Legal

Privacy Policy

Last updated: 1 July 2026

The short version: We do not log your prompts or completions. Your data is processed in RAM and discarded immediately after each request. Nothing you send to our API is stored, shared, or used for training.

1. Who We Are

Cheshir ("we", "us", "our") operates the AI inference API available at api.cheshir.dev and the website at cheshir.dev. Our infrastructure is located in Germany and operates under EU jurisdiction.

Contact: [email protected]

2. Data We Process

We distinguish between two categories of data:

API requests (prompts and completions): We do not store these. All inference requests are processed in server memory (RAM) and discarded immediately after the response is returned. No prompt or completion is written to disk, logged to a database, or transmitted to any third party.

Account and billing data: If you sign up for a paid plan, we collect:

Your email address
Billing information (processed by our payment provider)
API usage statistics (token counts per request — not the content of requests)

Technical logs: Our servers produce standard access logs (IP address, timestamp, HTTP status code, bytes transferred). These logs do not contain prompt or completion content. Logs are retained for a maximum of 30 days for security and debugging purposes.

3. Legal Basis for Processing

We process your data on the following legal bases under GDPR Article 6:

Contract performance (Art. 6(1)(b)) — to provide the API service you have signed up for
Legitimate interests (Art. 6(1)(f)) — to maintain security, prevent abuse, and operate reliable infrastructure
Legal obligation (Art. 6(1)(c)) — where required by applicable law

4. Data Residency

All inference runs on bare-metal servers located in Hetzner's datacenter in Germany (European Union). We do not transfer personal data outside of the European Economic Area (EEA). Your prompts, completions, and account data remain within the EU at all times.

5. Data Sharing

We do not sell, rent, or share your data with third parties for marketing purposes. We may share data only in the following circumstances:

Payment processing: Billing information is processed by our payment provider (Stripe). We do not store payment card details.
Legal requirements: We may disclose data if required by applicable law, court order, or governmental authority.

We do not use your data to train, fine-tune, or improve any AI model.

6. Data Retention

Prompt and completion content: Never stored. Discarded in RAM after each request.
Technical access logs: 30 days maximum.
Usage statistics (token counts): Retained for the duration of your account plus 90 days.
Account and billing data: Retained for the duration of your account plus the period required by applicable tax and commercial law (typically 7 years in Germany).

7. Your Rights Under GDPR

As a data subject in the EU, you have the following rights:

Right of access (Art. 15) — request a copy of personal data we hold about you
Right to rectification (Art. 16) — request correction of inaccurate data
Right to erasure (Art. 17) — request deletion of your personal data
Right to restriction (Art. 18) — request restriction of processing
Right to data portability (Art. 20) — receive your data in a machine-readable format
Right to object (Art. 21) — object to processing based on legitimate interests

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority. In Germany, the relevant authority is the Bundesbeauftragter für den Datenschutz und die Informationsfreiheit (BfDI).

8. Security

We implement appropriate technical and organisational measures to protect personal data, including:

All API communication over HTTPS (TLS 1.3)
Bare-metal servers with no shared tenancy
No prompt data written to persistent storage
Access to server infrastructure restricted to authorised personnel

9. Cookies

Our website (cheshir.dev) does not use tracking cookies or third-party analytics. We may set a minimal session cookie for authentication if you log in to an account dashboard.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify active customers of material changes by email. The date at the top of this page reflects the most recent update. Continued use of the service after changes constitutes acceptance of the updated policy.

11. Contact

For any privacy-related questions or requests, contact us at:
[email protected]