Politique de confidentialité
Version 1.0Ce texte est en anglais. Conditions générales
1. Who is responsible
Mathieu Dubois, 1008 Prilly, Switzerland, is responsible for the processing of personal data described here. Contact for anything about data protection: hello@llmaas.ch.
This policy covers the website llmaas.ch, the chat at chat.llmaas.ch, the API at api.llmaas.ch and our dealings with clients and prospects. It follows the Swiss Federal Act on Data Protection (FADP) and, where it applies to you, the EU General Data Protection Regulation (GDPR).
We have two roles. For account, billing, usage and contact data we decide why and how it is processed (controller). For what you send to the model we act only on our client's instructions (processor): see section 3.
2. What we process
We keep the data needed to give you access and to invoice the service, and nothing about what you ask the model.
| Data | What exactly | Where it comes from |
|---|---|---|
| Request for access | Name, email address, message, the plan asked for, language, the IP address it was sent from, the answer and when | You, through the request form |
| Account | Email address, password (stored as an argon2 hash), role, plan, language, date created, date last seen, the version of these terms accepted and when | You, or the person at your organisation who asked for your account, if it is an organisation's |
| Login sessions | Per browser login: time, IP address, browser identification, a hash of the session token | Your browser |
| API keys and access tokens | Name, a hash and the first characters of the key, dates created, last used and revoked | You |
| Usage | Per request: time, account, API key, model, number of tokens in and out, the box that answered | Our gateway |
| Your box | Its name, address, the network addresses you allowed, its running hours | You and our systems |
| Your agent | Its model provider and model, the last four characters of your provider key, your timezone, its history (created, started, locked, model changed and the like, with who did it), its payments | You and our systems |
| Billing | Name or organisation, contact person, billing address, statements, invoices, payments | You, our bank |
| Correspondence | Emails you send us and our answers | You |
| Technical logs | Time, IP address, path and status of requests to our servers; never the content | Your browser or application |
The website llmaas.ch runs no analytics and loads nothing from third parties; it remembers the language and the light or dark display you pick in two cookies (section 8). Requests that go directly to your box (direct access) do not pass through our gateway: we see a count of completed requests, nothing else.
3. Prompts, files and answers
We do not store what you send to the model or what it answers, and we do not use it to train any model.
- A request travels encrypted to our gateway and on to the model server: the client's dedicated box, or, on the free and agent plans, our shared model server in Switzerland. It is answered there, and is gone once the answer is sent.
- Chat conversations are saved in your own browser (local storage). Deleting them there deletes them; we have no copy.
- A file you attach in the chat is turned into text (or, for an image, into data the model can see) as soon as it arrives. While that happens it may sit in a temporary file on the gateway, deleted as soon as it is read; the result is then held in the gateway's memory for at most one hour so the model can use it, and is never stored.
- Our logs do not contain prompts or answers. Detailed logging for fault-finding is switched on only with the client's written consent, for an agreed time.
- Web search is optional and exists only in our chat app; the API never searches the web. When a user switches it on for a conversation, the search query the model writes is sent from our server to the search engine DuckDuckGo, outside Switzerland, and our server may open the web pages the model chooses to read, on any site and in any country. The search engine receives the query, and each site the address of its page; neither receives your IP address, your identity or the rest of the conversation. Our server reads public addresses only, never a private network.
- If the client has asked for it (it is off otherwise), requests are answered by our shared model server in Switzerland while their own box is unavailable. The same rules apply there.
Your agent, on the agent plan, keeps its conversations, memory and files on its own encrypted disk in Switzerland; we do not read them. You choose who holds the key to that disk: you alone, or our gateway as well, so the agent restarts by itself after a reboot; in that case our gateway can unlock the disk, and does so only to start the agent. The agent's log, on its own machine, records the start of each message and each tool it uses; it is shown to you alone, on your agent's page, and our operators cannot see it. The agent's requests to our model server follow the rules above. What it sends to the channels, tools, services and model providers you connect to it leaves our infrastructure, often Switzerland, at your choice (Terms 2.8): those services receive it under their own terms, and we are not a party to that.
Where an organisation gave you access (your employer, for example), that organisation is the client: it is the controller for this content and we are its processor. Requests about personal data inside prompts or files then go to the client; we help the client answer them. Where you hold the account for yourself, you are the client: you decide what you send, and we process it only to answer you, as described above.
4. Why we process it
We process personal data to provide and invoice the service, to keep it secure, and to meet our legal duties. We do not sell data, build profiles, send advertising or take automated decisions about people.
| Purpose | Data used | Legal basis under the GDPR, where it applies |
|---|---|---|
| Answering a request for access and opening the account | Request for access | Steps before a contract (art. 6(1)(b)) |
| Giving you access: login, keys, routing requests to your box or the shared model server | Account, sessions, keys | Contract (art. 6(1)(b)) |
| Running your agent: its machine, its settings, its history | Your agent | Contract (art. 6(1)(b)) |
| Showing usage and preparing the monthly statement and invoice | Usage, box, agent, billing | Contract (art. 6(1)(b)) |
| Security: limiting failed logins and requests per address, spotting misuse of a key, investigating incidents | Sessions, technical logs, usage, request for access | Legitimate interest (art. 6(1)(f)) |
| Operating and improving the service: capacity, faults, performance | Usage, technical logs | Legitimate interest (art. 6(1)(f)) |
| Answering your messages and offers | Correspondence | Contract or steps before a contract (art. 6(1)(b)) |
| Accounting and tax records | Billing | Legal obligation (art. 6(1)(c)) |
Under Swiss law this processing needs no separate justification as long as it stays within these purposes.
