What answers you, and what it does with your mail.
We are asking you to trust an address that answers your mail. That is not a thing to manufacture with a privacy policy nobody reads, so this page is the short version: what answers you, where it runs, what leaves the building, what we keep, what we will not claim, and how you check any of it without taking our word for it.
Two lanes, and we tell you which one answered
The on-premises lane runs on NGARi-controlled hardware on models we load ourselves — an open-weights model is a file on a disk, and running it sends nothing to the company that trained it. It is the lane we are building toward and the one we control end to end.
| Model (as loaded) | Family / origin | Runs on | What leaves |
|---|---|---|---|
qwen3.8:27b | Qwen (Alibaba, China) — open weights, Apache-2.0 | NGARi hardware | Nothing |
ngari-ft-distilled-v5:stable | NGARi distillation, 1.5B | NGARi hardware | Nothing |
all-minilm | open-weights embeddings | NGARi hardware | Nothing |
The hosted lane exists because some work needs a larger model than the box holds today. Stated plainly: an active ID on a live plan is served by the hosted lane by default today, because the model that fits the work does not yet fit on our hardware at the quality you are paying for. You can turn that off for your own ID (see the switch below) and the answer to your mail then never leaves our premises. When the hosted lane is used, the request goes to one of three providers. All three are Chinese-headquartered companies, and we name them rather than hide them:
| Provider | Country | Models | In the catalogue |
|---|---|---|---|
| DeepSeek | China | deepseek-flash, deepseek-v4-pro | Yes, today |
| Moonshot (Kimi) | China | kimi-k3.1-pro | Yes, today |
| Alibaba (Qwen) | China | qwen3.8-flash, qwen3.8-max | Our bench, not sold |
What the hosted lane receives: the current message, the agent's instructions, and when retrieval is on for that turn, a small number of retrieved passages from knowledge that requester is allowed to see. What it never receives: your whole mailbox, your documents as a corpus, your contacts, or anything about another customer.
Retention on their side is their terms, not ours. The catalogue labels those models
retention: provider_terms and we say so at checkout. We do not claim the provider forgets your
request, because we cannot verify that. What we can verify is what we sent, when, and to whom — and we
record it.
How the hosted lane is allowed to happen — and how you stop it
- You decide. Every ID has a consent setting: allowed, refused, or unset (unset means the plan default, which is hosted). A refusal outranks the plan — set it to local-only and no turn of yours is sent anywhere, at any price.
- Exact addresses, never domains. The internal staff allowlist matches full addresses only; a similar-looking address is a different person and does not match.
- A customer can choose a hosted model in the paid cloud lane, priced per token and labelled at checkout — a purchase, not a silent default.
- One switch turns the whole lane off, and it is checked at call time.
- Every call that leaves writes a hash-chained receipt: model, requester, byte count, purpose, success. Editing or deleting an entry breaks verification.
- A fallback to local is logged with the reason. It is never silent.
What we keep, and for how long
| Data | Where | Why | Retention |
|---|---|---|---|
| Your ID and its owner mailbox | Our premises | It is the account | Until you delete it |
| Mail to and from your ID | Our premises | To answer you and keep context | 24 months, then archived or deleted |
| Knowledge you teach it | Your vault, our premises | So it remembers | Until you delete the page |
| Hosted-lane receipts | Hash-chained ledger | So disclosure is checkable | Life of the account |
| Billing records | Stripe | Payment, tax, refunds | As law requires |
We do not sell your data, rent it, build an advertising profile from it, put third-party ad tags on your mail, or train models on your content. We do read it with software to answer it and keep you safe; a human reads it when you ask, when you report a failure, or when the law compels us.
Your controls
- Export everything, any time. Your ID, mail and receipts export as a signed bundle with
a manifest you verify with
sha256sum -c. - Take it with you. The same bundle imports into a device you own.
- Turn retrieval off. The answer gets worse, and we say so rather than quietly reaching further.
- Ask for a human. Reply and ask; a person answers.
- Choose your lane. Allowed, refused or default — per ID, reversible, and recorded as an event on your account. A refusal outranks the plan.
