24:I[605500,["/_next/static/chunks/16vzwrgxdneps.js","/_next/static/chunks/33tewtylqj_5b.js","/_next/static/chunks/0yh4s14oodo_f.js","/_next/static/chunks/2tz0gxhvwxxub.js","/_next/static/chunks/42q5_ukskwesl.js","/_next/static/chunks/3esr3jvuqehgh.js","/_next/static/chunks/0srlvyxuw0y_6.js","/_next/static/chunks/3ddrdf6v7uu1n.js","/_next/static/chunks/31utpnhcbkxpr.js","/_next/static/chunks/0snsxfzdz3et9.js","/_next/static/chunks/2kary8xqw6rjk.js","/_next/static/chunks/3aqwdy6s10p-h.js","/_next/static/chunks/17szccov77p-c.js","/_next/static/chunks/06wlonmjxades.js","/_next/static/chunks/11zq5tgr3odpx.js","/_next/static/chunks/0dx6v_-51likk.js","/_next/static/chunks/3pxb171e0ipxi.js","/_next/static/chunks/2zriw_w0xx4ex.js"],"Image"] 25:I[453199,["/_next/static/chunks/16vzwrgxdneps.js","/_next/static/chunks/33tewtylqj_5b.js","/_next/static/chunks/0yh4s14oodo_f.js","/_next/static/chunks/2tz0gxhvwxxub.js","/_next/static/chunks/42q5_ukskwesl.js","/_next/static/chunks/3esr3jvuqehgh.js","/_next/static/chunks/0srlvyxuw0y_6.js","/_next/static/chunks/3ddrdf6v7uu1n.js","/_next/static/chunks/31utpnhcbkxpr.js","/_next/static/chunks/0snsxfzdz3et9.js","/_next/static/chunks/2kary8xqw6rjk.js","/_next/static/chunks/3aqwdy6s10p-h.js","/_next/static/chunks/17szccov77p-c.js","/_next/static/chunks/06wlonmjxades.js","/_next/static/chunks/11zq5tgr3odpx.js","/_next/static/chunks/0dx6v_-51likk.js","/_next/static/chunks/3pxb171e0ipxi.js","/_next/static/chunks/3ux7hsk-mpu0k.js","/_next/static/chunks/1ktqw7oiknv21.js","/_next/static/chunks/1wm-mz-4e2o00.js","/_next/static/chunks/3na1h9dgmiuc-.js","/_next/static/chunks/0wrk2giuurqzp.js","/_next/static/chunks/453ltvjdnu1ga.js"],"TurboLink"] 26:I[27201,["/_next/static/chunks/33t46atd3n2zd.js"],"IconMark"] 27:I[787496,["/_next/static/chunks/16vzwrgxdneps.js","/_next/static/chunks/33tewtylqj_5b.js","/_next/static/chunks/0yh4s14oodo_f.js","/_next/static/chunks/2tz0gxhvwxxub.js","/_next/static/chunks/42q5_ukskwesl.js","/_next/static/chunks/3esr3jvuqehgh.js","/_next/static/chunks/0srlvyxuw0y_6.js","/_next/static/chunks/3ddrdf6v7uu1n.js","/_next/static/chunks/31utpnhcbkxpr.js","/_next/static/chunks/0snsxfzdz3et9.js","/_next/static/chunks/2kary8xqw6rjk.js","/_next/static/chunks/3aqwdy6s10p-h.js","/_next/static/chunks/17szccov77p-c.js","/_next/static/chunks/06wlonmjxades.js","/_next/static/chunks/11zq5tgr3odpx.js","/_next/static/chunks/0dx6v_-51likk.js","/_next/static/chunks/3pxb171e0ipxi.js","/_next/static/chunks/3ux7hsk-mpu0k.js","/_next/static/chunks/1ktqw7oiknv21.js","/_next/static/chunks/1wm-mz-4e2o00.js","/_next/static/chunks/3na1h9dgmiuc-.js","/_next/static/chunks/0wrk2giuurqzp.js","/_next/static/chunks/453ltvjdnu1ga.js"],"I18nControls"] 28:I[304349,["/_next/static/chunks/16vzwrgxdneps.js","/_next/static/chunks/33tewtylqj_5b.js","/_next/static/chunks/0yh4s14oodo_f.js","/_next/static/chunks/2tz0gxhvwxxub.js","/_next/static/chunks/42q5_ukskwesl.js","/_next/static/chunks/3esr3jvuqehgh.js","/_next/static/chunks/0srlvyxuw0y_6.js","/_next/static/chunks/3ddrdf6v7uu1n.js","/_next/static/chunks/31utpnhcbkxpr.js","/_next/static/chunks/0snsxfzdz3et9.js","/_next/static/chunks/2kary8xqw6rjk.js","/_next/static/chunks/3aqwdy6s10p-h.js","/_next/static/chunks/17szccov77p-c.js","/_next/static/chunks/06wlonmjxades.js","/_next/static/chunks/11zq5tgr3odpx.js","/_next/static/chunks/0dx6v_-51likk.js","/_next/static/chunks/3pxb171e0ipxi.js","/_next/static/chunks/3ux7hsk-mpu0k.js","/_next/static/chunks/1ktqw7oiknv21.js","/_next/static/chunks/1wm-mz-4e2o00.js","/_next/static/chunks/3na1h9dgmiuc-.js","/_next/static/chunks/0wrk2giuurqzp.js","/_next/static/chunks/453ltvjdnu1ga.js"],"FooterNavigation"] 23:T37b9,

