Privacy Policy

Klaver Solutions is the controller for the personal data described in this policy, except for the content you send through the API on behalf of others, where we act as your processor under the Data Processing Agreement. You can reach us about privacy at [email protected], or at Klaver Solutions, Blaasbalg 14, 8253 LX Dronten, Flevoland, Netherlands.

This policy covers personal data we handle as a controller when you visit the website, create an account, top up a balance, and use the API, the hosted chat, and the coding command line agent. The General Data Protection Regulation and its Dutch implementation, the Algemene verordening gegevensbescherming, apply.

We collect the following categories of personal data, for the purposes and on the lawful bases shown.

We do not ask you to provide special categories of personal data, and you should not send them in prompts unless you have a lawful basis to do so.

When you make a request, the content of that request is sent to the upstream provider that owns the model you chose, so that the provider can generate a response. Today that means OpenAI for the GPT and Codex families, Anthropic for the Claude, Opus, and Fable families, and Google for the Gemini family. The provider processes that content under its own terms and its own privacy and data handling commitments.

We store the metering record of each call, which is the model, token counts, cost, status, and time, but not the body of a stateless API request once the response has been returned.

If you use the hosted chat with memory, your conversation threads, their rolling summaries, and the facts you choose to remember are stored on the server for your account so the conversation can continue. You can delete a single conversation, delete a single remembered fact, or wipe all remembered facts from the product at any time. Remembered facts are deliberately kept when you delete a conversation, so deleting a conversation does not delete a fact you asked us to remember.

The legacy browser chat keeps its history in your own browser and is not stored on our server, except as the ordinary inference requests it sends.

We do not sell your personal data. We share it only with the service providers that help us run Chernion, acting on our instructions, and where the law requires it. These recipients are listed and kept current on the Sub processor list at the slug /subprocessors, and they fall into these groups:

• The upstream model providers, which receive the content of your requests to the models you select.
• Our payment service provider for card and wallet payments, and our crypto checkout provider, which receive the billing details and amounts needed to take payment and issue invoices.
• Google and GitHub, where you choose to sign in with them, which confirm your identity.
• Our hosting and infrastructure provider, and our transactional email provider, which run the service and deliver verification, sign in, and invoice emails.

We may also disclose data to comply with the law, to respond to a lawful request from a competent authority, to enforce our terms, or to protect the rights, safety, and security of our customers, the public, or us.

Some of our providers, including the upstream model providers and some infrastructure, are located outside the European Economic Area, in particular in the United States. Where personal data is transferred outside the European Economic Area, we rely on a lawful transfer mechanism, such as an adequacy decision of the European Commission, or the European Commission's standard contractual clauses together with any extra safeguards that are needed. You can ask us for more detail about the safeguards that apply.

We keep personal data only as long as we need it for the purposes above, then delete or anonymise it.

Under the General Data Protection Regulation you have the right to access your personal data, to have it corrected, to have it erased, to restrict or object to processing, to data portability, and, where we rely on consent, to withdraw that consent at any time without affecting earlier processing.

You can exercise many of these directly in the product, for example by editing your account, deleting conversations, and managing or wiping remembered facts. For anything else, write to [email protected]. We may need to verify your identity before we act, and we will respond within the period the law allows, normally within one month.

Some data we must keep even if you ask us to erase it, for example billing records we are required to retain for tax law. Where that applies, we will explain it.

If you think we have not handled your personal data properly, please tell us first so we can put it right. You also have the right to complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the supervisory authority in your country of residence.

The service is for people aged eighteen and over. We do not knowingly collect personal data from children. If we learn that we have, we will delete it.

We take appropriate technical and organisational measures to protect personal data, such as encryption in transit, storing passwords only as hashes, optional two factor authentication, access controls, and rate limiting. No service can be completely secure, so we cannot guarantee absolute security, but we work to protect your data and to meet our breach notification duties.

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. The model output you receive is generated at your request and is for you to evaluate and use; it is not a decision we make about you.

We may update this policy. If a change is material, we will give reasonable notice through the product or by email. The date at the top shows when it was last updated.

For any privacy question, write to [email protected], or to Klaver Solutions, Blaasbalg 14, 8253 LX Dronten, Flevoland, Netherlands.