Privacy Policy

What data we collect, why we collect it, how long we keep it, and your rights as a data subject. This policy applies to visitors of our website and to customers of the Services.

§1. What we collect and why

• Account data: Name, email, company, billing address, and payment method. Collected on signup; required to provide the Services.
• API request metadata: Timestamps, model selected, region, token counts, latency, and error codes. Collected for billing, rate-limiting, and performance monitoring. We do not log prompt or completion content to persistent storage by default.
• Console activity: Pages visited, features used, settings changed. Used to improve the console experience. Retained for 90 days.
• Communications: Emails you send us (support, security reports, press). Retained as needed for the correspondence.

§2. What we do not collect

We do not log prompt content or model output to persistent storage in the normal course of service. Fine-tuning datasets you upload are stored for the duration of your fine-tuning job plus 30 days, after which they are deleted. We do not sell data to third parties. We do not use Customer Data to train models.

§3. Legal basis (GDPR)

For customers and users in the EU/EEA: we process account data and billing data on the basis of contract performance (Article 6(1)(b)). We process usage metadata on the basis of legitimate interests (Article 6(1)(f)) — specifically, operating and improving the Services, and preventing fraud. Where we rely on legitimate interests, you may object to that processing.

§4. Data retention

• Account data: retained for the duration of your account plus 7 years for tax and legal record-keeping.
• API request metadata: 90 days in hot storage; 1 year in cold archive; deleted after 1 year.
• Fine-tuning datasets: deleted 30 days after job completion or job cancellation.
• LoRA adapters: retained until you delete them or your account closes.
• Console activity logs: 90 days.
• Support correspondence: 2 years after resolution.

§5. Your rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion ("right to erasure").
• Object to or restrict processing in certain circumstances.
• Receive your data in a portable format.
• Withdraw consent where processing is based on consent.

Exercise these rights at privacy@clusterbid.eu. We respond within 30 days.

§6. Sub-processors and transfers

We use sub-processors to provide the Services. A full list is at clusterbid.eu/security. Cross-border transfers from the EU/EEA rely on Standard Contractual Clauses (SCCs) with each sub-processor. The DPA governs our processing on your behalf as a data processor.

§7. Cookies and tracking

Our website uses a single analytics cookie (first-party, privacy-preserving) to count page visits. It is non-essential, so we do not set it until you opt in: on your first visit a consent banner asks whether to allow it, and the cookie is written only if you choose “Allow analytics”. If you decline, or have not yet chosen, the cookie is never set. Your choice is remembered, and you can change it any time by clearing the cb-cookie-consent preference in your browser, after which the banner reappears. No third-party advertising cookies. The console uses a session cookie required for authentication. The website functions without the analytics cookie; the console requires the session cookie to operate.

§8. Regional addenda

India (DPDP): We act as a data fiduciary for India-resident personal data processed through our in-region infrastructure. The India DPDP addendum to our DPA is available at clusterbid.eu/legal/dpa.

California (CCPA/CPRA): We do not sell personal information. California residents may request access, deletion, and opt-out of any sharing by emailing privacy@clusterbid.eu.

EU/EEA: The DPA applies to all customers processing EU/EEA personal data. Our EU representative is available in Annex 1 of the DPA.

§9. Contact

Data Controller: clusterbid GmbH, Mainzer Landstraße 50, 60325 Frankfurt am Main, Germany · HRB 198 422 · USt-IdNr DE 318 642 990.
Privacy inquiries: privacy@clusterbid.eu.
DPA and GDPR inquiries: dpo@clusterbid.eu.

Related documents: Terms of Service · Data Processing Agreement · Acceptable Use Policy