Last updated: 2026-09-20

This policy explains how Cognitivers LLC handles personal data when you use the website, the console, the API and the chat interface (the "Service"). It is written to meet the requirements of the EU General Data Protection Regulation ("GDPR") and the UK GDPR. Where we process personal data contained in the requests you send through the API on your behalf, we act as your processor and the Data Processing Addendum applies instead of sections 4 to 6 of this policy.

1. Who is responsible

Controller: Cognitivers LLC, a limited liability company formed under the laws of [STATE], United States, registered address [REGISTERED ADDRESS].

EU representative (GDPR Article 27): [EU REPRESENTATIVE]. Because we are established outside the EU and offer services to people in the EU, we are required to appoint a representative in the Union. You may contact the representative on any matter relating to this policy, in addition to or instead of contacting us.

UK representative (UK GDPR Article 27): [UK REPRESENTATIVE]. Required if we accept customers in the United Kingdom. If this placeholder is not filled, we do not currently accept UK customers.

Privacy contact: [PRIVACY EMAIL]. We have not appointed a statutory data protection officer because we are not required to at our size and activity; the privacy contact performs that role in practice.

2. Where your data is

GPU inference, request logs and the databases that hold your Account run on infrastructure located in the European Union. Cognitivers LLC is a United States company, which means that as controller it is established in the US even though the data itself is stored and processed in the EU. Section 7 explains what that means for transfers and how we address it.

3. What data we process and why

3.1 Account and identity data

Name, email address, password hash or OAuth identifier, organisation name, role, language and theme preference, the IP address and user agent used to sign in, and the verification information we request under our compliance programme (organisation registration number, business contact, stated use, evidence of authorisation for offensive-security work).

Purposes: creating and securing your Account; verifying who we are dealing with; preventing abuse; meeting the "know your business" checks described in the Terms.

Legal bases: performance of the contract (Art. 6(1)(b)); our legitimate interest in preventing misuse of a service that serves models without a moderation layer (Art. 6(1)(f)); legal obligation where sanctions screening applies (Art. 6(1)(c)).

3.2 Billing data

Billing name and address, VAT number, country, transaction history, invoices, the last four digits and brand of the payment card. Full card data is collected and held by Stripe, not by us.

Purposes: charging you; issuing invoices; tax compliance; fraud prevention.

Legal bases: contract (Art. 6(1)(b)); legal obligation for tax and accounting records (Art. 6(1)(c)).

