# Privacy Policy Source: https://docs.serenityedge.ai/terms/privacy-policy/ > **Document control** > > | Field | Value | > | --- | --- | > | Version | 1.1 | > | Effective date | 17 October 2026 | > | Last revised | 17 October 2026 | > | Approved by | Substrate Artificial Inteligence, S.A. | > | Contracting entity | Substrate Artificial Inteligence, S.A. | > > The full version history is available in the [Legal document changelog](https://docs.serenityedge.ai/terms/changelog/). ### Overview At Substrate AI, we are committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy is designed to help you understand how we collect and process your personal data when you use Serenity Edge and the website `docs.serenityedge.ai`. Serenity Edge is designed so that we hold as little personal data as possible. The prompts you send and the completions you receive are processed in memory and are never written to disk or logs; prompt prefixes may be kept in a volatile memory cache for at most 24 hours to speed up repeated requests, after which they are automatically evicted. What we keep is limited to the technical metadata of each request, the details of the people who contact us or sign a contract with us, and the security logs of the website. ### Scope This Privacy Policy does not apply where Substrate AI processes personal data on behalf of a Commercial Customer as a Data Processor, that is, where personal data is contained in the Inputs a Customer sends to the API or in the Outputs it receives. In such cases, the [Data Processing Agreement](https://docs.serenityedge.ai/terms/data-processing-agreement/) governs the processing of personal data by Substrate AI in its role as a Data Processor. Where you access Serenity Edge through a Platform, as defined in section 1, this Privacy Policy applies from the moment the Platform forwards your request to us. The Platform's own privacy policy applies to your account with it and to the leg between you and the Platform. Where you access Serenity Edge with a Serenity Star account, the Serenity Star privacy policy applies to the account, the API keys and the credits, which are operated by Subgen AI Spain, S.L., as explained in section 6. ## 1\. Definitions The capitalised terms in this document have the meanings below: - **Agreement**: the service agreement between You and Substrate AI, which includes (i) the [Terms of Service](https://docs.serenityedge.ai/terms/terms-of-service/), (ii) the [Acceptable Use Policy](https://docs.serenityedge.ai/terms/acceptable-use/), (iii) any applicable Additional Terms and, where relevant, (iv) the Data Processing Agreement and (v) an Enterprise Agreement. - **Data Controller**: the entity responsible for decisions regarding Your Personal Data, such as what data to collect, how it is processed and how long it is retained. - **Data Processor**: the entity processing Personal Data on behalf of the Data Controller under its instructions. - **Inputs** and **Outputs**: respectively, the data You submit to the API to prompt a Model, and the content the Services generate in response, as defined in the Terms of Service. - **Personal Data**: any data that directly or indirectly relates to an identified or identifiable natural person. - **Platform**: a third-party router, gateway or marketplace, such as OpenRouter, cortecs or EUrouter, through which You may access the Services, as defined in the Terms of Service. The Platforms on which the Services are available, and those on which their onboarding is in progress, are listed at [https://docs.serenityedge.ai/docs/access/channels](https://docs.serenityedge.ai/docs/access/channels/). - **Processing**: any operation performed on Personal Data (for example, collection, use, transfer or deletion). - **Request Metadata**: the technical information recorded about each API request, limited to timestamps, token counts, the Model requested, latency, status codes and the identifier of the API key used. It never includes the content of Inputs or Outputs. - **Serenity Star**: the platform operated by Subgen AI Spain, S.L., a group company of Substrate AI, through which You may obtain API keys and credits for the Services. - **Services**: Serenity Edge, that is, the API available at `https://api.serenityedge.ai/v1`, the Models it serves and the documentation published at `docs.serenityedge.ai`. - **Website**: the documentation website available at [https://docs.serenityedge.ai](https://docs.serenityedge.ai/). - **You** or the **Customer**: any individual or entity accessing or contracting the Services or visiting the Website, referred to in this Policy as "You", "Your" or "Yours". ## 2\. Who is the Data Controller? **2.1. Substrate AI as Data Controller** Substrate Artificial Inteligence, S.A., a company incorporated under the laws of Spain, with Spanish tax identification number (NIF) A98306228, registered with the Commercial Registry of Toledo under Section 8, Sheet TO-48960, with its registered