Privacy Policy

This policy describes how AELDER at aelder.dev handles personal data in connection with the website, API and account dashboard. References to “we”, “us” and “our” mean the operator of the Service. We determine the purposes and means of processing account, billing and website administration data.

Contact our support team using the contact details published on the website for privacy questions and requests.

If you submit personal data on behalf of an organisation, you are responsible for ensuring that the intended use is lawful and that any required processing agreement is in place before submitting it. This policy alone is not a data processing agreement.

We distinguish technical usage records from the content of your conversations. The records described below do not require us to retain prompt or response content in our platform logs.

• Account and access data: the contact and authentication information you provide to register, sign in and manage your account and API keys.
• API usage metadata: source IP address, selected model, input tokens, output tokens, cached tokens, request time and calculated cost.
• Payment records: top-up amounts, transaction references, credited balance, usage deductions, bonuses, refunds and the wallet or transaction details needed to verify and reconcile a payment.
• Support correspondence: your contact details, the messages you choose to send us and the information needed to investigate your request. Avoid including secrets or unnecessary personal data.
• Website analytics: Google Analytics data about visits and interactions, such as pages viewed, interaction events, referral information, browser and device information, and cookie or similar identifiers where enabled.

Your prompt content passes through our platform to route and execute your request, and the response passes back through the platform to your application. This involves transient processing; it does not mean that we keep a conversation history.

We do not save prompt or response content in our platform logs, and we do not routinely inspect that content as part of ordinary service operation. Our usage logs contain technical metadata rather than message text.

If you choose to include request content in a support message, that content becomes part of your support correspondence and is handled under the retention rules for support records. Do not include passwords, API keys or other secrets.

We do not use your prompts or responses to train models.

To fulfil your request, its content is transmitted to external infrastructure processing the selected model. External parties apply their own data retention, security and use policies. Those policies may permit retention, automated checks, review for security or troubleshooting, or use for training.

Our own no-training and platform-log commitments do not extend to external processing. We do not control those parties’ model-training decisions and cannot guarantee that content is never retained or used for training outside our platform.

Do not send passwords, API keys, sensitive personal data or confidential material if this handling is unacceptable to you or inconsistent with your obligations. This explanation does not remove any data-protection obligations that apply to us.

We use account and technical information to authenticate access, route requests, calculate charges, manage paid and bonus balances, process refunds, provide support and investigate operational problems. We also use relevant records to detect abuse, secure the Service and meet applicable legal or accounting obligations.

Where the GDPR or comparable law applies, the legal basis depends on the purpose: performance of a contract for account services, requested processing, billing and support; compliance with legal obligations for required records; and legitimate interests for proportionate security, abuse prevention and service administration, subject to your rights and interests.

Optional analytics processing relies on consent where required by applicable law. Any processing that requires a separate legal basis must have that basis; accepting the Terms alone is not blanket consent to every use of personal data.

The website and dashboard use necessary session or authentication storage to keep account access working. We also use Google Analytics to understand website visits and interactions.

Google Analytics involves sharing analytics information with Google under the configuration in use and its applicable terms. Prompt and response content is not intended for website analytics and must not be included in analytics events.

Where consent is required, optional analytics may run only with your consent, and you may withdraw that consent. Contact us to request withdrawal or information about the analytics settings that apply to your visit. Necessary authentication storage does not depend on optional analytics consent.

You can manage cookies in your browser. Blocking necessary session storage may prevent sign-in or other account functions from working.

Information is disclosed where needed to provide the requested functionality: model-processing infrastructure receives request content and necessary request information; hosting and technical services handle the data needed to operate the platform; payment infrastructure handles transaction information; Google receives analytics information; and support systems handle messages you send us.

Recipients receive information relevant to the functions they perform. Their respective roles and obligations depend on the processing arrangement and applicable law. You may contact us for more information about recipients relevant to your use.

We may disclose information where required by a valid legal obligation or where lawfully necessary to investigate fraud, protect rights or respond to a security incident. Disclosures must be limited to what is necessary for the applicable purpose.

USDC payments and refunds may create public blockchain records containing wallet addresses, amounts, timestamps and transaction identifiers. Although wallet addresses do not necessarily contain a name, they may be linked to an individual.

We keep the transaction information needed to credit payments, reconcile balances, investigate errors and arrange refunds. Public blockchain records are maintained independently of our account database and generally cannot be edited or erased by us.

Use only the payment token, network and address shown at checkout. Public transaction details can remain available independently of any retention period applied to our own records.

The Service and the infrastructure processing requests may operate in countries different from your own. Account data, technical records, analytics information and request content may therefore be processed internationally.

Where applicable law restricts international transfers, we must use a lawful transfer basis, such as an adequacy decision, appropriate contractual safeguards or another basis permitted by that law. Contact us for information about the destinations and safeguards relevant to your data. This policy does not make all external processing subject to the laws of your home country.

Our policy is to retain API request metadata and technical logs, including source IP addresses, for up to 7 calendar days, then delete or irreversibly anonymise them. This does not shorten any retention period legally required for a specific record. Account, financial, support and analytics records follow the separate rules below.

External infrastructure applies its own retention periods to content it receives. Those periods are separate from the platform retention schedule below.

• Prompt and response content: not saved in our platform logs; processed transiently for execution, except content you separately submit in support correspondence.
• Account and access records: kept while the account is active. After closure, we delete or anonymise data that is no longer needed to settle the account, complete a refund or meet a legal obligation. Account closure disables further authorised use of its keys.
• API request metadata and technical logs, including source IP addresses: up to 7 calendar days. Financial totals needed to reconcile usage and balances are accounted for separately.
• Payment, bonus, refund and accounting records: kept for account reconciliation, refund handling and the period required by applicable tax, accounting and record-keeping law. Where a dispute is active, relevant records may remain until it is resolved and any applicable claims period has ended.
• Support correspondence: deleted or anonymised within 7 calendar days after the matter is resolved, except information needed for a refund, an active dispute or a legal obligation, which follows the relevant financial or legal retention rule.
• Google Analytics data and cookies: retained according to the analytics configuration and Google’s applicable retention rules, only for as long as needed for the analytics purpose and subject to consent and deletion requirements. The 7-day API-log policy does not apply to Google’s systems. You can request details of the current configuration.

We are responsible for applying technical and organisational measures appropriate to the data and risks involved. No method of transmission or storage can guarantee absolute security or prevent every attempted intrusion.

Keep your account credentials and API keys secure. Revoke compromised keys and contact support if you suspect unauthorised access. Where a security incident creates a legal notification obligation, we will notify the relevant people or authorities as required.

Depending on applicable law, you may have rights to access, correct, delete or receive a portable copy of your personal data, restrict or object to certain processing, and withdraw consent where consent is the legal basis. Withdrawal does not affect processing lawfully carried out before withdrawal.

Send requests to our support team using the contact details published on the website. We may need proportionate information to verify your identity. We will respond within the period required by applicable law and explain any lawful limitation on a request.

You may request account closure and deletion. Some records may remain for legal, accounting, security or dispute purposes as described above. We cannot erase independently maintained public blockchain records.

You may complain to the data-protection authority competent for your situation, including the authority in the place of your habitual residence or work where applicable.

The Service is intended for developers and people legally able to enter into the service agreement, and is not directed at children. Contact us if you believe a child has provided personal information without the required authorisation so we can investigate and take appropriate action.

We will update the date above when this policy changes and communicate material changes through the Service or by email where appropriate. A policy update does not itself provide consent for a new purpose or remove any requirement to obtain consent or establish another lawful basis.