Privacy

Privacy Policy

What personal data we process, why, for how long, who receives it and how to exercise your rights under the GDPR.

Last updated: Nov 1, 2026

Draft — pending review by counsel (owner action O-05)

This document is a draft prepared for legal review. It may change before Tokentide launches publicly, and placeholders marked as pending will be completed.

On this page

This Privacy Policy explains what personal data Tokentide processes when you use our website, dashboard and API, why we process it, how long we keep it and what rights you have under the EU General Data Protection Regulation (GDPR) and the Spanish data protection law (LOPDGDD). Capitalized terms have the meaning given in our Terms of Service.

Zero data retention, guaranteed on Private models

We never store your prompts, inputs, files, images, audio or outputs, on any endpoint.
On Private models, Venice retains nothing either, so retention is zero end to end.
Anonymized models are opt-in: their provider sees your content and may retain it under its own policy, without your identity.
We keep only the metadata we need to run, bill and protect the Service, and we store it in the United States, with the transfer safeguards described below.
We don't sell personal data, show advertising or use third-party trackers.

Who is responsible for your data

The controller of your personal data is Pending: [Company legal name], NIF Pending: [NIF], with registered office at Pending: [registered office address], Spain ("Tokentide", "we", "us"). For anything related to privacy, write to privacy@tokentide.app. Data protection officer: Pending: [DPO contact details, if one is appointed].

We are the controller for your account, billing and request metadata. The content of your requests is processed only in transit: when a business customer uses the Service to process personal data of others, we act as that customer's processor under our Data Processing Agreement; otherwise, we process it as an independent controller, only to provide the Service you request, as described below.

What we never store

Content. Prompts, messages, files, images, audio and model outputs pass through memory to the model and back to you. They are never written to our databases, logs, analytics, error tracking, queues or disks, on any endpoint or lane. Every day, automated canary tests send a marker through the Service and search our logs and databases to check that it never appears.
Private models. On Private models (including TEE and E2EE models), Venice retains nothing either.
Anonymized models. If you enable Anonymized models (an API key with privacy mode all), the third-party provider of the model, such as the provider of a Claude, GPT or Gemini model, receives your content through Venice and may retain it under its own policy. It doesn't receive your identity. New API keys only allow Private models unless you change this.
End-to-end encrypted models. With E2EE models, your content is encrypted on your device; we only relay ciphertext we can't read.
Large uploads (preview). Files above 4.5 MB sent through the Large Payload Lane are encrypted on your device before upload. We hold only the ciphertext, for at most 15 minutes, and delete it right after use; the key is never stored, so we can't read it.

If you contact support, don't paste content you want to keep private: what you send us by email is kept as correspondence (see below).

What we store and for how long

Data	Why	Retention
Account: email address, sign-in factors (password hash, passkeys, two-factor settings), role, settings (such as language) and active sessions (browser description and a hashed IP address)	Sign-in, security, legal obligations	Life of the account + 30 days
Known devices: random identifiers of the browsers you sign in from (cookie `tt_did`, no fingerprinting)	Warning you by email about sign-ins from a new device	400 days after your last sign-in
Billing: deposits, refunds, invoices, country, VAT data (tax ID, location evidence)	Accounting and tax law (Spain: 6 years)	6 years; 10 years for EU One-Stop Shop VAT records, where they apply
Per-request metadata: ids, timestamps, endpoint, model, lane, multiplier, epoch, token or unit counts, list cost, charge, status, error class, latency, byte sizes, upstream id	Billing disputes, troubleshooting, market learning	90 days in full; then only hourly aggregates, kept 6 years, and the detail is deleted
IP address	Abuse prevention, rate limiting	Never stored raw: only a hash of the /24 (IPv4) or /48 (IPv6) network, with a salt that rotates daily. Kept 30 days in request metadata; session and audit records keep it for their own retention periods
Security audit log: sign-ins, key creation and revocation, security settings and administrator actions	Accountability	2 years
Support and privacy correspondence	Answering you, keeping records of complaints and requests	Pending: [retention period for correspondence]
Debug Capture (planned, opt-in)	Troubleshooting that you request	24 hours at most, encrypted to your own key (we can't read it)

When you delete your Account, we delete or anonymize your data; ledger records that tax law requires us to keep are anonymized, not deleted.

