Privacy Policy
Last updated: 7 August 2026
This Privacy Policy explains how TalkingMachines OÜ handles personal data in connection with the eterial.ai platform — the Inference API and Eterial Chat (together, the "Services").
TalkingMachines OÜ Registry code 17503863 · VAT EE102985162 Roosikrantsi 8c, Tallinn 10119, Estonia info@eterial.ai
eterial.ai is a product operated by TalkingMachines OÜ. The two are the same legal entity. In this policy, "we" and "us" mean TalkingMachines OÜ.
We have not appointed a Data Protection Officer. We review periodically whether appointing one becomes legally required. Send any data protection question to info@eterial.ai.
1. Two different roles
Our role under the GDPR depends on which Service you use. This distinction matters, because it determines who decides what happens to the data.
Eterial Chat — we are the controller. When you use Chat as an individual, we decide how your account data and your conversations are handled. This policy governs that processing.
Inference API — we are a processor. When a customer sends content through the API, that customer decides what to send and why. They are the controller; we process on their instructions. Our Data Processing Agreement governs that processing and takes precedence over this policy in respect of content submitted through the API. It applies automatically to Inference API customers and is available on request at info@eterial.ai.
We remain the controller of the account, billing, security and usage-metering data of API customers, regardless of the above. Section 3 identifies which category each type of data falls into.
If you are an individual whose personal data was sent to us through a customer's application, we are a processor in respect of that data. Please contact that customer, who is the controller. We will support them in responding to you, but we cannot act on your request directly without their instruction.
2. Where our data is held
The eterial.ai platform — our servers, databases and Chat conversation storage — is hosted with cloud providers within the European Economic Area.
Requests are then routed for processing to third-party Compute Providers, which may be outside the EEA. Section 6 explains this, and Section 7 explains how those transfers are protected.
3. What we collect
3.1 Account data — controller
| Data | Source |
|---|---|
| Email address | You, at sign-up |
| Password (stored only as a salted hash — we never see it) | You, if you register with a password |
| Name and profile picture | Google, if you sign in with Google |
| Account settings and preferences | You |
If you sign in with Google, we receive your email address, name and profile picture from Google. We do not receive your Google password and have no other access to your Google account.
3.2 Billing data — controller
Top-up amounts, currency, transaction identifiers, invoices, VAT status and VAT identification number, country of residence for tax purposes, and payment method type.
We never receive or store your full card number. Card details are entered directly with Stripe. For cryptocurrency top-ups, we receive the transaction identifier and the amount; the wallet address you pay from is visible to our payment processor and on the public blockchain, which is outside our control.
3.3 Usage and metering data — controller
For each request: timestamp, model requested, token counts, the Compute Provider used, latency, error codes, cost charged, and the API key or account involved.
This does not include the content of your requests.
3.4 Content you submit — depends on the Service
Inference API. We do not store the content of prompts or responses sent through the API. Content is held in memory only for as long as needed to route the request and return the result, then discarded. We are a processor for this content.
Eterial Chat. We do store your conversations, so that your chat history is available to you across sessions. Conversations are stored in the EEA, associated with your account, and retained until you delete them or close your account. We are the controller for this content.
3.5 Technical data — controller
IP address, browser and device type, operating system, and server logs of requests to our systems. We use these for security, abuse prevention, fraud detection and diagnosing faults.
Our server logs record metadata only — they do not contain the content of your prompts, responses or conversations.
3.6 Communications — controller
Emails you send us and our replies, including support requests.
3.7 Analytics and cookies — controller
Set out in Section 10.
