Privacy policy

1. Controller

Oscar Rojas, Quartiersweg 7, 10829 Berlin, Germany. Email: contact@modeluplink.com.

2. Data we process

• Account and access data: email address, session and device-login records, and security events.
• Endpoint data: endpoint name, engine, selected region, connection presence, free-evaluation allowance, and scoped API-key identifiers. Secret API keys are displayed once and stored only in hashed form.
• Billing and cancellation data: customer, subscription, invoice, payment status, and tax information received from Stripe, plus the identity, contract reference, requested end date, reason if supplied, receipt time, processing status, and confirmation address submitted through the cancellation page. We do not store full card details.
• Operational metadata: endpoint identifier, selected region, connection timing and encrypted byte counts, plus ordinary security and server logs. The relay handles encrypted traffic and does not receive the contents of prompts or responses.
• Support data: information you send us when requesting help.

3. Prompts and responses

Your app encrypts prompts, responses, images, embeddings, and other model traffic for the Model Uplink agent on your machine. The private key used to decrypt that traffic is created and stored on your machine; it is not given to the relay. The relay reads the destination hostname so it can send the encrypted traffic to the right machine, but it cannot decrypt the request, response, API key, or API route inside it. The agent checks the endpoint key and permitted routes before forwarding a request to your local model. The control API receives an identifier and a one-way proof for the endpoint key, not the reusable key or the prompt. As with any HTTPS service, security also depends on the certificate and DNS systems, the software, and the control plane. Your model and the apps you connect may process content under their own terms.

4. Purposes and legal bases

• To create and perform your service contract, authenticate you, connect endpoints, and provide support (Article 6(1)(b) GDPR).
• To bill for the service and meet tax, accounting, and other legal duties (Article 6(1)(b) and (c) GDPR).
• To secure, operate, debug, and improve service reliability, prevent abuse, and enforce fair-use limits (Article 6(1)(f) GDPR). Our legitimate interests are a secure and dependable service.
• Where we ask for optional consent, on the basis of Article 6(1)(a) GDPR. You may withdraw consent at any time.

5. Service providers and international transfers

We use service providers where needed to operate Model Uplink, including Amazon Web Services for hosting, DNS, domain registration, and email, Stripe for billing and tax, Plausible Analytics for website statistics, and Let’s Encrypt for endpoint certificates. Encrypted model traffic is relayed through Frankfurt, Germany, or Northern Virginia, United States, depending on which relay your app connects to; the relay cannot read that traffic. Our current subprocessor list describes their functions and locations. Where data is transferred outside the European Economic Area, we rely on an adequacy decision or appropriate safeguards such as the European Commission’s standard contractual clauses.

6. Retention schedule

• Inference content: not intentionally stored by the relay or control plane; transient encrypted buffers exist only for the connection and are released when it ends.
• Identifiable request and connection metadata: 30 days, followed by deletion. Statistics kept longer are aggregated or stripped of account, endpoint, key, and request identifiers.
• Application, security, and infrastructure logs: 30 days.
• Email sign-in codes and device authorisations: valid for 10 minutes and deleted on use or by the daily expiry job within 24 hours.
• Account sessions: valid for 30 days and deleted on sign-out or by the daily expiry job within 24 hours after expiry.
• Revoked API-key records: 30 days after revocation. We retain only one-way secret verifiers, not reusable keys.
• Account and active endpoint records: for the life of the account, then deleted within 30 days after a verified closure request, except records we must retain by law.
• Cancellation declarations and confirmations: six years from the end of the calendar year in which they were received, unless a longer legal hold applies.
• Endpoint-hostname allocation tombstones: retained indefinitely without an account link so a hostname is not reassigned to another customer.
• Support correspondence: 24 months after the matter is closed, unless a longer period is required for a legal claim.
• Invoices, payments, and tax records: eight years from the end of the calendar year in which the record was created, or longer where a legal hold applies.
• Database backups: expire within 14 days after deletion from the live database.

We may suspend deletion for the limited data covered by a documented legal hold, security incident, or binding preservation requirement. When the hold ends, the ordinary schedule resumes.

7. Website storage and cookies

The dashboard uses strictly necessary, secure cookies for sign-in and cross-site request forgery protection. The signed session cookie is HttpOnly, expires with the browser session, and is removed when you sign out; signing out also revokes the underlying session on our control plane so the cookie can no longer be used. We do not currently use advertising cookies. We use Plausible Analytics to understand aggregate traffic on our public website pages, including pages visited, referral sources, browser and device categories, and approximate location. Plausible does not use cookies or persistent identifiers for this measurement. Our sign-in and dashboard pages are excluded. See Plausible’s data policy for details.

8. Your rights

Subject to the GDPR’s conditions, you may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent without affecting earlier lawful processing. Contact contact@modeluplink.com to exercise these rights. You may also complain to a supervisory authority, including the Berlin Commissioner for Data Protection and Freedom of Information.

9. Security and changes

We use technical and organisational safeguards appropriate to the risk, including encryption in transit, scoped credentials, access controls, and content-minimising telemetry. No internet service is risk-free. We may update this policy as the service or law changes; the date above identifies the latest version.