer Agreement (IDTA) / UK Addendum and the EU Standard Contractual Clauses (SCCs, Commission Implementing Decision (EU) 2021/914) (uk_idta_scc).

4. Cookies, Data Subject Rights & Supervisory Complaints

bf16 uses strictly necessary first-party cookies for session security and PARAGLIDE_LOCALE language selection (see our Cookie Policy). Under UK GDPR and EU GDPR, you may exercise rights of access, rectification, erasure, restriction, portability, or objection by emailing hello@bf16.ai. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) (ico.org.uk) or your local EU/EEA data protection supervisory authority.