We do not train on your data
BaliLLM never uses the prompts or completions submitted through our inference API to train, fine-tune, evaluate, or otherwise improve any machine learning model, ours or anyone else's. Your inputs and outputs remain yours. See Section 5 and Section 6 for the full commitment and how request logs are handled.
1. Introduction
This Privacy Policy explains how PT Bali Towerindo Sentra Tbk, operating the BaliLLM inference platform at balillm.ai ("BaliLLM," "we," "us," or "our"), collects, uses, stores, and protects information when you use our API, dashboard, and related services (collectively, the "Service"), including when the Service is accessed through an authorized reseller or marketplace.
By using the Service, you agree to the collection and use of information in accordance with this Policy. If you do not agree, please do not use the Service.
2. Information We Collect
2.1 Account and Contact Information
When you or your organization register for access, we may collect your name, company name, email address, billing details, and API credentials.
2.2 Request Data (Prompts and Completions)
To process an inference request, we necessarily receive the content you submit ("prompts") and generate a response ("completions"). This content is processed in memory to fulfill your request and is not retained for training purposes — see Section 5 for exact retention windows.
2.3 Technical and Usage Metadata
| Category | Examples |
|---|---|
| Request metadata | Timestamp, model ID, token counts, latency, HTTP status code, finish reason |
| Network data | IP address, user agent, approximate region (for abuse prevention and routing) |
| Billing data | Usage volume, invoicing details, payment status (processed via our payment provider) |
| Support data | Correspondence you send us via email, chat, or support tickets |
3. How We Use Information
- To operate, maintain, and provide the Service, including generating completions in response to your prompts.
- To monitor uptime, latency, and throughput, and to publish aggregated performance metrics as required by marketplaces.
- To detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms of Service.
- To calculate usage and process billing.
- To respond to support requests and communicate service updates.
- To comply with applicable law, regulation, or lawful government request.
4. Legal Basis for Processing
We process personal data on the following bases, consistent with Indonesia's Law No. 27 of 2022 on Personal Data Protection (Undang-Undang Perlindungan Data Pribadi, "UU PDP") and, where applicable, other data protection laws:
- Performance of a contract — to provide the Service you or your organization requested.
- Legitimate interests — to secure our systems, prevent abuse, and improve reliability, balanced against your privacy interests.
- Legal obligation — to comply with applicable tax, accounting, or regulatory requirements.
- Consent — where required, such as for optional marketing communications.
5. Data Retention
| Data type | Retention period | Purpose |
|---|---|---|
| Prompt and completion content | Up to 30 days, then permanently and irreversibly deleted | Abuse detection, security monitoring, and debugging only |
| Request metadata (no content) | Up to 24 months | Billing, analytics, uptime and performance reporting |
| Account and billing records | As required by applicable tax and accounting law (typically up to 10 years in Indonesia) | Legal and financial compliance |
| Support correspondence | Up to 24 months after resolution | Quality assurance and dispute resolution |
After the applicable retention period, prompt and completion content is permanently deleted from our production systems and backups on a rolling basis. We do not maintain a long-term or indefinite archive of prompt content.
6. No Training on Customer Data
Our commitment, in plain language
We will never use the content of your API requests or responses — including prompts, completions, embeddings, or any derivative of them — to train, fine-tune, distill, or otherwise improve any AI or machine learning model, whether operated by BaliLLM or any third party. This applies regardless of whether the Service is accessed directly or through a reseller.
The only exceptions are: (a) with your prior written, opt-in consent for a specific, clearly-described purpose; or (b) aggregated, de-identified statistics (e.g., token counts, latency) that contain no prompt or completion content and cannot be used to reconstruct your data.
7. Data Sharing and Third Parties
We do not sell personal data or customer content. We share information only as follows:
- Marketplaces: if you access our Service through a marketplace, that marketplace acts as an intermediary and has its own privacy practices governing the data it collects from you; please review that marketplace's privacy policy separately.
- Infrastructure and subprocessors: cloud hosting, payment processing, and monitoring vendors who process data on our behalf under contractual confidentiality and data protection obligations, and only to the extent necessary to provide the Service.
- Legal and safety: where required to comply with law, a valid legal process, or to protect the rights, property, or safety of BaliLLM, our users, or the public.
- Business transfers: in connection with a merger, acquisition, or sale of assets, subject to continued protection under a substantially similar privacy policy.
8. Data Security
We apply industry-standard technical and organizational measures to protect information, including encryption in transit (TLS), encryption at rest, access controls and audit logging, and regular security review of our infrastructure. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
9. Your Rights
Subject to applicable law, including the UU PDP, you may have the right to:
- Request access to, or a copy of, personal data we hold about you;
- Request correction of inaccurate or incomplete personal data;
- Request deletion of your personal data, subject to legal retention requirements;
- Object to or restrict certain processing;
- Withdraw consent, where processing is based on consent, without affecting prior lawful processing; and
- Lodge a complaint with the competent Indonesian data protection supervisory authority.
To exercise these rights, contact us using the details in Section 12. We will respond within the timeframe required by applicable law.
10. Children's Privacy
The Service is intended for business and developer use and is not directed to individuals under 18. We do not knowingly collect personal data from children. If we learn we have collected such data, we will delete it promptly.
11. Changes to This Policy
We may update this Policy from time to time. Material changes will be notified via the Service, our website, or email at least 14 days before taking effect. The "Last updated" date at the top of this page reflects the most recent revision.
12. Contact Us
If you have questions about this Privacy Policy or wish to exercise your data protection rights, contact us at:
| Data protection / privacy inquiries | privacy@balillm.ai |
| General support | support@balillm.ai |
| Registered address | Autograph Tower Thamrin Nine Jl. Kota Bumi No.10, RT.14/RW.20, Kb. Melati, Kecamatan Tanah Abang, Kota Jakarta Pusat, Daerah Khusus Ibukota Jakarta 10230 |