Privacy Policy
Effective date: 25 October 2026
1. Who we are
FENRIR is an AI inference service: an API that runs large language models for business customers, and a web console for managing access, usage and billing. FENRIR is operated by PT. Horizon Internusa Persada (Indonesia) ("we", "us", "our"). You can reach us at hello@lio.id.
This policy explains what data we handle when you use the FENRIR API or console, why we handle it, and how long we keep it.
2. The short version
- We do not store the text of your prompts or of the model's outputs. They are processed in memory while your request is served and are then discarded.
- We do not use your prompts or outputs to train or improve any model.
- The models run on our own hardware in Indonesia. Your requests are not sent to any third-party AI model provider.
- We keep request metadata (who called which model, when, how many tokens, how long it took and whether it succeeded) for billing, security and support.
3. What we collect
Account data. For each customer organization: its name and the billing details you give us (billing email, address, reference, tax ID, website). For each console user: email address, username, display name, role, and the password stored only as a salted one-way hash.
API keys. Only a one-way hash of each key, its first few characters (so you can recognise it), its label, and when it was created, last used and revoked. We cannot show a key again after it has been created.
Request metadata. For every API request: the time, a request ID, your organization, the API key used, the model, the number of input, cached-input and output tokens, the response time, the status (including whether the caller disconnected before the answer finished), the price applied and the resulting cost, and, when it is switched on, the result of the personal-data check described below.
Prompts and outputs. The content you send and the answers the model returns are processed in memory to serve your request. FENRIR does not write them to its database or its logs, and our model servers do not log them. To answer repeated prompts faster, the model servers keep recently processed prompt data in memory for a short time (a "prefix cache"); it is never written to disk and is overwritten automatically as new requests arrive.
Personal-data (PII) check. FENRIR can scan prompts for personal data such as names, email addresses, phone numbers and card numbers when this check is switched on for your organization. We record only the type of data found and how many times (for example "EMAIL_ADDRESS: 2"), never the matched values. By default the prompt is forwarded unchanged; your organization can instead choose to have personal data replaced by a label before it reaches the model, to have such requests refused, or to switch the check off. Recent scan results are held in memory only, so the same text is not scanned twice, and are lost when the service restarts. Model outputs are not scanned.
Technical and security data. The IP address of each API caller, recorded with each request in our audit log and in our service logs. For console sign-ins, the IP address and browser user agent of the session. Our edge proxy logs the time, path, status, size and user agent of each request.
Payments and credits. Records of credits, payments and invoices for your organization. Card and bank payments are handled by our payment providers. We never see or store your full card number or security code. For auto top-up we keep the provider's card token, the card brand, its last four digits and its expiry date.
Our website and console use Google Tag Manager with Google Analytics 4 and the Meta Pixel, which set analytics and advertising cookies. They are not loaded where you enter payment card details and never receive your prompts or outputs. Our homepage also uses a web analytics service that sets no cookies. The console uses one essential cookie to keep you signed in.
4. How we use it
- To provide the service: authenticate requests, send them to the right model, and enforce your quotas and credit.
- Metering and billing: count tokens, calculate charges, and produce invoices and usage reports for your organization.
- Security and abuse prevention: detect misuse, investigate incidents, and keep a tamper-evident audit log.
- Support and debugging: diagnose errors you report or that we detect.
- Referral program: if an account signs up with a referral code, we record which account referred it, so we can work out commission and the welcome bonus. The referrer sees only totals: how many accounts signed up and paid, and the commission earned. Because commission is a share of what referred accounts pay, those totals reflect their combined spending. They never show who signed up, their usage or their individual payments.
We do not sell your data. We disclose it only where Indonesian law or a valid legal order requires us to.
5. How long we keep it
| Data | How long |
|---|---|
| Prompts and outputs | Not stored. Held in memory only while a request is processed. |
| Personal-data check results | Type and count only, kept with the request metadata. Matched values are never stored. |
| Request metadata (the usage ledger) | For the life of your account, and afterwards for as long as needed for billing, accounting, tax and legal purposes. It is kept even if an organization is deleted, because it is the billing record. |
| Audit log (including caller IP addresses) | Kept indefinitely. It is append-only and tamper-evident, so entries are not deleted. |
| Account data | While your account is active, and afterwards as needed for billing, accounting and legal purposes. You can ask us to delete it (section 9). |
| Console sign-in sessions (IP address, user agent) | Expire after 12 hours and are removed after they expire. |
| Service logs (caller IP address, request path, status) | Rotated out automatically by size; at current volumes after about two months. |
| Edge proxy logs | 14 days. |
| Database backups | A daily backup, of which the last 14 are kept. Occasional extra snapshots taken before maintenance are deleted when no longer needed. |
6. No training on your data
We do not use your prompts or outputs to train, fine-tune or improve any model, and we do not give them to anyone who would. The models we serve are pre-trained; your usage does not change them.
7. Where your data is processed
Our API gateway, model servers and databases run on hardware we operate in a data centre in Indonesia. No third-party AI model provider receives your prompts or outputs. Traffic travels to us over encrypted HTTPS through our edge network and hosting infrastructure, which processes connection data such as IP addresses in order to deliver and protect it.
8. Security
- All public traffic is encrypted with HTTPS.
- API keys and passwords are stored only as one-way hashes.
- The console requires sign-in, access is limited by role, and repeated failed sign-ins are locked out.
- Every consequential action is written to a tamper-evident audit log.
- Our servers are not directly exposed to the internet; only the public API paths are reachable, through our edge proxy.
- Access to production systems is limited to authorised staff.
No system is perfectly secure. If you think a key has leaked, revoke it in the console and tell us.
9. Your rights
Under Indonesian law, including the Personal Data Protection Law (Law No. 27 of 2022), you may ask us to tell you what personal data we hold about you, to correct it, or to delete it, and you may withdraw consent where we rely on it. Some records (such as billing and audit records) may have to be kept to meet legal obligations. Send requests to hello@lio.id.
If you include personal data about other people in your prompts, you are responsible for having the right to do so.
10. Changes
We may update this policy. We will publish the new version on this page with a new effective date and, for significant changes, tell account holders before the change takes effect.
11. Contact
PT. Horizon Internusa Persada, Indonesia
hello@lio.id