ETHUXETHUX runs open models and AI infrastructure on hardware in the Netherlands. This policy explains what we do with personal data.
We are Gijsbert Westeneng, trading as ETHUX. KvK 95784756. VAT NL005174579B17. Contact: support@ethux.net. Postal address: Lupine 43, 2231 PH Rijnsburg, the Netherlands.
Two different roles
Data you send to our API: we are a processor. Our customer decides what is sent and why, and we process it only to return a model response. If you are an end user of an application built on our API, contact the operator of that application. We forward any request that reaches us, but we cannot identify you in our systems.
Data about our website, enquiries and invoicing: here we are the controller, and the rest of this policy applies to us directly.
What we do with API data
We do not store your prompts or the model's responses. They exist in server memory for the duration of the request and are not written to disk.
To make the service fast and affordable we keep a cache derived from prompt content. It is not readable text, but we treat it as personal data. This cache:
- is deleted within an hour of its last use
- is kept in memory only and never written to disk
- can be deleted sooner at a customer's instruction
We never use your prompts or responses to train, fine-tune, evaluate or benchmark any model, or to improve our service. There is no exception and it does not depend on your plan.
Customer records and invoices are kept in Odoo Online, run by Odoo S.A. in Belgium and hosted in the European Union.
We keep usage records for billing: token counts, timestamps and which API key was used. They contain no prompt or response content. We keep them for 7 years because Dutch tax law requires it.
We keep server logs with IP addresses, endpoints, response codes and timings for 14 days, to keep the service secure and to find faults.
Website and enquiries
If you use the contact form or email us, we process your name, email address and message to reply to you. We keep this for 24 months after our last contact. Legal basis: our legitimate interest in answering enquiries, and performance of a contract where it leads to one.
Our web server logs IP addresses for 14 days. The site uses no analytics and no tracking. One cookie remembers your language.
Where your data is
In the Netherlands, on our own hardware, colocated at BIT in Ede through Xyphen IT. Neither has access to the data itself; they provide space, power and physical security.
We do not use a US-controlled cloud provider for the API. Email runs at TransIP in the Netherlands and at Proton in Switzerland, which the EU recognises as protecting personal data adequately; apart from that, no personal data leaves the European Union. DNS for ethux.net is at Cloudflare without proxying, so no site or API traffic passes through it.
Who else sees it
For our own administration we use a few processors: Odoo S.A. for customer records and invoices, TransIP and Proton for email. None of them sees data you send to the API. We have no employees and no contractors with access to customer data. We do not sell, share or disclose personal data, and we do not use it for advertising or profiling.
We would disclose data only if legally compelled by a competent Dutch or EU authority.
Your rights
You may request access, rectification, erasure, restriction or portability, or object to processing. Where we are the controller, contact us and we respond within one month. Where we act as a processor for a customer, contact that customer; we forward your request to them.
For API data there is little to retrieve, because we do not store prompts or responses. What exists is the derived cache, which we can delete, and billing records, which we must keep by law.
You can complain to the Autoriteit Persoonsgegevens, the Dutch supervisory authority.
Security
Our technical and organisational measures are described in a separate document, available to customers and prospective customers on request. In short: our own hardware in the Netherlands, key-based administrative access only, and no third party with access to customer data.
We do not hold SOC 2 or ISO 27001 certification. We would rather tell you exactly what we do than point at a certificate.
Automated decisions
We do not make automated decisions about you. Our service generates output on our customers' instructions. Model output can be wrong and is not advice. Decisions based on it are made by our customer, not by us.
Changes
We update this page when the service changes and note the date at the top. For material changes affecting customers we give notice under the applicable agreement. The Dutch version of this policy prevails; this English version is a translation.