Privacy Policy
Effective 11 November 2026
TALDERMONT LIMITED (Taldermont, we or us) explains here how it handles personal data when you visit the website, use the dashboard or API, buy Points, or get in touch. This policy covers the Service described in our Terms of Service. Our Cookie Policy explains how browser storage works.
1 Who handles your data
Taldermont is the Hong Kong data user and, where applicable, the controller for data we use to run the Service, administer accounts and handle payments and enquiries. Our Business Registration Number is 81573444. Our postal and email contacts are at the end of this policy.
When a business sends its end users’ personal data to the API and decides why it is processed, it may be the controller and we may act on its instructions to deliver the Service. The business must provide its own privacy notices and identify a lawful basis. It may request data processing terms from our privacy contact and must put them in place before submitting personal data where required by law.
2 Data we receive or generate
| Information | What it includes | Where it comes from |
|---|---|---|
| Account and settings | Email, authentication details, optional name or profile information, account and key identifiers, key names and spending limits, language and currency preferences, and logging settings. | You, your account settings and our systems. |
| Payments and billing | Transaction references and status, currency, exchange rate, USD-equivalent purchase value, paid and promotional Points, usage and balance, invoices, and refund or withdrawal requests and their submitting IP addresses. | You, our systems and our payment provider. |
| Sign-in and order records | Time, IP address, approximate country and browser information, plus checkout consent records and timestamps. Sign-in records can remain after the session ends. | Generated at sign-in or when you place an order. |
| API and device information | Request status and time, model, input and output usage, listed price, Points charged, key identifier, IP address and relevant browser, device, session and security data. | Our systems record this when you use the Service. |
| Request content | Prompts, files, parameters and the response returned by the model. | You or a caller using your account, and the selected Model Provider. |
| Contact and support | Messages, name, email, topic, supporting material, the contact-form IP address, replies and relevant support records. | You, our contact form and our support records. |
An email address and password are necessary for an account. Payment information is required to buy paid Points. Request metadata is required to operate and bill the API. Without information required for an activity, we may be unable to provide it. Optional profile details, support messages and content logging are voluntary.
Our payment service provider handles card details and may make its own fraud and payment decisions under its privacy notice. We do not request or store your full card number. The provider supplies information needed to administer and verify the payment.
3 Prompts responses and logging controls
We send request content and the information needed to run it to the selected Model Provider and return its output. This happens regardless of your logging settings. We do not use prompts or responses to train models. The Model Provider may process or retain content under its own terms, for example to run the model, monitor abuse or comply with legal duties. Review those terms before submitting sensitive data and only submit another person’s sensitive data when you have a lawful basis and a need to do so.
By default we keep metadata for billing, history, security and support, without storing prompt or response content as request history. If you switch on request logging in the dashboard, we keep content so you can review it. The retention limits below apply. If separate consent is required, we ask for it before enabling the feature. Switching logging off stops new content logs. You can delete saved content in the dashboard. Your settings and deletions do not control records held independently by a Model Provider.
4 Purposes and legal bases
We use account, request and billing data to register and authenticate users, manage keys and preferences, route requests and deliver results, maintain the Points balance and usage history, calculate charges, confirm purchases, handle refunds and withdrawals, issue invoices and provide support. We also use information to notify you about the Service, operate essential website features and honour your privacy choices.
We use order, sign-in, consent, device and request records to secure the Service, detect and investigate fraud or abuse, enforce our Terms and apply sanctions and location restrictions. We derive approximate country from IP addresses. Relevant records may be used to verify payments, respond to disputes and chargebacks, maintain tax and accounting records, comply with legal duties, or establish, exercise or defend legal claims.
Where EU or UK data protection law applies and we act as controller, our legal bases are as follows.
| Purpose | Legal basis |
|---|---|
| Account administration, service delivery, Points purchases and billing, and support you request. | Performance of our contract or steps you request before contracting. |
| Required tax, accounting and regulatory records and lawful requests from authorities. | Compliance with legal obligations. |
| Security, access restrictions, fraud prevention, dispute handling, service administration and claims. | Our legitimate interests in protecting the Service, users and our rights, where those interests are not overridden by your rights. |
| Optional request content logging. | Contract performance where necessary to provide the feature you request. We obtain separate consent before enabling it where required. |
| Optional cookies or direct marketing, if introduced. | Consent where required. You can withdraw consent at any time. |
Automated signals may flag suspicious registration, payment or API use. Our payment provider may independently approve or reject payments. If a check affects your access, contact us. Where the law gives you rights regarding decisions based solely on automated processing, you may exercise them through our privacy contact.
5 Recipients and service providers
- Model Providers receive request content and the technical data necessary to process it. DeepInfra, Inc. in the United States currently runs the available models. We will update this policy before a different Model Provider receives request content.
- Operational providers handle hosting, network delivery and security, authentication, payments, email, deployment or support. They receive the data needed for their work.