3.3 API request data

This is the data category that depends on the retention setting of each API key. You choose the setting; we apply it.

Retention setting	What we store	Personal data involved
None	Aggregate token counts and cost per key, for billing. No per-request record.	None beyond Account and key identifiers
Metadata only (default)	Per request: timestamp, model, input and output token counts, latency, status code, key and Account identifiers, client IP address, user agent. Not the content of prompts or outputs.	IP address, identifiers
Full requests	Everything in "Metadata only" plus the content of Inputs and Outputs, so that you can review and export them.	Whatever you put in your requests

Purposes: billing; capacity planning; detecting abuse; investigating suspected breaches of the Acceptable Use Policy; our own legal defence; and, for full retention, giving you the review and export features you asked for.

Legal bases: contract (Art. 6(1)(b)); legitimate interest in security, abuse prevention and defence of legal claims (Art. 6(1)(f)). Where the content of your requests contains personal data about other people, we process it as your processor under the DPA.

We do not run a moderation layer that reads your prompts. We may run automated checks on requests for indicators of known illegal material and for abuse signals (rate anomalies, known-bad patterns); these checks do not involve a person reading your content unless a signal is triggered and an investigation is opened. [CONFIRM which automated checks are actually in place before publication.]

3.4 Chat interface data

Conversations you have in the chat interface are stored in your Account so that you can return to them, until you delete them or close your Account. The retention setting of the key used by the chat interface applies to the underlying API requests.

Legal basis: contract (Art. 6(1)(b)).

3.5 Embeddings

Embeddings requests are processed like any other API request. The retention setting of the key applies. We do not keep the vectors after returning them unless the key uses full retention.

3.6 Website and console usage data

Server logs (IP address, URL, timestamp, user agent, referrer) kept for security. Analytics events (pages viewed, features used, approximate location derived from IP) only if you consent to measurement cookies; see the Cookie Policy. Error reports sent to our monitoring provider, which may contain the URL, browser details and, if you are signed in, your user identifier.

Legal bases: legitimate interest in keeping the Service secure and working (Art. 6(1)(f)); consent for analytics (Art. 6(1)(a)), which you may withdraw at any time from the cookie preferences link in the footer.

3.7 Support and communications

Emails you send us, support tickets, abuse reports and the records of our replies. Transactional emails we send you (sign-in links, invoices, security notices, changes to the terms). Marketing emails only with your consent, which you may withdraw with the unsubscribe link.

Legal bases: contract; legitimate interest in running support and keeping records of complaints; consent for marketing.

3.8 Compliance and enforcement records

Records of verification requests, evidence of authorisation you provided, suspension and termination decisions, abuse investigations and any report we made to an authority.

Purposes: operating the compliance programme described in the Terms; demonstrating that we acted properly; defending legal claims.

Legal bases: legitimate interest (Art. 6(1)(f)); legal obligation where a report is mandatory (Art. 6(1)(c)).

4. Where the data comes from

Almost all of it comes from you. We also receive data from Stripe (payment status, fraud signals), from the OAuth provider you sign in with (email, name, identifier), and from public sanctions lists and company registers when we verify an organisation.

5. Who we share it with

We share personal data with the subprocessors listed on the Subprocessors page, in summary: the GPU hosting provider in the EU, Cloudflare for networking and application hosting, Stripe for payments, Neon for the database, our email provider, and the error-monitoring and (with consent) analytics providers. Each is bound by a contract that restricts what they may do with the data.

We may also disclose personal data to law enforcement, courts or regulators where we are legally required to, or where we report a serious offence under the Acceptable Use Policy. Where the law allows, we will tell you.

We do not sell personal data and we do not share it with data brokers or advertising networks.

