Portal AI Platform No-Training & Data Use Policy

Last updated: June 27, 2026

This No-Training & Data Use Policy explains, in plain terms, how Portal AI Inc. (“Portal”, “we”, “us”, or “our”) handles Customer Data submitted to Portal AI Platform, including platform.portal.ai, CoreX private access, Portal APIs, modules, and related services (the “Service”). It supplements our Terms of Service, Privacy Policy, Acceptable Use Policy, and Data Processing Agreement.

This policy describes the developer and business platform. Portal One+ consumer assistant services are governed separately: Portal One+ provides persistent agent memory and retains data as described in the Portal One+ Privacy Policy, so the platform retention windows in this policy do not describe Portal One+. The no-training, no-sale, and no-unauthorized-sharing commitments apply to both products.

1. The Core Commitments

• No training. We do not use Customer Data to train, fine-tune, or improve AI models.

• No provider training. We require providers and subprocessors involved in delivering the Service to process Customer Data only for service delivery and not to use it for model training, fine-tuning, or model improvement.

• Route assurance. Portal will not route Customer Data to any provider for which Portal has not confirmed contractual or published policy terms prohibiting model training, fine-tuning, or model improvement on Customer Data for that route.

• No sale. We do not sell, rent, or license Customer Data.

• No unauthorized sharing. We disclose Customer Data only to providers and subprocessors strictly necessary to deliver, secure, support, or comply with the Service; to comply with law; to enforce our terms; to protect rights, safety, and security; or with your instruction or consent.

• Limited retention. We retain Customer Data only as long as needed to provide the Service and no longer than thirty (30) days from submission unless a shorter retention route applies, you configure or agree to a different retention setting, or retention is required or permitted for law, security, fraud prevention, dispute resolution, or abuse investigation.

These retention windows describe transient processing of API inputs and outputs on the Platform. Where a Platform feature is expressly designed to store data on your behalf, such as customer-visible logs, history, or a stateful module you enable, that data is retained for the life of the feature or your account per its settings, as described where the feature is offered.

• You own your data. As between you and Portal, you own your inputs and outputs. We host and process Customer Data to provide the Service; we do not claim ownership of it.

2. What Counts as Customer Data

Customer Data includes prompts, messages, inputs, files, API payloads, context, instructions, outputs, and, where enabled or stored, account-visible call content such as response content, reasoning traces, tool-call metadata, and debugging records submitted by or returned to you through the Service. Customer Data does not include Service Data, billing records, security logs, account records, or aggregated/de-identified metrics that do not contain prompt, file, or output content.

3. What We Do Collect and Use

To operate the Service, we process Service Data such as timestamps, token counts, route or model identifiers, module selection, cost, latency, status, errors, fraud and abuse signals, account status, and billing records. We use Service Data to operate, bill, secure, troubleshoot, analyze, and improve the Service. Service Data is never used to train AI models.

Aggregated or de-identified data may be used to understand reliability, cost, capacity, routing, abuse trends, and product health, provided it does not identify you and does not include Customer Data content.

4. Our Infrastructure

The Service runs on Portal’s proprietary infrastructure, routing, controls, modules, and API surfaces. To deliver a response, Customer Data may be processed through Portal systems and, where necessary, providers or subprocessors that help deliver the Service. We do not publicly disclose the specific composition of this infrastructure or the identities of underlying providers because they are confidential.

Every provider or subprocessor involved in processing Customer Data is required to honor no-training, confidentiality, security, and limited-retention obligations appropriate to its role.

5. Abuse, Security, and Compliance Reviews

To keep the Service secure, Customer Data that triggers automated safety, abuse, fraud, or security signals may be reviewed to investigate and prevent misuse, enforce our policies, protect users and third parties, comply with law, or secure the Service. Customer Data reviewed for abuse, security, or compliance is not used for model training.

6. Support, Debugging, and Service-Quality Reviews

Portal systems, authorized Portal personnel, and approved providers may access or review Customer Data when reasonably necessary to provide responses, operate routing and tools, deliver support, debug issues, resolve billing or usage disputes, maintain reliability, or improve the safety, quality, and functionality of the Service. This is operational review, not model training. We do not use Customer Data reviewed for support, debugging, reliability, or service-quality purposes to train, fine-tune, or improve AI models.

7. Service Operation Is Not Model Training

Processing Customer Data to generate a response, route a request, maintain account-specific logs or history, create customer-visible call records, meter usage, build abuse or security signals, debug a customer-requested issue, or maintain the reliability and functionality of Portal systems is service operation, not model training. Portal does not use Customer Data to train, fine-tune, or improve Portal or third-party AI models.

8. Customer Controls and Enterprise Documentation

These commitments apply to every Portal AI Platform customer; they are not an upgrade. Enterprise customers may request our Data Processing Agreement, security summary, and additional subprocessor information under NDA or a written data processing arrangement where required.

9. Changes

We will not use a policy update to retroactively authorize training of Customer Data or materially more permissive Customer Data use without appropriate notice and consent.

10. Contact

Questions about how we handle data: privacy@portal.ai