4. Why we process it, and on what legal basis
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Creating and running your account; providing the Services | Account, content | Performance of a contract — Art. 6(1)(b) |
| Metering usage, drawing down your balance, taking payment | Billing, usage | Performance of a contract — Art. 6(1)(b) |
| Issuing invoices and keeping accounting records | Billing | Legal obligation — Art. 6(1)(c) |
| Determining and reporting VAT | Billing, country | Legal obligation — Art. 6(1)(c) |
| Service emails: credit expiry reminders, security notices, changes to terms | Account | Performance of a contract — Art. 6(1)(b) |
| Security, abuse prevention, fraud detection, enforcing our terms | Technical, usage, account | Legitimate interests — Art. 6(1)(f) |
| Diagnosing faults and maintaining reliability | Technical, usage | Legitimate interests — Art. 6(1)(f) |
| Establishing, exercising or defending legal claims | All categories | Legitimate interests — Art. 6(1)(f) |
| Sanctions screening, and checks required of us by a payment provider | Account, billing | Legitimate interests in preventing unlawful use — Art. 6(1)(f); and legal obligation — Art. 6(1)(c) — where one applies to us |
| Analytics | Cookies, technical | Consent — Art. 6(1)(a). Where consent is declined, the identifier-free page count described in Section 10 rests on legitimate interests — Art. 6(1)(f) |
| Marketing emails, if we send them | Email address | Consent — Art. 6(1)(a) |
Where we rely on legitimate interests, we have weighed those interests against your rights. In each case above, the processing is limited to what is needed to keep the platform running, secure and billed correctly. You may object to processing based on legitimate interests — see Section 9.
We do not use your prompts, responses or conversations to train models. We do not sell personal data. We do not share personal data with third parties for their own marketing.
5. Redaction before routing
Before a request leaves our systems for a Compute Provider, we run automated redaction that attempts to detect certain categories of sensitive data and replace them with placeholders.
This is a risk-reduction measure, not a guarantee. It is automated and best-effort. It will not detect everything, it does not anonymise your request, and redacted content remains personal data. You should not send us data whose exposure you could not tolerate.
6. Who we share data with
We share personal data only with the following categories of recipient, each acting under contract:
Compute Providers. Third parties whose computing capacity serves your requests, including a decentralised compute network and a routing intermediary. Whatever remains in a request after redaction is visible to the provider serving it. We select providers on the basis of their published data policies and configure our integrations to disable prompt logging and training where that option is available to us. We cannot audit their internal practices and do not warrant their compliance with their own policies.
Cloud hosting providers. Who host our platform, database and Chat conversation storage in the EEA.
Payment processors. Stripe for card and bank payments; NOWPayments for cryptocurrency. They receive the data needed to take payment and to meet their own legal obligations.
Email delivery provider. For account, billing and security emails.
Analytics provider. See Section 10.
Professional advisers — accountants, auditors and lawyers — bound by confidentiality.
Authorities, where we are legally required to disclose, or where disclosure is necessary to establish, exercise or defend legal claims.
An acquirer, if we are ever party to a merger, acquisition or sale of assets. We would notify you before your data became subject to a different privacy policy.
We maintain a current list of the specific sub-processors we engage. Business customers using the Inference API can request it at info@eterial.ai, and are notified of changes as set out in our Data Processing Agreement.
7. Transfers outside the EEA
Our own platform and your Chat conversations stay in the EEA. However, requests are routed to Compute Providers that may be located anywhere, and our payment and email providers may process data outside the EEA.
Where personal data leaves the EEA, we rely on one of the following:
- an adequacy decision of the European Commission covering the destination country or the recipient's certification; or
- the European Commission's Standard Contractual Clauses, together with an assessment of the laws of the destination country and additional measures where needed.
You can ask us for details of the safeguards applying to a specific transfer by writing to info@eterial.ai.
Be aware: a decentralised compute network is, by design, operated by independent participants in multiple jurisdictions. We flow contractual obligations down to the network operator, but the legal protection available in a given jurisdiction may be weaker than under EU law. This is a material consideration if you intend to send personal data through the Services, and it is why redaction exists and why you should not send data you cannot afford to expose.
8. How long we keep data
| Data | Retention |
|---|---|
| API prompt and response content | Not stored |
| Chat conversations | Until you delete them or close your account |
| Account data | For as long as your account is open, then 90 days after closure — so that the account can be restored if it was closed in error or in dispute, and to prevent immediate re-registration by a suspended user |
| Usage and metering records | 12 months |
| Invoices and accounting records | 7 years from the end of the financial year, as required by the Estonian Accounting Act |
| Security and server logs | 90 days |
| Website analytics events | 14 months in Google Analytics |
| Support correspondence | 24 months |
| Records needed for a legal claim | Until the claim and any limitation period end |
After these periods we delete the data or irreversibly anonymise it so it can no longer be linked to you.
9. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you, and receive a copy;
- rectify data that is inaccurate or incomplete;
- erase your data, where one of the grounds in Article 17 applies;
- restrict processing in the circumstances set out in Article 18;
- object to processing based on legitimate interests, and to direct marketing at any time;
- portability — receive data you provided to us in a structured, machine-readable format, and have it transmitted to another controller where technically feasible;
- withdraw consent at any time, where we rely on consent. This does not affect processing carried out before withdrawal.
In Chat, you can delete individual conversations and close your account from your account settings at any time. For anything else, write to info@eterial.ai.
We will respond within one month. That period may be extended by two further months for complex requests, in which case we will tell you within the first month. We may ask you to confirm your identity before acting, and we do not charge for responding unless a request is manifestly unfounded or excessive.
Complaints. If you think we have handled your data unlawfully, please raise it with us first — we would rather fix it. You also have the right to complain to a supervisory authority, in the EU Member State of your residence, place of work or the alleged infringement. Ours is:
Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate) Tatari 39, Tallinn 10134, Estonia info@aki.ee · +372 6828 712 · aki.ee
10. Cookies and analytics
We use cookies and similar technologies — including your browser's local storage — on our website and in the Services.
Strictly necessary storage keeps you signed in, secures your session, protects against cross-site request forgery, and remembers the answer you give to the cookie banner. It is required for the Services to work and is set without consent, as permitted by law. You cannot switch it off. The record of your cookie choice is held in local storage rather than in a cookie, and is written whichever way you answer — it is the only way we can stop asking you.
Analytics cookies help us understand how the site is used — which pages are visited, how people move through them, and where things break. They are set by our analytics provider only if you consent.
When you first visit, you will be shown a banner. Nothing beyond strictly necessary storage is set unless you accept. Declining is offered on the same screen and in the same form as accepting, and you can change your choice at any time from the Cookie settings link in the site footer. Withdrawing consent does not affect processing already carried out. If you decline we ask again no sooner than six months later; if you agree, we ask again after thirteen months, so that consent does not stand indefinitely.
If you decline. No analytics cookies are set, and no identifier for you is created or stored. The page still reports to our analytics provider, in a request that carries no identifier, that a page of this site was viewed; your IP address is visible to the provider in the course of making that request. Reports of this kind can be counted but never joined to one another or to you, and for them we rely on our legitimate interest in knowing how many people reach the site — Art. 6(1)(f). If you would rather nothing were sent at all, a content or tracker blocker will stop it.
What we measure. Which sections of a page were reached, which navigation links were used, and — for the chat demonstration on the front page — that a message was sent, how long the answer took, what it cost, and whether it failed. We do not send what you type into the chat demonstration, or the text of the answer, to our analytics provider. What we send about an exchange is its shape, together with the identifier of the request in our own systems.
Our analytics provider is Google, through Google Analytics. We have not enabled Google Signals, advertising features or cross-device tracking, and we share nothing with advertisers. Analytics data may be processed outside the EEA; Section 7 explains the safeguards. The specific cookies we set, their purpose and their duration are listed in the cookie settings panel.
11. Automated decision-making
We do not make decisions producing legal or similarly significant effects about you by automated means alone, within the meaning of Article 22 of the GDPR.
Note that outputs generated by AI models through the Services are not decisions we make about you. Where a customer uses our API to build a system that does make such decisions, that customer is responsible for its own compliance, including any obligation to provide human review.
12. Security
We protect personal data with measures appropriate to the risk, including encryption in transit, encryption at rest for stored conversations, hashed passwords, access control on the principle of least privilege, network isolation, logging and monitoring, and a formal process for handling security incidents.
No system is perfectly secure.
Where we are the controller and a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Estonian Data Protection Inspectorate within 72 hours of becoming aware of it, and will tell you directly where the law requires.
Where we are a processor — that is, for content submitted through the API — we will notify the customer who is the controller without undue delay after becoming aware of a breach, and it is for that controller to notify its supervisory authority and the individuals concerned.
13. Children
The Services are for people aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, write to info@eterial.ai and we will delete it.
14. Changes to this policy
We may update this policy. The current version is always published at eterial.ai/privacy with the date at the top.
Where a change materially affects how we handle your personal data, we will notify you by email at least 30 days before it takes effect. Where a change requires your consent, we will ask for it before making the change.
15. Contact
Write to info@eterial.ai for any question about this policy or about your personal data, or by post to TalkingMachines OÜ, Roosikrantsi 8c, Tallinn 10119, Estonia.