Logs kept by our providers

Some of our providers keep short-lived technical logs of their own. Our hosting provider (Vercel) logs technical data about each HTTP request, including the IP address, user agent, path and status, for a short period (currently up to 30 days); these logs never contain request bodies. Our error monitoring (Sentry, EU region) receives error metadata from our own code, such as request ids, route, error class and a pseudonymous account id, never content. Details are on the sub-processors page.

Why we use your data

Purpose	Data	Legal basis (GDPR)
Providing the Service: your Account, API keys, processing your requests, the dashboard and support	Account, content in transit, request metadata	Performance of the contract (art. 6(1)(b))
Calculating charges, taking payments, issuing invoices, handling refunds and withdrawals	Billing data, request metadata	Performance of the contract (art. 6(1)(b))
Keeping accounting and tax records, determining VAT, answering authorities	Billing data	Legal obligation (art. 6(1)(c))
Security, fraud and abuse prevention, rate limiting, trust tiers and enforcement of our Acceptable Use Policy	Request metadata, hashed IP addresses, device identifiers, payment risk signals, audit log	Legitimate interest in protecting the Service, our customers and our upstream access (art. 6(1)(f))
Service messages: security alerts, receipts and invoices, notices about changes, price alerts you set up	Email address or dashboard	Performance of the contract; legal obligation for some notices
Aggregated market analytics: learning demand to set the tide table, and reports	Aggregated request metadata	Legitimate interest in running and improving the market; aggregates don't identify you (art. 6(1)(f))
Website analytics, aggregated and without cookies	Page views and performance metrics	Legitimate interest in understanding and improving our website (art. 6(1)(f))
Exercising or defending legal claims, and answering lawful requests	Relevant records	Legal obligation; legitimate interest (art. 6(1)(c) and (f))

You can object at any time to processing based on legitimate interest (see Your rights). We don't use your email address for advertising; if we ever send you news about our services, we'll do so only as Spanish law allows (article 21 LSSI-CE) and every message will include a simple way to opt out.

We need your email address to create an Account, and billing data to sell you credit and meet our tax obligations. Without them, we can't provide the Service.

Fraud prevention and automated decisions

To protect the Service and keep prices low for everyone, we assign each Account a trust tier (new, verified or trusted). The tier depends on verification (email, passkey, two-factor authentication), payment method and history, account age and usage patterns. It sets usage limits, such as rate limits, top-up limits and Low Tide caps. It never changes the price you pay.

We use risk signals such as:

a card fingerprint from Stripe (an identifier of the card, never its number), disputes and early fraud warnings;
the rate at which upstream providers reject your requests under their content policies; and
hashed network addresses, device identifiers and key usage patterns.

We may link Accounts that share these signals, to apply one trial credit and one Low Tide allowance per person or organization and to prevent fraud.

Some limits apply automatically, such as rate limits or a temporary hold on a top-up. We don't take decisions based solely on automated processing that produce legal effects for you or affect you similarly significantly: a person reviews suspensions and terminations. You can ask for human review, express your point of view and contest a decision by writing to support@tokentide.app or privacy@tokentide.app.

Where your data is stored and processed

Storage: our database, where we keep your account, billing and request metadata and the ledger of your balance, is in the United States (AWS US East), with Neon Postgres on Amazon Web Services. All the data we keep is stored in the United States, encrypted at rest.
Processing: our servers receive and process requests in transit in the United States (US East), with Vercel. To serve requests quickly, our cache (Upstash Redis in the United States, US East) also holds short-lived operational data (account and key identifiers, hashed IP prefixes, counters and the reservations of requests in progress) that expires after a short time.
Venice: to run inference, Venice receives the content of your request together with our API key, a pseudonymous per-account hash, our server's IP address and timing data. It never receives your IP address, cookies, user agent, email address or account id. Venice decides where inference runs and doesn't publish its location.

If you are in the European Economic Area, storing and processing your data in the United States is an international transfer. See International transfers for the safeguards we rely on.

