Privacy policy
Last updated: 13 October 2026
Controller
Adarve, a personal project operated from Spain. Privacy contact: privacy@adarve.dev.
What data we process
Waitlist: email, plan of interest, profile, optional note, language, and the consent and confirmation dates. Free API key: email, the SHA-256 hash of your key (never the key) and monthly usage counters. Enterprise console: email, name, an argon2id password hash, an encrypted second factor, sessions and your organisation's audit log (actions, time and IP address).
Your prompts
The texts you inspect are not stored in clear text: only their SHA-256 hash, score, category, latencies and the deciding layer. The public playground works the same way.
Encryption of your texts
Everything travels encrypted with TLS 1.3 and a hybrid post-quantum key exchange (X25519MLKEM768); TLS 1.0 and 1.1 are disabled. The texts you inspect are not stored: the audit trail keeps only their SHA-256 fingerprint. If an organisation turns on retention of flagged texts for human review, they are stored encrypted with AES-256-GCM under that organisation's own key, deleted automatically when they expire (1 to 90 days), and every read is recorded.
Website analytics
We measure how the site is used with our own analytics, without cookies and without third parties: the page viewed, time on the page, where the visit came from (referring site and utm parameters), the browser, operating system, device type, the browser's language and time zone, and actions such as trying the playground or asking for a key. We do not keep your IP address or any persistent identifier: each visitor is an anonymous code that changes every day and cannot be used to recognise you. Legal basis: legitimate interest in audience measurement (GDPR art. 6.1.f). We keep this data for 13 months. You can switch it off for this browser below.
Legal basis
Waitlist and free API key: your consent (GDPR art. 6.1.a), with double opt-in. Enterprise console: the contract with your organisation (art. 6.1.b). Anonymous analytics and security logs: our legitimate interest in measuring use and protecting the service (art. 6.1.f).
Retention periods
Unconfirmed requests: 14 days. Privacy links: 1 hour. Free account and API key: until you delete them. Anonymous analytics: 13 months. Technical and security logs: 30 days. Encrypted backups: up to 12 months, after which deleted data is gone from them too.
Vendors
Everything runs on our own servers at Hetzner (Germany and Finland), inside the EU: the website, the API, the models, email (our own mail server), analytics and backups. No third-party CDN or proxy sees your texts, and there are no tracking cookies, ads or third-party analytics.
Your rights
You can download or delete your data yourself with the form below (or in the console, under Account → Your data), unsubscribe with the link in any email, or write to us for access, rectification, erasure, restriction, portability or objection. You can also complain to your data protection authority.
Your data
Download a copy of everything we store about your email (API key, usage, waitlist) or delete it for good. We'll send a single-use link, valid for one hour, to confirm the email is yours.
Analytics in this browser
Analytics are anonymous and cookieless. If you'd still rather not be counted, switch them off here; the choice is remembered in this browser only.