Privacy Policy

1. Controller

Nubri GmbH, Liebenowzeile 22, 12167 Berlin, Germany. Email: info@nubri.co.

2. What we process

• Account data: your email address and your password, which we store only as an Argon2id hash, never in readable form.
• Session cookie: one essential cookie (mo_session) that keeps you signed in for up to 30 days. We store only a hash of its value.
• API keys: a hash of each key, its first characters for display, its name and spend cap. The full key is shown to you once and is not stored.
• Usage records: for each API request, the time, model, API key, token counts, cost, status and latency. We do not store the content of your prompts or of the model’s responses.
• Prompts and responses: passed through to the model provider to produce the response (see section 4) and not retained by us.
• Payment data: payments are processed by Stripe. We pass your email address to Stripe for the checkout and receipt, and receive the checkout reference, amount, currency and payment status. We never receive your card details. We keep a record of every credit and charge on your account.
• Technical data: our servers log IP address, time, requested path, status code and user agent for security and troubleshooting. Sign-up and sign-in attempts are counted per IP address to prevent abuse; those counters are deleted after two hours.

3. Purposes and legal bases

• Providing the Service: your account, API access, usage accounting and billing (Art. 6(1)(b) GDPR, performance of a contract).
• Keeping billing records as required by German commercial and tax law (Art. 6(1)(c) GDPR, legal obligation).
• Security, abuse and fraud prevention, rate limiting and server logs (Art. 6(1)(f) GDPR, our legitimate interest in operating a secure service).

We do not use your data for advertising and do not sell it.

4. Recipients

• Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg, and Amazon Web Services, Inc., USA): hosting of the Service in the United States, and Amazon Bedrock, which processes prompts and responses for Claude models in the United States. According to AWS, Amazon Bedrock does not use prompts or responses to train models and does not share them with the model providers.
• OpenAI (OpenAI, L.L.C., USA) and Anthropic (Anthropic, PBC, USA): only if you use a model that we serve directly through that vendor’s API.
• Stripe (Stripe Payments Europe, Ltd., Ireland, and Stripe, Inc., USA): payment processing.

Transfers to the United States rely on the EU-U.S. Data Privacy Framework where the recipient is certified, and otherwise on the European Commission’s Standard Contractual Clauses.

5. Retention

We keep account data, API keys and usage records while your account exists and delete them when it is deleted. Records of payments, credits and charges are kept for the periods required by German commercial and tax law (up to 10 years). Server logs are kept only as long as needed for security and troubleshooting.

6. Cookies

We use only the essential session cookie described above. We use no analytics, advertising or third-party cookies. The Stripe checkout page is operated by Stripe under its own privacy policy.

7. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). To exercise them, or to delete your account, email info@nubri.co from the address you registered with. You also have the right to lodge a complaint with a supervisory authority, for example the Berlin Commissioner for Data Protection and Freedom of Information.

8. Security

Connections to the website and API are encrypted with TLS, as are our calls to model providers and Stripe. Passwords are hashed with Argon2id; API keys and session tokens are stored only as hashes. Access to production systems is restricted.

9. Changes

We will update this policy when our processing changes and show the date of the last update at the top of this page.