Legal

Privacy Policy

Tarka is operated by TarkaHQ, Inc., a Delaware corporation (“Tarka”), and its wholly owned subsidiary Tarka Pvt. Ltd. (Kathmandu, Nepal), which runs Tarka’s fleet in Kathmandu and contracts with customers in Nepal. This policy explains how both handle personal data and customer data on tarkahq.com, in the console, and through the API at tarka.rest. The data handling page restates the parts about prompts, outputs and stored data in plain terms; this policy governs where they differ.

1. What we collect

Account data

When you create an account we collect your email address, your name if you give one, the organization you create or join, and the sign-in method you use. When you request access to a product we also collect what you tell us about your intended use.

Billing data

Payment details are collected and held by our payment processor; we see the payment method’s type, its last four digits and expiry, the billing address, and the record of charges and credit. Usage records for billing are described in §3.

Request metadata

For every API call we record which organization and API key made it, the request ID, the model and region, timestamps and latency, whether it succeeded, token counts or media duration or page counts, the resulting cost, and the size of the request and response. This metadata never includes the content of a request or response.

Content you send and store

Prompts, uploaded media and model outputs sent to inference endpoints are processed to produce the response. Data you put into agent hosts, object storage, hosted Git and sandboxes is stored to provide those services. How long each is kept is in §3.

Website and support data

Our edge network provider’s privacy-first web analytics records page views on tarkahq.com: the page path, the referring site, country, browser and device type, and page load timing. It sets no cookies, does not fingerprint visitors, and never receives the query string or fragment of a URL, so sign-in and invitation tokens stay in your browser. If you write to us, we keep the correspondence.

2. What we do not do

• We do not use prompts, outputs, agent memory, files, repositories or tool-call data to train or fine-tune models, ever.
• We do not read the content of your requests or stored data except to operate the service, to investigate abuse or a security incident, or at your request.
• We do not share customer data with third parties for advertising, and we do not sell it.

3. How long we keep it

Models served by Tarka. By default, prompts, media and outputs are processed in memory and discarded once the response is returned; nothing is written to disk or to logs. Retention is a property of the model alias, not of price or plan, and is off for every alias except two: the six himalaya evaluation aliases without a -private suffix keep inputs and outputs in a Tarka-controlled archive, reachable only by verified Tarka operators, for evaluation and debugging until Tarka deletes them, and deleting your organization does not delete that archive; and the Responses API keeps conversation state for 30 days only when you send store: true.

Models served by partners. Requests to partner-served models pass through Tarka’s router, which keeps only the metadata in §1, and are forwarded to the partner, whose retention terms apply. We choose partners whose published terms commit to not retaining request or response content beyond what is needed to serve the request; that commitment is the partner’s, not ours.

Capture you enable. An organization owner or admin can enable inference capture, which writes every admitted model call into an inference-history bucket in your own object storage for the period you choose: until deleted, or 7, 30 or 90 days. Capture is off until you turn it on. If you capture data about your own users, you are the controller of that data and responsible for telling them.

Agent hosts, object storage, hosted Git, sandboxes. Stored until you delete it. Sandbox state is discarded when the sandbox finishes. If your credit runs out, storage becomes read-only and hosts pause; nothing is deleted. After you close your account we delete your stored data within 30 days, apart from the records this section says we keep longer.

Request metadata and usage records. Operational logs and metrics are kept for days, not months; both are payload-free, and API keys are redacted before they are written. Usage and billing records are kept for as long as tax and accounting law requires in the United States and Nepal, up to ten years.

Account data. Kept while your account is active and for 12 months after closure, except where billing records require longer.

4. Why we process it and on what basis

We process your data to provide the service you signed up for, to bill you, to keep the platform secure and reliable, to improve it by analysing request metadata in aggregate, and to meet legal obligations. Tarka offers its service to people in the EU and UK, so the GDPR and UK GDPR apply to their data even though Tarka is a US company. For them, the lawful bases are performance of a contract (Art. 6(1)(b) GDPR) for providing and billing the service, legitimate interest (Art. 6(1)(f)) for security, abuse prevention and aggregate product analytics, legal obligation (Art. 6(1)(c)) for tax and accounting records, and consent (Art. 6(1)(a)) for product announcements, which you can withdraw at any time.

5. Subprocessors

We update this list before adding a subprocessor and notify active customers by email.

6. Your rights

People in the EU and UK may access, correct, delete, restrict and port their personal data, object to processing based on legitimate interest, withdraw consent, and complain to a supervisory authority. People in Nepal have the equivalent rights under Nepal’s Individual Privacy Act, 2075 (2018). Write to privacy@tarkahq.com; we answer within 30 days. Organization owners can delete API keys, stored data and the organization itself in the console at any time.

7. Cross-border transfers

Tarka is a US company whose control plane and billing run in Europe, whose models run on its fleet in Kathmandu, Nepal, and in its European and US East cells, and whose engineering staff in Kathmandu operate the platform. Personal data therefore moves between the EU, the United States and Nepal; the data residency page lists each location and which countries are verified. For data of people in the EU and UK, transfers to Tarka in the United States and to Tarka Pvt. Ltd. in Nepal rely on Standard Contractual Clauses (Modules 1 and 2) between the Tarka entities and in our customer Data Processing Addendum, and transfers to US subprocessors rely on the EU-US Data Privacy Framework where the recipient is certified and on Standard Contractual Clauses otherwise. Tarka’s EU representative under Art. 27 GDPR is named on request until one is published here. A Data Processing Addendum is available on request for customers who need one.

8. Security

API keys are stored hashed and shown once. Browser sessions use server-managed cookies that JavaScript cannot read. Customer data is scoped to an organization and isolated from other customers. Operator access to production requires a verified Tarka identity and an active operator grant. If we learn of a breach affecting your personal data, we notify you without undue delay and, where required, the supervisory authority within 72 hours.

9. Children

Tarka is not directed at anyone under 16 and we do not knowingly collect their data.

10. Changes

If we materially change this policy, we email active customers at least 30 days before the change takes effect.

Last updated: 2026-10-31.