6. How long we keep it

Data	Retention
Account data	Life of the Account plus 30 days, then deleted; identifiers needed for invoices are kept with the invoice
Verification and evidence of authorisation	Life of the Account plus 5 years [CONFIRM], for our legal defence
Billing records and invoices	10 years, as tax and accounting law requires [CONFIRM the period for [STATE] and the EU countries where VAT is due]
API request metadata ("metadata only" setting)	30 days, then deleted or aggregated [CONFIRM]
API request content ("full requests" setting)	Until you delete it, or 90 days after the last request on that key, whichever is earlier [CONFIRM]
Chat conversations	Until you delete them or close the Account
Server logs	30 days
Analytics events	12 months from collection; deleted when you withdraw consent, going forward
Error reports	90 days
Support and abuse correspondence	3 years from closure of the ticket
Enforcement and reporting records	5 years from the decision, longer if required for a legal proceeding
Export window after Account closure	30 days, during which you may download your data

We keep data longer only when a legal claim, an investigation or a legal hold requires it.

7. International transfers

Storage and inference happen in the EU. Even so, Cognitivers LLC is established in the United States, and our staff may access data from outside the EU to operate the Service. That access is a transfer under GDPR Chapter V. We address it as follows:

Cognitivers LLC [CONFIRM: certifies / does not certify] under the EU-US Data Privacy Framework. If certified, transfers to us are covered by the Commission's adequacy decision of 10 July 2023 for as long as it stands.
Independently of that, we rely on the Standard Contractual Clauses adopted by the European Commission (Decision (EU) 2021/914) with our EU customers under the DPA, together with the transfer impact assessment described there.
Some subprocessors (Cloudflare, Stripe, the monitoring and analytics providers) are established in the US or process data globally. Each is either certified under the Data Privacy Framework or bound by Standard Contractual Clauses. The Subprocessors page lists the mechanism for each.

You may ask for a copy of the safeguards used by writing to [PRIVACY EMAIL].

8. Your rights

Under the GDPR and the UK GDPR you can ask us to:

access the personal data we hold about you and receive a copy;
rectify inaccurate data (most Account data you can change yourself in the console);
erase your data, subject to the retention we must keep by law;
restrict processing while a dispute about accuracy or lawfulness is resolved;
port the data you gave us in a machine-readable format (the audit log export and the Account export do this);
object to processing based on legitimate interest, including at any time to direct marketing;
withdraw consent where processing is based on consent, without affecting what was done before.

Write to [PRIVACY EMAIL] or to our EU representative. We will answer within one month, extendable by two months for complex requests, and we will tell you if we extend. We may ask you to prove your identity. We will not charge you unless a request is manifestly unfounded or excessive.

You have the right to complain to a supervisory authority, in particular in the EU country where you live or work or where you think a breach happened. The Spanish authority is the Agencia Española de Protección de Datos (aepd.es). The UK authority is the Information Commissioner's Office (ico.org.uk).

9. Automated decisions

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Automated abuse signals may trigger a temporary suspension of an API key; a person reviews the case before any decision to terminate an Account, and you can contest it by writing to us.

10. Security

Data is encrypted in transit (TLS) and at rest. Access to production is limited to named staff with multi-factor authentication and is logged. API keys are stored hashed. Inference runs on GPU servers in the EU that are reachable only over a private network. The DPA describes our technical and organisational measures in more detail. No system is perfectly secure; if a breach affects your data we will notify you as the law requires.

11. Cookies

We use cookies and similar storage for sign-in, preferences, consent and, only with your consent, analytics. The Cookie Policy explains each of them and how to change your choices.

12. Children

The Service is for people aged 18 or over, used in a professional or organisational capacity. We do not knowingly collect personal data from anyone under 18. If you believe a minor has created an Account, tell us at [PRIVACY EMAIL] and we will delete it.

13. Changes

We may update this policy. Material changes will be announced by email or in the console at least 14 days before they take effect. The date at the top tells you when it was last changed.

