Privacy Policy

MEEP CLOUD ROMEX S.R.L., Bd. Iuliu Maniu nr. 21, bl. D1, sc. 2, et. 4, ap. 19, Deva, jud. Hunedoara, Romania, trade register number J20/1485/2021, CUI 44989045, is the controller of your personal data under the EU General Data Protection Regulation (GDPR). For anything about your data, write to [email protected].

If you are a member of an organization on InterOdin, its owners and admins manage your membership, API keys and spending limits. They can see the usage metadata of your requests, but never the content of your chats.

• Account data: name, email address, preferred language and passkey public keys. If you sign in with Google or GitHub, we receive your name, email address and profile picture from that service.
• Consent records: when you accepted the Terms and the Privacy Policy and which version, and whether you agreed to receive product updates and offers by email (with the time of that choice).
• Organization and invoice data: organization name, members and roles, invoice name, tax ID (CUI), address, country and currency.
• Payment data: Stripe processes your card. We receive a customer reference, the card brand, its last four digits and expiry date, and the status of each payment. We never see your full card number.
• API usage metadata: request ID, time, API key, model, endpoint, token counts, cost, latency, status and error code, IP address and user agent. Never the content of prompts or completions.
• Web chat data: your conversations, messages, attached images, custom instructions and chat settings. Incognito chats are never stored; only billing metadata (tokens, cost, time) is kept.
• Security data: sessions with IP address and user agent, and an audit log of important account actions such as invitations, key creation and role changes.
• Support messages: what you send to our support addresses, kept in our support inbox.

When you call the API or send a chat message, your request passes through our gateway in memory and is sent to the GPU infrastructure that runs the model. The response streams back to you the same way.

For the API, we do not write prompts or completions to disk, to our database or to logs. Web chats are stored as described in this policy, except incognito chats. Our error monitoring is set up to exclude the content of requests and chats.

The model infrastructure is operated for us by a specialised provider in the European Union and the United States, under a contract with us. It processes the content only to generate the response and does not store it, apart from a short-lived cache that speeds up repeated prompts.

• To provide the Service you signed up for: your account, chat, API, console and support. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• To bill you, issue invoices and keep accounting records. Legal basis: legal obligation (Art. 6(1)(c) GDPR) and contract.
• To keep the Service secure, enforce rate limits and our Acceptable Use Policy, and prevent fraud and abuse. Legal basis: our legitimate interests (Art. 6(1)(f) GDPR).
• To send service emails such as sign-in links, invitations, receipts and notices of important changes. Legal basis: contract.
• To send you product updates and offers by email, only if you opted in. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in your account settings ("Product updates by email"); this does not affect emails sent before.

We do not send marketing emails without your consent.

We never use your prompts, outputs or chats to train AI models. We do not sell or rent personal data, and we do not show ads or use advertising trackers.

We share personal data only with service providers that help us run InterOdin, under contracts that require them to protect it, and only as far as they need it:

• Hetzner, our hosting provider in Germany: servers and database.
• Cloudflare: DNS, network protection, bot detection, and storage of encrypted backups and chat attachments.
• Our model infrastructure provider, in the European Union and the United States: processing of request content, only to generate responses.
• Sentry, in the European Union: error monitoring, set up to exclude the content of requests and chats.
• Stripe: payments.
• Resend: delivery of service emails and receipt of the emails you send to our support addresses.
• Google (Gmail): a copy of the emails you send to our support addresses, so we can answer quickly.
• Google and GitHub sign-in: only if you choose to sign in with them. They tell us your name, email address and profile picture.

We may also disclose data to public authorities when the law requires it, and to professional advisers who are bound by confidentiality.

Some providers are based outside the European Economic Area or may access data from there, for example in the United States, where part of the model infrastructure runs. In those cases we rely on an adequacy decision of the European Commission, such as the EU–US Data Privacy Framework for certified companies, or on the Standard Contractual Clauses approved by the European Commission. You can ask for a copy of the relevant safeguards at [email protected].

• Account and organization data: until you delete the account or organization.
• API request metadata, including IP address and user agent: 90 days. After that we keep only daily totals per organization, model, key and member, without IP addresses, for billing and usage history.
• Web chats: until you delete them. Deleted conversations are hidden immediately and erased permanently after 30 days. Deleting your account erases all your chats and attachments immediately.
• Support emails: as long as we need them to handle your request and keep a record of it. Ask us at [email protected] to delete them sooner.
• Invoices, payments and the credit ledger: as long as Romanian accounting and tax law requires, currently up to 10 years.
• Security and audit logs: as long as your organization exists, so owners can review important actions.
• Backups: encrypted and kept for up to 30 days, so data deleted from the Service also disappears from backups within 30 days.

Under the GDPR you have the right to access your data, correct it, delete it, restrict or object to its processing, and receive it in a portable format. Where we rely on your consent, you can withdraw it at any time.

You can export your chats and delete your account yourself in the console settings. For anything else, write to [email protected]. We reply within one month.

You also have the right to complain to a data protection authority. In Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro. You may also contact the authority in the EU country where you live or work.

We protect data with encryption in transit, encrypted backups, API keys stored only as hashes we cannot read back, passkeys, mandatory two-factor authentication for staff, strict access controls and audit logs. No system is perfectly secure; if a breach affects your data, we will inform you and the authorities as the GDPR requires.

Authorized InterOdin staff may access your account’s console to help you when you ask, or to investigate abuse or a security problem. Staff access requires two-factor authentication, and every access is recorded in an audit log. Staff access for support or abuse investigation is audited, shown with a banner while it is active, is view-only (staff cannot change anything in your account), and may include seeing your chats. Incognito chats are never stored, so staff can never see them. We never use this access for any other purpose.

InterOdin is not intended for anyone under 18, and we do not knowingly collect data from children.

We may update this policy. We tell you about important changes by email or in the console before they apply. The effective date at the top always shows the current version.