Metadata and data retention policy

What an event may contain

• The call: provider, model, operation, input, output and cached tokens, other usage units such as characters or audio seconds, latency, status, error category and any cost the provider reported.
• Where it ran: environment, application, workflow, feature, and links between steps of the same execution.
• Who it was for: customer, plan, user and conversation IDs, and prompt IDs and version labels. You choose these values. Use internal IDs rather than names or email addresses where you can.
• MCP calls: server and tool name, transport, authentication category, outcome and direct cost.
• Model servers you run: from vLLM's traces, each request's ID, model, token counts and time in the queue and in the model; from GPU metrics, utilization, GPU count and running requests, rolled up per pool and hour. Trace and metric content beyond these is not kept.
• Custom attributes: up to 50 keys, 16 KB in total, with strings up to 1,000 characters.

What Ganivra rejects

An event is refused if an attribute is named like content or a secret: prompt, response, completion, message or messages, content, request or response body, tool arguments, input, output or result, API key, authorization, OAuth scopes or workspace ID. This guards against content being sent by mistake. It cannot catch content placed under another name, so do not put prompts, responses, tool payloads, credentials or personal data in attribute values.

OpenTelemetry from coding tools such as Claude Code is read for usage only, and its prompt, response and tool content is never copied. It can identify a developer by email address or account ID, which becomes that call's user ID. See privacy for how to send a different label.

What Ganivra adds

Each event gets a cost, the rate and source behind it, and, where the model allows it, an estimated energy and carbon figure. Costs are recalculated when a price, contract rate or GPU pool changes. Most changes are recorded as revisions with the old and new value. GPU pool splits are recalculated every hour: changes during the running day are not kept, and the call's breakdown shows its day, rate and whether it is still provisional. Once the day has finished, changes are recorded. The terms describe the limits of GPU estimates.

How long records are kept

Workspace records are kept while the workspace exists, so past reports, margins and reconciliations stay reproducible. Nothing expires automatically today.

Deleting data

To delete specific events, a workspace or an account, email founder@ganivra.com from the address on the account. When a workspace is deleted, its events, revisions, audit history, settings and keys are deleted with it. Our hosting and database providers may keep backups for a limited time before they are overwritten. Removing a GPU pool in the dashboard deletes it straight away and returns its calls to unpriced.