Privacy policy

Who is responsible

The controller for the eutonomous website and services (eutonomous.eu and its subdomains) is Fineupp, sole proprietorship of Kevin Keller, John Deelaan 26, 2135 XA Hoofddorp, the Netherlands — see the legal notice. Questions about your data: hello@eutonomous.eu.

Visiting the website

When you open a page, the web server receives your IP address, the page requested, the time, your browser's user agent and the referring page. This is needed to deliver the page and to keep the service secure (legitimate interest, Art. 6(1)(f) GDPR). Server logs are deleted after 14 days.

There is no analytics, no advertising and no tracking. Cookies are only set when you sign in or use a form: a session cookie and a security token against cross-site request forgery. They are strictly necessary and need no consent. Your light/dark choice is stored in your own browser and never sent to me.

Fonts and icons are served from my own servers. Visiting the pages does not make your browser contact any third party.

Contact form and email

If you write to me, through the contact form or by email, I process your name, email address, organisation (if given) and message to answer you (Art. 6(1)(b) and (f) GDPR). Messages from the form are stored on the server and forwarded to me by email. I delete them when they are no longer needed, at the latest 12 months after the last exchange, unless they lead to a contract.

Your account

Accounts are managed by a sign-in service I run myself at id.eutonomous.eu. It stores your email address, name, password (hashed) and, if you set them up, second-factor credentials. I use this data to provide the account and the services you sign up for (Art. 6(1)(b) GDPR). Account data is kept while the account exists and deleted when you close it, except what the law requires me to keep (see below).

Using the services

Inference API. Your requests are sent to the European provider named in the model id (for example Scaleway SAS, France, or STACKIT GmbH & Co. KG, Germany), which processes them to generate the answer. For every request I record usage data: the API key used, model, number of tokens, cost and time. I do not store the content of prompts or answers. The security gateway in front of the API keeps a signed record of its security decisions — for example that a request was blocked, or how many and which kinds of personal data were replaced — but never the content itself.
Workspaces, compute boxes and client-side apps. The code, files and data you put into these services are processed only to run them for you, on servers in the EU. I do not use your content to train models.
Running apps in the client-side runtime. Apps run in your own browser. To start one, your browser downloads the Python runtime (Pyodide) and the packages the app needs directly from public package servers: jsDelivr (cdn.jsdelivr.net), the Python Package Index, and for marimo notebooks wasm.marimo.app. Those servers receive your IP address and may be outside the EU. An app can also load other resources, such as map tiles; its author decides that.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

Payments

Payments are handled by Stripe Payments Europe Ltd. (Ireland) or Mollie B.V. (the Netherlands), depending on the service. They receive the data needed for the payment; I do not see or store your card or bank details. Invoices and payment records are kept for seven years, as Dutch tax law requires (Art. 6(1)(c) GDPR).

Who receives data

Hetzner Online GmbH, Germany — servers (Finland) and encrypted backups (Germany).
Scaleway SAS, France — inference, and delivery of service emails.
Proton AG, Switzerland — the hello@eutonomous.eu mailbox.
STACKIT GmbH & Co. KG, Germany — inference.
Stripe Payments Europe Ltd., Ireland, and Mollie B.V., the Netherlands — payments.

Each acts as my processor under a data processing agreement, or as an independent controller where the law makes them one (payment providers). I do not sell data.

Transfers outside the EU

Your data is processed in the EU, with two exceptions: email to hello@eutonomous.eu is stored by Proton in Switzerland, which the European Commission recognises as providing adequate protection; and when you run an app in the client-side runtime, the package servers named above may process your IP address outside the EU.

Your rights

You can ask for access to your data, correction, deletion, restriction of processing and data portability, and you can object to processing based on legitimate interest. Where processing is based on consent, you can withdraw it at any time. Just email me.

You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority in the EU country where you live.

Changes

eutonomous is still being built, and this policy will change with it. The date at the top shows the current version.