- Delete. Operator-run today, within the 30-day promise: erasure removes the ID, its events, its hold record and its vault from our systems and writes a tombstone receipt. Mail already delivered to a mailbox is removed from our store by the same run; the copy in your own inbox is yours to keep or delete. Ask and it is done inside 30 days, and the tombstone proves it.
The roadmap, and the money
We are building the infrastructure to serve models of this class on our own premises, so the hosted lane stops being necessary for the work you actually do. That is a capital problem, not an engineering opinion: capable weights need accelerators, power, cooling and space. We would rather say that out loud than pretend growth is vanity — every paid ID, cloud pack and box moves a workload from somebody else's datacenter to ours, and funds the next one.
- Serve the default lane on our own hardware — done, and it is where most answers come from.
- Bring the largest models we use in-house — in progress. No date gets published until a benchmark runs on hardware we own.
- Publish the measurements — tokens per second, watts, cost per million tokens — including when they are worse than the hosted alternative.
- Reduce the hosted surface over time, and record in the changelog when a workload moves home.
What we will not claim
We are not SOC 2 certified, not HIPAA-compliant, not FedRAMP or CMMC assessed, and not cleared for classified work. We do not guarantee uptime. The model can be wrong, and when it is wrong about law, medicine, money or safety, the answer is not advice. An ID is a tool that answers, with a receipt and a human behind it — not a licensed professional.
How to check us
| Claim | How you verify it |
|---|---|
| A hosted call happened | The receipt chain: model, requester, bytes, purpose, timestamp |
| A hosted call did not happen | The chain is the record; absence is evidence, and the chain verifies |
| Mail is really from us | SPF, DKIM (selector spacemail) and DMARC are published for ngari.ai |
| Our DMARC posture | p=quarantine since 12 November 2026 — mail that fails authentication is quarantined, not delivered. Next: p=reject once a week of clean aggregate reports confirms nothing legitimate is being caught |
| The throughput we claim | Model cards: 27.3B at 18.54 GB VRAM and 10.7 tokens/sec on our box, measured — and watts marked unmeasured rather than estimated |
| This page is current | The version and date at the top, and the changelog below |
| Your data left with you | Export the bundle and verify the manifest yourself |
Changing this Act
- Versioned, dated, public. Every change edits this page and appends to the changelog.
- 14 days' notice to every active ID before a material change takes effect — by email to the ID, not a post nobody reads.
- No retroactive weakening. A commitment made under an earlier version is not withdrawn by publishing a later one.
- You can challenge it. Reply to this in any ID, or write to support@ngari.ai; disagreements that change the text are recorded in the changelog with the reason.
- Alignment is testable. This Act sits under the governance documents and the limits page. Where it contradicts the Tech Charter, the Charter wins and this page is corrected.
Changelog
| Version | Date | Change |
|---|---|---|
| 1.0.3 | 2026-11-12 | DMARC moved from p=none to p=quarantine: a trust document on a spoofable domain is self-defeating. Verified SPF and DKIM alignment first. |
| 1.0.2 | 2026-11-11 | Corrected the lane description: an active ID on a live plan is served by the hosted lane by default, not local-first as 1.0 implied. Added the per-ID consent switch (allowed / refused / unset, where a refusal outranks the plan) and described erasure as it now exists. |
| 1.0.1 | 2026-11-11 | Corrected the on-premises model table to the IDs actually loaded, and replaced copied tier numbers with a pointer to the plans API after the two disagreed. |
| 1.0 | 2026-11-11 | First publication. Names DeepSeek, Moonshot and Alibaba as hosted providers; states the on-premises default; commits to deletion in 30 days, DMARC enforcement and published benchmark numbers. |
None of this is a reason not to use the system. It is the set of facts that makes using it a decision you are making, rather than one being made for you.
This page is a public commitment, not a contract, and it does not create legal rights beyond
those the law already gives you. The Terms of Service and
Privacy Policy govern the service; the limits page states what the
system may not be relied on for. Ask for this page any time by emailing TRANSPARENCY to any NGARi
address — you do not have to be a customer to read it.