office at Avenida Real Fábrica de Sedas 28, 45600 Talavera de la Reina (Toledo), Spain ("**Substrate AI**", "**We**", "**Us**" or "**Our**"), is the Data Controller when processing Your Personal Data in connection with Serenity Edge and the Website. You can contact us: - By email: [contact@substrate.ai](mailto:contact@substrate.ai) - By post: Substrate Artificial Inteligence, S.A., Attn: Privacy, Avenida Real Fábrica de Sedas 28, 45600 Talavera de la Reina (Toledo), Spain **2.2. Data Protection Officer** Substrate AI has not designated a Data Protection Officer. Requests relating to Personal Data, including the exercise of the rights described in section 9, are handled through the contact details above. This section will be updated if one is appointed. **2.3. Substrate AI as Data Processor** If You are a Commercial Customer, Substrate AI processes on Your behalf, as a Data Processor, any Personal Data contained in Your Inputs and Outputs. Those activities are described in the [Data Processing Agreement](https://docs.serenityedge.ai/terms/data-processing-agreement/). This Privacy Policy only covers Substrate AI's Processing activities as a Data Controller. ## 3\. What kind of Personal Data do we collect? **3.1. Personal Data We collect directly from You** - **Identity and contact data**: Your name, email address, organisation, job title and the content of Your message when You write to Us, request enterprise access, report abuse or exercise Your rights. - **Contract and billing data**: where You sign an Enterprise Agreement, the details of the signatories and of the billing contacts, the invoicing details of Your organisation and the payment records. Where You purchase credits through a Serenity Star account, the billing data is collected by Serenity Star, not by Us (see section 6). **3.2. Personal Data generated by Your use of the Services** - **Request Metadata**: for each request sent to the API, the timestamp, the number of input, cached and output tokens, the Model requested, the latency, the HTTP status code and the identifier of the API key used. Request Metadata does not contain the content of the Input or the Output. The API key identifier allows Us to attribute a request to an account or an organisation for billing and security purposes. - **Security and network data**: the IP address, request headers and timing of the connections that reach Our edge network, recorded by Our edge and security provider for the purpose of protecting the API and the Website against attacks. **3.3. Personal Data generated by Your use of the Website** - **Server and security logs**: the IP address, user agent, pages requested and timing of Your visits, recorded by Our edge and security provider. - **Aggregated analytics**: the Website uses a cookieless analytics service that reports aggregated page views and referrers without identifying individual visitors. The [Cookie Policy](https://docs.serenityedge.ai/terms/cookie-policy/) describes the technologies used on the Website. **3.4. Personal Data We receive from Serenity Star** Where You access the Services with a Serenity Star account, Serenity Star authenticates Your requests and meters Your usage against Your credits. For that purpose, We receive from Serenity Star the identifier of Your API key and the status of Your credit balance, and We send to Serenity Star the token counts of Your requests. We do not receive Your account password, Your payment details or Your identity data, unless You write to Us directly. **3.5. Inputs and Outputs** We do not collect Inputs or Outputs as Data Controller. Inputs and Outputs are processed in memory and are never written to disk or logs, on Our behalf where You are a Consumer and on Your behalf where You are a Commercial Customer. To speed up repeated requests, prompt prefixes may be kept in volatile memory (a cache) for at most 24 hours, after which they are automatically evicted. Cached content is never used for training and is not accessible to staff. Where You are a Consumer and Your Inputs contain Personal Data relating to You or to others, that Personal Data is processed for the sole purpose of generating the Output and, beyond that cache, is discarded when the response is complete. ## 4\. Why do We use Your Personal Data? We use Your Personal Data for the following purposes and on the following legal bases: - **To provide the Services** (Article 6(1)(b) GDPR, performance of a contract): to authenticate Your requests, generate Outputs, apply rate limits, meter Your usage and answer Your support requests. - **To bill the Services** (Article 6(1)(b) and 6(1)(c) GDPR): to calculate the Fees from the Request Metadata, to reconcile usage with Serenity Star or with a Platform, to issue invoices under an Enterprise Agreement and to keep the accounting and tax records that the law requires. - **To secure the Services and prevent abuse** (Article 6(1)(f) GDPR, Our legitimate interest in protecting the