privacy policy

Last updated: 23 September 2026

overview

ozeye is an EU AI inference gateway with a chat interface, browser notebooks and mobile apps. This policy explains what personal data we collect, why, how long we keep it, who else receives it, and your rights under the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Dutch Uitvoeringswet AVG.

The short version: ozeye never stores the content of your AI requests or the responses. We keep the metadata needed to bill you and run the service, for the periods listed below.

who is responsible

The controller for the processing described here is ozeye, a Dutch sole proprietorship (eenmanszaak) established in Arnhem, the Netherlands, owned and operated by Mack Jupiter Maier. Contact: privacy@ozeye.ai.

Trader identification (BW 3:15d / Handelsregisterwet art. 27/29): trade name ozeye, sole proprietorship (eenmanszaak), proprietor Mack Jupiter Maier, address Bothaplein 1, 6814 AJ Arnhem, the Netherlands, KVK 42115615, VAT NL005505927B53.

When a business customer uses ozeye to process personal data of its own users, that business is the controller for that data and ozeye acts as its processor under a data processing agreement.

what ozeye never stores

ozeye does not write the content of your requests or of the responses to its database, its logs or its backups. This covers prompts, chat messages, completions, embedding input, audio, generated images, web search queries and fetched pages. Our records hold metadata only: time, model, provider, token counts and cost.

This is enforced in code: request handlers only persist metadata, audit metadata is filtered, and a log handler redacts any field named like content (content, prompt, message, body, completion, text, query) from every log line.

Three things are held briefly in server memory, never on disk:

a request and its response while the request is in flight, so it can be passed to the provider and back to you;
streamed chat responses in the ozeye web app, buffered while the stream runs and for 2 minutes after, capped at 4 MB, so a dropped connection can resume without billing you again. API requests are not buffered;
app documents returned by an MCP server you connected yourself, held for up to 30 minutes so your browser can display them.

Content you deliberately save in the product is stored until you delete it: notebook files you save (browser notebooks save their source code to ozeye) and presets (which can include a system prompt). Your chat history and documents are stored in your own browser or app, not on our servers.

The AI provider that serves a request does process its content. What each provider keeps is described on the subprocessors page.

data we collect and how long we keep it

Data	Purpose	Legal basis	Retention
Email address (or an anonymous account number instead), optional name, password hash (bcrypt)	Account, login, service emails	Contract (art. 6(1)(b))	Until account deletion
Login sessions (with the browser user agent)	Keeping you logged in, security	Contract (art. 6(1)(b))	Expire after 30 days and are then cleaned up
API keys (stored as SHA-256 hash and prefix), key names and limits	API authentication, spend limits	Contract (art. 6(1)(b))	While active; revoked keys 12 months after revocation
Usage metadata per request: time, model, provider, token counts, cost (never content)	Billing, your usage dashboard and exports, fraud prevention	Contract (art. 6(1)(b)); legal obligation (art. 6(1)(c)) for the totals	Detailed for 24 months, then reduced to monthly totals per account and model, which are kept at least 7 years as accounting records
Audit log: account actions (key created or revoked, top-ups, settings changes, app sign-ins) and request events (model, token counts); no IP addresses	Security, support, dispute handling	Legitimate interest (art. 6(1)(f))	12 months
Failed usage records awaiting retry	Making sure every request is billed correctly	Contract (art. 6(1)(b))	90 days
Payments, invoices and billing profile: amounts, VAT, customer type, country, payment instrument country, and for businesses name, address, VAT number and the VIES check result	Top-ups, invoicing, VAT evidence	Legal obligation (art. 6(1)(c), Dutch tax law)	at least 7 years (AWR art. 52)
Saved notebook files and presets	Providing the feature you use	Contract (art. 6(1)(b))	Notebook files until you delete them or your account; presets until account deletion
Provider blocklist (providers you excluded)	Routing according to your preference	Contract (art. 6(1)(b))	Until account deletion
Product-update email consent and unsubscribe records	Sending optional emails, proving consent	Consent (art. 6(1)(a)); legal obligation to demonstrate it (art. 7(1))	Consent until withdrawn; an unsubscribe record is kept so we never email you again
IP address	Rate limiting and abuse protection	Legitimate interest (art. 6(1)(f))	Not stored. Held in memory by the rate limiter for up to a few minutes

Server logs record request id, method, path, status and duration, never request bodies, prompts or outputs, and are rotated by size. Database backups are kept for 30 days (see security below), so deleted data disappears from backups within 30 days.

payments

Card, iDEAL and Bancontact payments are handled by Mollie B.V. (Amsterdam). You enter your payment details on Mollie’s page; ozeye never sees card or bank account numbers. From Mollie we receive and store the payment id, status, method, amount and the country of the payment instrument (card issuer or bank account country), which we keep as evidence of your location for VAT. Together with your billing profile and the invoice this is kept for 7 years.

Monero top-ups run on payment software we host ourselves; no payment company is involved. We store the one-time payment address, the XMR amount, the exchange rate used and the transaction hashes, next to the invoice. We do not geolocate IP addresses for VAT.

When a business enters a VAT number, we check it with the European Commission’s VIES service and store the result and its request identifier.

who receives your data

AI requests are sent to the provider that serves the chosen model. All inference providers are EU companies processing in the EU:

Mistral AI - France
Scaleway - France
OVHcloud - France
Inceptron - Sweden
TensorX - Ireland

You can exclude providers in your dashboard settings; excluded providers never receive your requests, including as a fallback. Other subprocessors: Hetzner Online GmbH (server hosting, Germany), Linkup SAS (hosted web search, France, only when you enable it), Scaleway (transactional email, France), Mollie B.V. (payments, Netherlands) and an EU object storage provider holding our encrypted offsite backups. The full list with what each receives is on the subprocessors page.

