Your data

Datagoat keeps your rows only while they are in use. Nothing else about your data is kept, apart from the few things listed below.

What	How long
Rows sent inline with an ask (`rows`, `csv`, `fetch_url`)	Deleted when the call ends
The engine's reading of a record (with `shape`)	Deleted when the call ends
A dataset stored with `dg_add_dataset`	Deleted 24 hours after it was last used, or at once with `dg_delete_dataset`
An answer (for `dg_poll` and idempotent retries)	24 hours
A fitted model	90 days. It holds coefficients, the numeric cut points it bins on and the category values it groups (such as plan names). It holds no rows.
Outcomes you report with `dg_report_outcomes`, and actions you record with `dg_attest` (the case id, a hash of the lever token, whether it complied, the dose, when)	Kept as the model's track record
Usage counts (fits and answered cases, per month)	Kept for billing
Your account, API keys (stored hashed) and a small profile of each stored dataset (column names, and the distinct values of columns with at most 12 of them)	Until you delete them or the dataset

"Last used" means stored, appended to, asked about or preflighted. Asking about a dataset every day keeps it. Stop, and it is gone a day later. A fit is cached by the record's content, so asking about the same bytes again after the rows are gone still reuses the model, as long as you send the rows again.

Verdicts are signed and returned to you. Datagoat keeps no separate copy of them beyond the 24-hour answer.

What not to send

Datagoat learns from the columns you send, so send only the columns a question needs. Do not send:

health information about identifiable people (protected health information)
payment card numbers or bank account numbers
government identifiers: social security, passport or tax numbers
passwords, API keys or other credentials

An identifier that names a case, such as customer_id, is expected. Make it an opaque ID and not a name or an email address.

Where it runs

Datagoat is hosted. The API and the MCP server run on Vercel, the database on Neon, and the analysis engine on Modal with an object store for rows (the regions are listed in the privacy policy). Rows are stored only in that object store, for the periods above. Datagoat is not offered for self-hosting.

People as cases

Questions where each case is a person (subject_kind: "person") are decision support. They need acknowledge_decision_support: true, and a human should make the decision. Do not use Datagoat answers as the sole basis for decisions with legal or similarly significant effects on people, such as credit, employment, housing or insurance.