1. Controller

The controller for the processing described in this policy is Media Holding Development OÜ, registry code [REGISTRY CODE], [LEGAL ADDRESS], Tallinn, Estonia. Contact for data protection matters: [CONTACT EMAIL]. We have not appointed a data protection officer because the law does not require one for our processing; the contact above handles every data protection request.

This policy is written to meet Articles 13 and 14 of Regulation (EU) 2016/679 (the GDPR).

2. Scope and roles

This policy covers three groups of people: visitors to this site, the people who use the customer cabinet on behalf of a business customer, and the representatives of business customers who contact us. For all of them we act as controller.

For personal data that a customer places in API requests (prompts, documents, messages), we act as processor on the customer's behalf under the Data Processing Agreement. Section 9 explains what that means for you if you are an end user of one of our customers.

3. What we process, why, and on which legal basis

Who / what	Data	Purpose	Legal basis (GDPR Art. 6(1))
Site visitors	No cookies, no analytics, no tracking pixels. The edge provider that serves the site keeps short-lived access logs (IP address, user agent, time, requested URL) for security and abuse prevention. We do not receive personal data from the site.	Security, abuse prevention	(f) legitimate interest — operating a public website securely
Cabinet users — account	Name, business email address, organisation, role, password hash (Argon2), email-confirmation state, login timestamps, IP address of logins	Creating and securing your account; access control	(b) performance of the contract; (f) security
Cabinet users — billing	Company name, registration and VAT number, business address, invoices, payment status, the last four digits and brand of a card as reported by Stripe. Card numbers are handled by Stripe only.	Invoicing, tax compliance, payment	(b) contract; (c) legal obligation — accounting and tax law
API customers — request metadata	Request identifier, timestamp, model, HTTP status, prompt and completion token counts, duration, project identifier, API-key prefix, source IP address	Metering, billing, rate limiting, security, support	(b) contract; (f) security and abuse prevention
API customers — request content	Not stored. The platform default is zero retention of request and response content (`SOVCLOUD_RETENTION_CONTENT=none`). Content passes through memory for the duration of the request and is not written to any log.	—	—
Support correspondence	Your messages, our replies, the request identifiers you quote	Answering you; improving the service	(b) contract; (f) legitimate interest
Security and audit logs	Administrative actions, key creation, rotation and revocation events, suspension events, with the acting user and time	Security, accountability, incident response	(f) legitimate interest; (c) legal obligation where applicable

We do not use your data for advertising, do not sell it, do not profile you, and do not train models on it.

4. Retention

Account data: for the life of the account and 30 days after deletion; backups are rotated within 35 days.
Request metadata and the metering ledger: 13 months, so that an invoice can be reconciled and a dispute resolved.
Audit and security logs: 13 months.
Invoices and accounting records: 7 years, as required by the Estonian Accounting Act.
Support correspondence: 24 months after the last message.
Request content: not retained.

5. Recipients and sub-processors

We share personal data only with the service providers we need to operate the platform, under written contracts:

Stripe — payment processing and invoicing (Stripe Payments Europe, Ltd., Ireland, with processing by Stripe, Inc., United States).
Resend — transactional email (account confirmation, invoices, security notices). Sending from a European Union region; account data is stored in the United States.
Cloudflare — DNS, TLS termination and the content delivery edge for the site and the API host.
GitHub — source-code hosting and continuous integration of the platform. No customer personal data is placed in repositories or CI by design.
[HOSTING PROVIDER] — hosting of the control plane, its database and the inference plane in a data centre in the European Union (planned: Hetzner Online GmbH, Germany / Finland).

The complete list with addresses and transfer mechanisms is Annex III of the Data Processing Agreement. We also disclose data where the law obliges us to, for example to tax authorities, or to a court.

6. International transfers

The control plane, its database and the inference plane are operated in the European Union. Some sub-processors are established in, or process data in, the United States: Stripe, Resend, Cloudflare and GitHub. For those transfers we rely on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) and, where the provider is certified, on the EU-U.S. Data Privacy Framework, together with the supplementary measures described in the Data Processing Agreement. You can ask us for a copy of the relevant clauses at [CONTACT EMAIL].

7. Your rights

Under the GDPR you have the right to access your personal data, to have it rectified or erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw any consent you have given (withdrawal does not affect processing before it). Write to [CONTACT EMAIL]; we answer within one month, extendable by two months for complex requests, and we may ask you to prove your identity.

You also have the right to lodge a complaint with a supervisory authority. Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, info@aki.ee, www.aki.ee. You may also complain to the authority of your own member state.

8. Automated decision-making

We make no decisions about you that are based solely on automated processing and that produce legal or similarly significant effects. Rate limiting and budget enforcement are automatic technical controls that apply equally to every project and are not decisions about a person.

9. If you are an end user of one of our customers

A customer of ours may send your personal data to the platform inside an API request. In that case the customer is the controller and we are its processor: we process the content only to generate the response, we do not store it, and we do not use it for any purpose of our own. For questions about such processing, please contact the customer; if you contact us, we forward your request to the customer where we can identify it.

10. Security

We protect your data with the technical and organisational measures described in the Security and Trust page and in Annex II of the Data Processing Agreement, including encryption in transit and at rest, one-way hashing of API-key secrets, tenant isolation, access control, audit logging and tested backups.

11. Children

The platform is for business customers and is not directed at anyone under 18.

12. Changes

We may update this policy. A material change is announced at least 30 days in advance to the administrators of registered organisations by email and by the revision date on this page.

Viimati muudetud 2026-10-13