Some features make requests to third parties that are not our processors, because you asked for them:

Page fetch tool - when you or the model use the fetch tool, ozeye’s server requests the web page at that URL. The website sees our server, not you.
MCP servers you add - requests from your browser to an MCP server you configured are relayed by ozeye’s proxy (cookies and your IP address are not passed on). To show the server’s icon, its domain name is sent to Google’s favicon service, through our proxy when available.
Browser notebooks - the notebook runtime and Python packages are downloaded by your browser from cdn.jsdelivr.net, wasm.marimo.app and PyPI (pypi.org, files.pythonhosted.org). These services see your IP address like any website you visit. Your notebook code and data are not sent to them.

international transfers

ozeye and all its subprocessors store and process your data in the EU. We do not transfer personal data to countries outside the EU/EEA. The third-party services named above (Google favicons, the notebook package hosts, and any website or MCP server you choose) may operate outside the EU; they only receive what is described above, because you use that feature.

mobile apps

The ozeye apps for Android and iOS use the same service and this policy applies to them. The app signs in by linking to your account in the browser and receives an ozeye API key, which is stored in the Android Keystore or iOS Keychain on your device. Your chat history stays on the device. The apps contain no analytics, advertising or push-notification SDKs.

cookies and local storage

We use only cookies that are needed for the service to work:

ozeye_session - login session (Ory Kratos), HttpOnly, SameSite=Lax, expires after 30 days
csrf_token_* - protects the login, signup and settings forms against cross-site request forgery
api_key - lets the web app call the ozeye API for you after login, HttpOnly, SameSite=Strict, expires after 30 days, removed on logout and account deletion
sidebar:state - remembers whether the chat sidebar is open, 7 days

The web app stores your conversations, documents and settings in your browser’s local storage (IndexedDB and localStorage). We do not use tracking, analytics, advertising or third-party cookies. Strictly necessary cookies do not need consent under the Dutch Telecommunicatiewet (art. 11.7a); we show a short notice on first visit so you know.

security

HTTPS (TLS) for all traffic to ozeye and from ozeye to providers
Database self-hosted on our own server at Hetzner in Germany, not reachable from the internet
API keys stored as SHA-256 hashes, never in plaintext
Passwords hashed with bcrypt by Ory Kratos
No prompt or output content in databases, logs or backups
Rate limiting and request size limits
Database backups several times a day, encrypted with GPG (AES-256), kept at most 30 days on the server and at an offsite EU object store, with an automatic weekly restore test
Dependency vulnerability scanning (govulncheck) before releases

product-update emails

We send optional product-update emails (new models, features, EU AI compliance notes). Subscription is double opt-in: you request it in your dashboard settings or at signup, and we email a confirmation link; nothing is sent until you click it. Every email carries a one-click unsubscribe link, and unsubscribing is effective immediately.

We keep a record of your consent (when and how it was given, and when you withdrew it) to meet GDPR art. 7. We do not track email opens or clicks; delivery status (delivered or bounced) is the only feedback we process, and it is used only to stop mailing addresses that bounce. Service emails (verification and password recovery codes, and one welcome email at signup) are part of the service and are sent without a subscription.

your rights

Under the GDPR you have the right to:

Access - get a copy of your personal data (art. 15)
Rectification - correct inaccurate data (art. 16)
Erasure - delete your account and data (art. 17). You can do this yourself in the dashboard. Payment records and invoices are kept for the 7-year fiscal period, and usage and audit records are kept for their retention period without the link to your account.
Portability - export your usage data in JSON or CSV via the dashboard or /v1/account/usage/export (art. 20)
Restriction - limit how we process your data (art. 18)
Objection - object to processing based on legitimate interest (art. 21)
Withdraw consent - at any time, for product-update emails, without affecting earlier processing (art. 7(3))
Complaint - lodge a complaint with the Dutch supervisory authority, Autoriteit Persoonsgegevens, or the authority in your own EU country

how to make a request

Email privacy@ozeye.ai and say which right you want to use.
We check that the request comes from the account holder, normally by asking you to confirm from the account’s email address or to sign in to the dashboard. For anonymous accounts we ask for proof of control of the account, such as an API key prefix you can see in the dashboard. We only ask for what is needed to verify you.
We answer within one month of receiving the request. If a request is complex or there are many, we may extend this by up to two further months; we tell you within the first month if we do (art. 12(3)).
Requests are free. We may refuse or charge a reasonable fee only for requests that are manifestly unfounded or excessive, and we explain why.

data breaches

If a personal data breach occurs, ozeye notifies the Autoriteit Persoonsgegevens without undue delay and where feasible within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to your rights and freedoms (GDPR art. 33). If the breach is likely to result in a high risk to you, we also inform you directly without undue delay (art. 34). Business customers under a DPA are notified as set out in that agreement.

data processing agreement

If you use ozeye as a business to process personal data of your own customers or staff, GDPR art. 28 requires a written data processing agreement between your company and ozeye. See the DPA page, or email privacy@ozeye.ai.

minimum age

ozeye is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

changes to this policy

We may update this policy when our practices or legal obligations change. Material changes are announced by email and in the product at least 30 days before they take effect. The date at the top of this page shows the latest revision.

contact

Privacy questions and requests: privacy@ozeye.ai
Security disclosures: security@ozeye.ai (see also security.txt)
General questions: hello@ozeye.ai