Who receives your data

Sub-processors. We use providers for hosting, database, caching, payments, email, error monitoring and model inference. Each is listed, with its purpose, data, location and safeguards, on our sub-processors page.
Venice and model providers, as described above. Venice's terms allow it to monitor information transmitted through its service; on Private models, Venice retains nothing.
Stripe. For card purchases sold through Stripe Managed Payments, Stripe is the merchant of record and acts as an independent controller for that sale, under its own privacy policy. For card purchases we sell, including automatic top-ups, Stripe acts as our payment processor: it processes the payment and stores any card you save. We receive from Stripe the purchase details, billing country, the tax ID you enter, the payment status and risk signals and, for a saved card, its brand, last four digits and expiry date, never your full card number.
Professional advisers, such as lawyers, tax advisers and auditors, bound by confidentiality.
Authorities, when the law requires it (see below).
A successor, if our business is merged, acquired or transferred; the successor must respect this policy.

We don't sell personal data, don't show advertising and don't use third-party trackers.

Requests from authorities

We hold metadata only, never the content of requests, so content is never something we can disclose. Requests from authorities follow a documented process with legal review: we check that the request is valid and has a legal basis, disclose only the minimum required and, unless the law prohibits it, tell the customer concerned. We publish the number of requests we receive in our quarterly transparency report.

International transfers

We store and process your personal data in the United States, outside the European Economic Area (EEA), and some of our providers process it there or in other countries outside the EEA. Each transfer relies on one of these safeguards:

EU-US Data Privacy Framework. Where the recipient is certified under the EU-US Data Privacy Framework, we rely on the European Commission's adequacy decision for that framework.
Standard Contractual Clauses. Otherwise, we rely on the EU Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914.

We add supplementary measures: encryption in transit and at rest, zero data retention of the content of your requests (we only store metadata), API keys stored only as hashes, IP addresses stored only as hashed network prefixes, and a pseudonymous identifier instead of your identity towards Venice. The sub-processors page shows the safeguard for each provider. You can ask for a copy of the relevant safeguards at privacy@tokentide.app.

Cookies

We only use cookies that are strictly necessary or that remember choices you make, such as your language. We don't use advertising or tracking cookies, so we don't show a consent banner. Our website analytics don't use cookies. See our Cookie Notice.

How we protect your data

We protect personal data with technical and organizational measures such as encryption in transit everywhere, storing API keys only as hashes, least-privilege database access, passkeys for administrators and a tamper-evident audit log. Our Security page has the details. If a personal data breach occurs, we notify the Spanish Data Protection Agency (AEPD) within 72 hours where the law requires it, and we inform you without undue delay if the breach is likely to result in a high risk to you.

Your rights

You have the right to:

access your personal data and receive a copy (art. 15 GDPR);
rectify inaccurate data (art. 16);
erase your data (art. 17);
restrict processing (art. 18);
data portability: receive your data in a structured, machine-readable format (art. 20);
object to processing based on legitimate interest (art. 21); and
not be subject to decisions based solely on automated processing that significantly affect you (art. 22).

Where we rely on your consent, you can withdraw it at any time.

How to exercise them

In the dashboard: you can export your data (account, API key metadata, request metadata and ledger) in JSON or CSV, and delete your Account, from Settings.
By email: write to privacy@tokentide.app. We may ask you to confirm your identity, for example by writing from your Account email address.

We answer within one month (30 days). For complex or numerous requests we may extend this by two further months, and we'll tell you why within the first month. Exercising your rights is free, unless a request is manifestly unfounded or excessive.

Some limits apply: we can't give you content we never stored, and we keep the billing records that tax law requires (anonymizing them when you delete your Account).

Complaints to the supervisory authority

If you think we haven't handled your data correctly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es, or to the supervisory authority of the EU country where you live or work. We'd appreciate the chance to solve the problem first.

Personal data in your requests

If you are a business customer and your requests contain personal data of other people (for example, your own customers or users), you decide why and how that data is processed, and we act as your processor under our Data Processing Agreement. You must have a legal basis for sending it and inform the people concerned. Because we don't store content, we can't search it to answer their requests; we forward to you any request we receive about it.