14. Contact

Cognitivers LLC, [REGISTERED ADDRESS], United States. Privacy contact: [PRIVACY EMAIL]. EU representative: [EU REPRESENTATIVE]. UK representative: [UK REPRESENTATIVE].

b:["$","section",null,{"className":"relative w-full","children":["$","div",null,{"className":"mx-auto flex w-full flex-col px-6 py-16 sm:px-10 md:py-24 gap-10 sm:gap-12 lg:gap-16","children":[["$","header",null,{"children":[["$","div",null,{"className":"border-hairline bg-canvas/60 inline-flex h-7 max-w-full items-center gap-2.5 overflow-hidden rounded-full border pr-3.5 pl-3 font-mono text-[11px] leading-none tracking-[0.12em] uppercase","children":[["$","span",null,{"aria-hidden":true,"className":"bg-ow-accent size-1.5 shrink-0 rounded-full"}],null,["$","span",null,{"className":"text-ink truncate font-medium","children":"Legal"}]]}],["$","h1",null,{"children":"Privacy Policy","className":"text-ink text-3xl font-medium tracking-tighter text-balance md:text-4xl lg:text-6xl"}],["$","p",null,{"children":"What personal data Cognitivers LLC processes, why, on which legal basis, for how long, where it is stored, and what rights you have. Written to GDPR standard for a US company hosting in the EU.","className":"text-ink-muted text-balance md:text-lg"}]],"className":"flex flex-col gap-4 items-center text-center"}],["$","div",null,{"className":"typeset typeset-prose w-full max-w-[65ch] min-w-0 pb-6","dangerouslySetInnerHTML":{"__html":"$23"}}]]}]}] 1e:["$","main",null,{"className":"bg-canvas relative flex flex-1 flex-col items-center justify-center overflow-hidden px-6 py-24","children":[["$","$L24",null,{"src":"/images/brand/tex-orb.webp","alt":"","width":1200,"height":896,"className":"pointer-events-none absolute top-1/2 left-1/2 w-[48rem] max-w-none -translate-x-1/2 -translate-y-1/2 [mask-image:radial-gradient(ellipse_50%_50%_at_50%_50%,black_20%,transparent_100%)] opacity-40"}],["$","div",null,{"className":"relative flex max-w-xl flex-col items-center gap-6 text-center","children":[["$","span",null,{"className":"text-ink-muted text-caption font-mono","children":"404"}],["$","h1",null,{"className":"text-ink text-[clamp(2rem,5vw,3.5rem)] leading-[1.02] font-medium tracking-[-0.04em] text-balance","children":"Not found!"}],["$","p",null,{"className":"text-ink-muted text-lead max-w-md text-pretty","children":"The resource you are looking for does not exist."}],["$","$L25",null,{"href":"/","className":"focus-visible:outline-solid focus-visible:outline-ink focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:border-ring focus-visible:ring-ring/50 aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive dark:aria-invalid:border-destructive/50 group/button inline-flex shrink-0 cursor-pointer touch-manipulation items-center justify-center gap-2 rounded-md bg-clip-padding text-sm font-medium whitespace-nowrap transition-all outline-none select-none focus-visible:ring-[3px] active:scale-[0.97] disabled:pointer-events-none disabled:opacity-50 aria-invalid:ring-[3px] [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-']):not([class*='w-']):not([class*='h-'])]:size-4 h-11 px-6 has-data-[icon=inline-end]:pr-4 has-data-[icon=inline-start]:pl-4 bg-ink text-canvas hover:bg-ink/90 rounded-pill","children":"Go back home"}]]}]]}] e:null 12:[["$","title","0",{"children":"Privacy Policy | Cognitivers"}],["$","meta","1",{"name":"description","content":"What personal data Cognitivers LLC processes, why, on which legal basis, for how long, where it is stored, and what rights you have. Written to GDPR standard for a US company hosting in the EU."