Services, Our customers and third parties): to detect and block attacks, abusive traffic and breaches of the [Acceptable Use Policy](https://docs.serenityedge.ai/terms/acceptable-use/), and to investigate reports of abuse. - **To plan capacity and improve the Services** (Article 6(1)(f) GDPR): to analyse aggregated Request Metadata in order to size Our infrastructure and improve the performance of the Services. Service improvement never includes training, fine-tuning or evaluating any Model with Your Inputs or Outputs. - **To communicate with You** (Article 6(1)(b) and 6(1)(f) GDPR): to send You notices about the Services, such as changes to the Models, the prices or these documents, and to answer Your messages. - **To send commercial communications** (Article 21 of the Spanish Law 34/2002 on Information Society Services and Electronic Commerce): only where You have asked to receive them or where We may lawfully send them to an existing customer about similar services, and always with the possibility to opt out in each message or by writing to Us. - **To comply with legal obligations and manage disputes** (Article 6(1)(c) and 6(1)(f) GDPR): to comply with requests from competent authorities, to keep the records that the law requires and to establish, exercise or defend legal claims. We do not take decisions based solely on automated processing that produce legal effects concerning You or similarly significantly affect You. Automatic rate limiting and abuse detection are technical measures that block requests; they do not evaluate You as a person. ## 5\. How long do We store Your Personal Data? We retain Personal Data for as long as necessary to achieve the purposes outlined in this Privacy Policy, and then delete or anonymise it: - **Inputs and Outputs**: never written to disk or logs. They exist in memory while the request is processed; prompt prefixes may remain in a volatile memory cache for at most 24 hours, after which they are automatically evicted. - **Request Metadata**: 90 days from the request, after which it is deleted. Aggregated statistics that no longer identify any API key may be kept for capacity planning. - **Security and network logs**: for the limited period needed to detect and investigate attacks on the API and the Website, after which they are deleted or anonymised. - **Contact data and correspondence**: for as long as needed to answer Your request and, thereafter, for the limitation period of the claims that may arise from it. - **Contract and billing data**: for the term of the contract and, thereafter, for the periods required by Spanish commercial, accounting and tax legislation, during which the data is blocked and accessible only to the competent authorities, as provided by Article 32 of the LOPDGDD. ## 6\. Who do We share Your Personal Data with? We share Personal Data only with: - **Authorised team members** of Substrate AI, on a need-to-know basis and under confidentiality obligations. - **Subgen AI Spain, S.L.**, Our group company, which (i) operates the facility in Valencia, Spain, where inference runs, on Our behalf, and (ii) operates Serenity Star, which handles account creation, authentication, API key management, credits and billing for Serenity Star account traffic. For the first activity, Subgen AI acts as Our Data Processor under an intra-group data processing agreement (in preparation). For the second, Subgen AI acts as Data Controller of the account and billing data under the Serenity Star privacy policy, and We exchange with it only the data described in section 3.4. - **Third-party service providers** under strict contractual obligations, listed on the [Sub-processors](https://docs.serenityedge.ai/terms/sub-processors/) page, which states, for each of them, the service it provides, the categories of Personal Data it processes, the region in which it processes them and the basis for any international transfer. That page is the up-to-date list and is maintained as providers change. - **Platforms**, where You access the Services through one of them. A Platform is not a provider engaged by Us; it is an independent router, gateway or marketplace with which You have contracted. We receive Your requests from the Platform and return the Outputs to it, and We exchange with the Platform only the information needed to route and settle those requests. - **Regulatory authorities, courts or legal bodies**, where required by law or necessary to establish, exercise or defend legal claims. We do not sell Personal Data and We do not share it with advertising networks or data brokers. ## 7\. Do We transfer Your Personal Data outside the EU? No. Inference runs on Substrate AI's own GPU infrastructure in Valencia, Spain. API request handling, the storage of secrets and the operational logs run in Microsoft Azure in the Spain Central region. Authentication and billing for Serenity Star account traffic are processed by Serenity Star in the European Union, in Microsoft