Privacy policy
Last updated October 15, 2026
1. Controller
Thomas COLLET EI is the controller of the personal data described below, under the EU General Data Protection Regulation (GDPR). When a business sends its own users' data to a model through the service, we process that content on its behalf, as its processor.
2. What we process, why and for how long
| Data | Purpose | Legal basis | Kept |
|---|---|---|---|
| Email address, password (hashed) or Google sign-in identity | Your account and signing in | Contract | For the life of the account; erasure requests are reviewed manually (section 8) |
| API keys (only a hash and a short prefix are stored) | Programmatic access | Contract | For the life of the account; erasure requests are reviewed manually (section 8) |
| Credit purchases, machine usage and charges | Billing, invoices and accounting | Contract, legal obligation | 10 years (French Commercial Code, article L123-22) |
| Billing address, business name and tax ID, card details | Payment and invoices | Contract, legal obligation | Collected and kept by Stripe; we never see card numbers |
| A one-way hash of your IP address (or of its /64 network) | Limiting anonymous searches of GPU offers | Legitimate interest (preventing abuse) | Until the next anonymous search after its one-minute window |
| Technical logs (requests, errors, identifiers) | Running, securing and debugging the service | Legitimate interest | 7 days |
| Database backups | Recovery after an incident | Legitimate interest | 35 days |
| Email address and message sent through the contact form | Answering you | Legitimate interest | As long as the exchange requires, then 3 years at most |
3. Your prompts, answers and code
What you send to a model, its answers and the files in your coding workspace are not stored in our database. They pass through our proxy to the machine you rented and are processed there. The workspace lives on that machine and is deleted when the machine is destroyed. Conversations in the chat interface are kept in its own storage only until that service restarts. When the chat's web search is used, the search query it writes is sent to DuckDuckGo.
4. Who receives data
- Scaleway SAS (France): hosting, database, logs and transactional email.
- Cloudflare, Inc. (United States): network delivery and protection of every request.
- Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (United States): payments and invoices.
- Google LLC (United States): only if you choose to sign in with Google.
- Vast.ai (United States) and the independent host of the machine you rent, in the country shown on the offer: everything you send to the model runs on that machine.
- DuckDuckGo (United States): web search queries from the chat, when used.
We do not sell personal data and do not use it for advertising.
5. Transfers outside the European Union
Cloudflare, Stripe and Google transfer data to the United States under the EU–US Data Privacy Framework or the European Commission's standard contractual clauses; Vast.ai relies on standard contractual clauses. A machine you rent may be located outside the European Union, in a country whose level of protection the Commission has not recognized: the offer shows its country before you launch. If your data must stay in the European Union, choose an offer located there, and do not send special categories of personal data to a model.
6. Cookies and similar storage
We use only what the service cannot work without: the sign-in session cookie set by our identity server, the sign-in state the dashboard keeps for the current browser tab, and your choice of light or dark theme. We use no analytics, advertising or tracking cookies, so we do not ask for consent.
7. Security
Every service runs in private containers reachable only through our edge, secrets are kept in a secret manager, API keys are stored hashed and backups are immutable. If a breach is likely to put your rights at risk, we notify the CNIL within 72 hours and tell you without undue delay.
8. Your rights
You can ask to access, correct, delete or receive a copy of your data, to restrict its use or to object to a processing based on our legitimate interest, by writing to contact@algosia.ai or through the contact form. Requests are handled manually, including review of identity records and API-key revocation. Sending a request does not automatically delete your account or revoke your keys. Accounting records and their links to the corresponding account are retained for the legal retention period. You may also lodge a complaint with the CNIL ( www.cnil.fr).