Privacy policy

1. Data controller

The data controller is Justyna Sidoruk, address: ul. Sidorska 43a, 21-500 Biala Podlaska, Poland. Contact for data protection matters: [email protected] or a ticket on discord.gg/epsiloncode.

2. Data we process

• Discord account data: user ID, name, avatar, profile color, server membership status. Obtained through Discord OAuth at login.
• Billing data: plan or add-on identifier, amount, date, payment status relayed by the payment operator. We do not store card numbers.
• Technical data: IP address, user agent, login date and time, API key identifiers (prefix), last use time of a key.
• Request metadata: request ID, model, start and end time, token counts, billing classification, technical status, cost, source (CLI or API).
• Request diagnostics: transport event trace, headers (with secrets masked), streaming response chunks and request content to the extent needed for billing and abuse detection. Full diagnostics are accessible only to the administrator and to the recipient of a one-time link for a specific request.
• Security data: history of suspensions, bans, automatic blocks, banned IP addresses and the reasons for these decisions.

3. Purposes and legal bases

• Providing the Service, authorization, unit accounting and plan handling: Art. 6(1)(b) GDPR (performance of a contract).
• Sales records and tax obligations: Art. 6(1)(c) GDPR.
• Security, detection of abuse, scraping, multi-accounts and limit circumvention, defence against claims, service profitability analytics: Art. 6(1)(f) GDPR (legitimate interest).
• Marketing communication, if introduced: Art. 6(1)(a) GDPR (consent).

4. Prompt and response content

Prompt content is relayed to the model Vendor solely to generate a response. Vendors process data under their own policies, over which the controller has no influence. Do not send sensitive data through the API if disclosure to a Vendor would be unacceptable.

Fragments of request content may be stored in diagnostic logs for billing, complaints and detection of Terms violations. Content preview in the admin panel is truncated and treated as untrusted text.

5. Recipients

• AI model Vendors (Anthropic, OpenAI, Google, DeepSeek, xAI or others listed in the catalog) for prompt content.
• The payment operator for processing transactions.
• Discord Inc. for OAuth authentication and server membership.
• Hosting and infrastructure providers under data processing agreements.
• Public authorities where required by law, and legal advisors in case of a dispute.

6. Retention

• Account data: for the duration of use and up to 3 years after the last activity, unless longer retention follows from the points below.
• Billing data: 5 years from the end of the tax year of the payment.
• Request metadata and technical logs: up to 3 years (limitation period for business-related claims); the user panel shows the last 500 requests.
• Full diagnostic traces: as a rule up to 90 days, longer only in connection with an ongoing complaint or dispute.
• Login history: according to the retention period shown in the admin panel.
• Ban and block data: until lifted, and IP data also after lifting to prevent repeated abuse, no longer than 3 years.
• Backups: up to 90 days in the rotation cycle.

7. One-time request links

The administrator may generate a one-time link allowing a view of one request's diagnostics without logging in. The link is valid for 24 hours until first use, and the granted access for 1 hour. The token is removed from the address after exchange and is not sent to analytics tools. The link gives access to exactly one request.

8. Cookies and local storage

The dashboard uses a session cookie necessary to stay logged in, and localStorage to remember interface language and menu layout. We do not use advertising cookies or third-party trackers. Blocking the session cookie prevents login.

9. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection to processing based on legitimate interest. Send requests to [email protected]; we respond within 30 days. You may lodge a complaint with the President of the Polish Personal Data Protection Office (UODO). Erasure may be limited to the extent necessary to defend against claims and fulfil tax obligations (Art. 17(3) GDPR).

10. Age of users

The Service is intended for persons aged 15 or older. If an account of a younger person is detected, the account is blocked and the data erased except for the scope necessary to defend against claims.

11. Security

We use TLS encryption, restricted administrative access, secret masking in logs and automatic abuse detection. The API key is shown in full only once, at creation. You are responsible for its confidentiality; report a leaked key immediately and revoke it in the dashboard.

12. Changes to this Policy

This Policy may change. The new version applies from publication at epsiloncode.eu/privacy. We will announce significant changes in the dashboard or on Discord.