Azure in the France Central region. Our edge and security provider handles traffic from the European Union in its European Union data centres. Where a provider listed on the [Sub-processors](https://docs.serenityedge.ai/terms/sub-processors/) page is established outside the European Economic Area, that page states the safeguard under which any access to Personal Data from outside the European Economic Area would take place, such as the Standard Contractual Clauses adopted by the European Commission. Where You are a Commercial Customer, clause 7 of the [Data Processing Agreement](https://docs.serenityedge.ai/terms/data-processing-agreement/) governs these matters. Where You access the Services through a Platform, the Platform processes Your request before forwarding it to Us, under its own terms and in the locations it discloses. That leg is outside Our control. ## 8\. How do We protect Your Personal Data? We apply technical and organisational measures appropriate to the risk of the Processing, including: - Encryption in transit with TLS 1.2 or higher for every connection to the API and the Website. - Access control to the systems that process Personal Data, restricted to authorised personnel and based on the principle of least privilege. - Storage of secrets and credentials in a managed key vault. - Network isolation of the inference path from the public internet. - Logging that never contains Inputs or Outputs. - Notification of Personal Data breaches to the competent supervisory authority within 72 hours where the GDPR requires it, and to the affected persons where the breach is likely to result in a high risk to their rights and freedoms. The [Data Processing Agreement](https://docs.serenityedge.ai/terms/data-processing-agreement/) describes these measures in more detail for Commercial Customers. ## 9\. Your rights You have the right to: - **Access** the Personal Data We hold about You and obtain a copy. - **Rectify** inaccurate or incomplete Personal Data. - **Erase** Your Personal Data, where there is no lawful reason for Us to keep it. - **Restrict** the Processing of Your Personal Data in the cases provided by the GDPR. - **Object** to Processing based on Our legitimate interest, and to commercial communications at any time. - **Data portability**, that is, to receive the Personal Data You have provided to Us in a structured, commonly used and machine-readable format. - **Withdraw consent** at any time, where the Processing is based on consent, without affecting the lawfulness of the Processing carried out before the withdrawal. To exercise these rights, write to [contact@substrate.ai](mailto:contact@substrate.ai) or to the postal address in section 2, stating the right You wish to exercise. We may ask You to confirm Your identity before acting on a request. We will answer within one month of receiving Your request, which may be extended by two further months where the request is complex, in which case We will inform You. Because Inputs and Outputs are never written to disk or logs, We cannot retrieve, correct or export the content of past requests; beyond the volatile cache, which is not accessible to staff and is automatically evicted within 24 hours, that content no longer exists once the response has been returned. Where Your Personal Data is held by Serenity Star (account, API keys, credits and billing) or by a Platform, You should address Your request to them; We will forward to Serenity Star any request that concerns data it holds. You also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of Your habitual residence, place of work or place of the alleged infringement. In Spain, the supervisory authority is the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), C/ Jorge Juan 6, 28001 Madrid, [https://www.aepd.es](https://www.aepd.es/). We would appreciate the chance to address Your concerns before You approach the AEPD, but You are not obliged to contact Us first. ## 10\. Children The Services are intended for organisations and for adults. We do not knowingly collect Personal Data from children under fourteen (14) years of age, the age from which a minor may consent to the Processing of Personal Data under Article 7 of the LOPDGDD. If You believe that a child has provided Us with Personal Data, write to Us and We will delete it. ## 11\. Changes to this Privacy Policy This Privacy Policy may evolve to reflect changes in Our Services, in Our providers or in the applicable regulations. We will publish each new version on the Website with an updated version number and revision date, record the change in the [Legal document changelog](https://docs.serenityedge.ai/terms/changelog/) and, where the change substantially affects the way We process Your Personal Data and We hold an email address for You, notify You by email before it takes effect. Please review this Privacy Policy regularly. For questions, contact Us at [contact@substrate.ai](mailto:contact@substrate.ai).