}],["$","link","2",{"rel":"manifest","href":"/manifest.webmanifest","crossOrigin":"$undefined"}],["$","meta","3",{"property":"og:title","content":"Privacy Policy"}],["$","meta","4",{"property":"og:description","content":"What personal data Cognitivers LLC processes, why, on which legal basis, for how long, where it is stored, and what rights you have. Written to GDPR standard for a US company hosting in the EU."}],["$","meta","5",{"property":"og:url","content":"https://cognitivers.com"}],["$","meta","6",{"property":"og:site_name","content":"Cognitivers"}],["$","meta","7",{"property":"og:image","content":"https://cognitivers.com/images/og.jpg"}],["$","meta","8",{"property":"og:image:width","content":"1200"}],["$","meta","9",{"property":"og:image:height","content":"630"}],["$","meta","10",{"property":"og:image:alt","content":"Cognitivers"}],["$","meta","11",{"property":"og:type","content":"website"}],["$","meta","12",{"name":"twitter:card","content":"summary_large_image"}],["$","meta","13",{"name":"twitter:title","content":"Privacy Policy"}],["$","meta","14",{"name":"twitter:description","content":"What personal data Cognitivers LLC processes, why, on which legal basis, for how long, where it is stored, and what rights you have. Written to GDPR standard for a US company hosting in the EU."}],["$","meta","15",{"name":"twitter:image","content":"https://cognitivers.com/images/og.jpg"}],["$","meta","16",{"name":"twitter:image:alt","content":"Cognitivers"}],["$","meta","17",{"name":"twitter:image:width","content":"1200"}],["$","meta","18",{"name":"twitter:image:height","content":"630"}],["$","link","19",{"rel":"icon","href":"/favicon.ico?favicon.36as9cjf1g_xo.ico","sizes":"32x32","type":"image/x-icon"}],["$","link","20",{"rel":"icon","href":"/icon.svg?icon.3hq66w4z7z21z.svg","sizes":"any","type":"image/svg+xml"}],["$","link","21",{"rel":"apple-touch-icon","href":"/apple-icon.png?apple-icon.2rei5i9lrk0dq.png","sizes":"180x180","type":"image/png"}],["$","$L26","22",{}]] 22:["$","footer",null,{"className":"relative isolate mt-auto w-full overflow-hidden","children":[["$","div",null,{"aria-hidden":true,"className":"from-ow-accent/24 via-ow-accent/7 pointer-events-none absolute inset-x-0 top-0 -z-1 h-80 bg-radial-[ellipse_50%_100%_at_50%_0%] via-45% to-transparent to-75%"}],["$","div",null,{"className":"divide-hairline grid grid-cols-1 divide-y md:grid-cols-4 md:divide-x md:divide-y-0","children":[["$","div",null,{"className":"flex flex-col items-start gap-4 p-8 lg:pt-18","children":[["$","$L25",null,{"href":"/","className":"text-ink flex shrink-0 items-center gap-2.5","aria-label":"Home","children":[["$","svg",null,{"viewBox":"0 0 64 64","fill":"none","aria-hidden":true,"className":"size-7","children":[["$","rect",null,{"x":"16","y":"40","width":"36","height":"13","rx":"6","fill":"currentColor"}],["$","rect",null,{"x":"10","y":"25","width":"36","height":"13","rx":"6","fill":"currentColor"}],["$","rect",null,{"x":"18","y":"10","width":"36","height":"13","rx":"6","className":"fill-ow-accent"}]]}],["$","span",null,{"className":"font-brand text-[1.45rem] leading-none font-extrabold tracking-[-0.04em] lowercase","children":"cognitivers"}]]}],["$","p",null,{"className":"text-small text-ink-muted max-w-xs text-pretty","children":"Open-weight inference without the refusal layer, served from GPUs in the EU. One endpoint, your logs."}],["$","div",null,{"className":"mt-1 flex items-center gap-3","children":["$","$L27",null,{}]}]]}],["$","$L28",null,{}]]}],["$","div",null,{"className":"border-hairline border-t py-4","children":["$","div",null,{"className":"flex flex-col items-center justify-between gap-2 px-8 sm:flex-row","children":[["$","p",null,{"className":"text-small text-ink-muted text-center","children":["© ",2026," ","Cognitivers","."," ","All rights reserved","."]}],"$L29"]}]}]]}]