5. Where the data is and who receives it
All our servers are in data centres in Switzerland: the gateway, the database, the shared model server, every client's box and every agent. We do not transfer account, usage or billing data abroad.
| Recipient | What it receives | Where |
|---|---|---|
| Our cloud provider (virtual machines, GPU machines, managed database, email) | Everything in section 2, as our processor; requests in transit to the machines it hosts | Switzerland |
| Our bank | Payment data | Switzerland |
| DuckDuckGo (search engine) | Search queries, only when web search is switched on in our chat app | Outside Switzerland (United States and other countries) |
| The sites of the pages the model reads | The address of the page, from our server, only when web search is switched on in our chat app | Wherever those sites are |
| Authorities and courts | What a binding Swiss order requires | Switzerland |
The cloud provider is named in the data processing agreement and on request. We tell clients before we add or replace a processor that handles their data.
Web search is the only way data we handle goes abroad by our choice; the services you connect to your agent are yours to choose (section 3). The search engine receives the query text and each site the address of its page, from our server, never your identity or IP address. Switzerland does not recognise the United States, nor every country a site may be in, as offering adequate protection in general; these transfers rely on the user's choice to switch web search on. Leave it off if queries could contain personal or confidential data.
The holder of a client account sees that account's usage per API key. Our operators can see account, usage and billing data to run the service and give support.
6. How long we keep it
We keep data for as long as the contract runs and the law requires, then delete it.
| Data | Kept for |
|---|---|
| Prompts, answers, conversations | Not stored |
| Files attached in the chat | At most 1 hour, in memory only |
| Request for access | Until it is answered, then 12 months |
| Account, API keys, access tokens | The contract; then the account is suspended, and deleted when the client asks |
| Your agent's settings and history | As long as the account |
| Login sessions | Until sign-out or 30 days without activity (8 hours for our operators), then deleted at our next clean-up |
| Usage per request | 24 months |
| Statements, invoices and accounting records | 10 years, as Swiss law requires (art. 958f Code of Obligations) |
| Correspondence | 3 years after the last exchange; 10 years where it documents the contract |
Your agent's disk, with its memory and files, is deleted with the agent: when you delete it, at the end of the month paid for once you cancel it, or when it is deleted unpaid (Terms 5.10). Usage per request, requests for access and ended login sessions are removed by a clean-up we run by hand, so a row may outlive its period until the next run.
A revoked API key or token stops working at once; its record (name, first characters, dates) is kept with the account so that past usage stays attributable.
7. How we protect it
- Every connection is encrypted with TLS: browser or application to the gateway, and gateway to each box, where both sides prove their identity with certificates.
- A dedicated box runs its client's model on a virtual machine and GPU used by that client alone; the free and agent plans share our model server, which keeps nothing of one request for the next. Each machine's firewall admits only our gateway and, for a dedicated box, the addresses its client has allowed.
- Passwords are stored as argon2 hashes. API keys, access tokens and session tokens are stored as hashes only; a copy of the database logs nobody in.
- The session cookie cannot be read by scripts and is sent only over HTTPS. Failed logins are rate-limited. Changing a password signs out every other browser.
- Only our operators can reach the servers and the operator console; their sessions expire after 8 hours without activity.
- The database is backed up by the cloud provider in Switzerland.
If a breach is likely to put you at risk, we inform the affected clients and the competent authority without undue delay.
8. Your rights, cookies and changes
Your rights. You may ask us whether we process data about you and receive a copy, have wrong data corrected, have data deleted or its processing restricted, object to processing based on our legitimate interest, and receive the data you gave us in a common electronic format. Write to hello@llmaas.ch. We answer within 30 days, free of charge. We may need to check your identity first, and we keep what the law obliges us to keep.
You can do part of this yourself in your account: change your password, revoke keys and tokens, and read your usage and statements.
Deleting your account. An account is not deleted by itself: at the end of the contract it is suspended. Ask us at hello@llmaas.ch and we delete it, with its keys, sessions and usage detail, within 30 days, keeping only what the law obliges us to keep.
Complaints. In Switzerland you may turn to the Federal Data Protection and Information Commissioner (edoeb.admin.ch). If the GDPR applies to you, you may complain to the data protection authority of your country.
Cookies and browser storage. The website llmaas.ch and the chat use two preference cookies, kept a year: llmaas_lang (your language) and theme (light or dark). Signing in adds the session cookie that keeps you signed in (__Host-llmaas_session), and opening your agent's page a cookie that lets you into it while you are signed in (llmaas_agent). They are strictly necessary or set by your own choice, and need no consent. The chat keeps your conversations and display settings, the light or dark choice among them, in your browser's local storage, on your device only; your agent's page keeps its own settings there too. There is no analytics, no advertising and no third-party content.
Changes. We may update this policy. The current version and its date are on this page. Clients are told by email of changes that affect how their data is handled.