- Payment providers and card networks may receive relevant order, checkout consent and sign-in records to verify payments or resolve disputes and chargebacks.
- Lawyers, accountants, auditors and a prospective or actual business successor may receive relevant data subject to appropriate protections. We may disclose information to authorities or others to meet a legal obligation, respond to a valid legal request or protect legal rights.
We do not sell personal data or share it for cross-context behavioural advertising.
6 International processing
Taldermont is based in Hong Kong. Hetzner Online GmbH hosts the main servers, database and email in Finland and our internal deployment and support tools in Germany. Cloudflare, Inc., a US provider, handles website and API traffic for network security and content delivery. DeepInfra, Inc. processes model requests in the United States. The payment provider may process data in other countries under its privacy notice. Customer access restrictions under our Terms are separate from the locations where providers lawfully process data.
Where cross-border transfer rules apply, we use the required safeguards and lawful mechanism, such as an adequacy decision or applicable standard contractual terms where appropriate. Contact us for details of relevant safeguards and how to obtain a copy where available.
7 Retention and deletion
We keep data for its stated purposes, then delete or anonymise it unless a legal duty, unresolved dispute or security matter requires limited retention. The periods below describe our systems. Independent Model Providers and payment providers may apply their own retention rules.
| Record | Retention |
|---|---|
| Active account and settings | Kept while the account is open. On closure we delete the password, sessions and saved request content, and revoke the keys. Once outstanding refunds are resolved we anonymise the name and email in the active account profile. Identity may remain in records we need for billing, fraud prevention or legal purposes. |
| API request metadata | Retained with billing records. We remove the request IP address after 24 months unless a specific documented exception applies. |
| Prompt and response content | With logging off, processed for the request without storing it as history. With logging on, deleted from the live database after 30 days. Copies may remain in routine backups for up to 14 more days. We may preserve limited information for an unresolved legal or security matter where allowed. |
| Sign-in and technical records | Sign-in history, contact form messages, and IP address and browser information from orders, consents, refunds and requests are kept for up to 24 months. Specific records may remain longer for an unresolved security investigation, payment dispute, chargeback or claim. |
| Sessions and confirmation links | Retained until expiry or sign-out as applicable. Expired records are automatically deleted. |
| Support mailbox and look-ups | Support emails are kept for up to 24 months except where needed for an unresolved dispute or claim. Results of internal support look-ups are retained for up to seven days. |
| Database backups | Overwritten within 14 days. |
| Business and accounting records | Where Hong Kong record-keeping law applies, we keep purchase orders, Points transactions, invoices and refund or withdrawal records for at least seven years from the relevant transaction. Longer retention requires a legal duty or an unresolved claim. Payer identity may remain where needed. The shorter limits for IP addresses still apply unless a documented exception applies. |
8 Security and account controls
We use organisational and technical safeguards, including controls on access and protection for data in transit. We review relevant access and security events and investigate incidents. Where law requires notice of a personal data breach, we provide it. Keep credentials confidential and revoke an exposed key promptly. The dashboard lets you manage keys and spending limits, switch request logging on or off, delete saved request content, download account data and close your account.
9 Rights and complaints
Contact us to request access or correction, or to exercise other rights available under applicable law, which may include erasure, restriction, portability, objection and withdrawal of consent. Withdrawal leaves earlier lawful processing unaffected. We may verify your identity and ask for enough information to identify the relevant records. Legal retention duties and other statutory exceptions can affect what we can provide or delete.
In Hong Kong, access and correction requests are generally handled within 40 calendar days under the Personal Data (Privacy) Ordinance, subject to statutory procedures and exceptions. A reasonable, non-excessive fee may apply to a Hong Kong data access request. Where the EU or UK GDPR applies, we normally respond to rights requests within one month, subject to lawful extensions. For complaints covered by UK data protection complaint rules, we acknowledge receipt within 30 days and respond without undue delay.
You may also complain to the Hong Kong Privacy Commissioner for Personal Data, the UK Information Commissioner’s Office, or the competent EU or EEA supervisory authority where applicable.
10 Hong Kong personal information collection statement
Under the Personal Data (Privacy) Ordinance (Cap. 486), the purposes of collection are those in section 4. Information required for account opening, paid Points purchases and API delivery is obligatory for those activities. Section 2 explains what happens if you decline to provide it and what information is voluntary. We may transfer data to the recipient classes in section 5, including recipients outside Hong Kong as explained in section 6. To request access or correction, write to our privacy contact below. We will give the separate notice and obtain any consent required under Hong Kong law before using personal data for direct marketing.
11 Brazil
Where the General Personal Data Protection Law (LGPD) applies, Taldermont is the controller for processing whose purposes and means it decides. Subject to the LGPD, you may request confirmation and access, correction, portability, information about sharing and the effects of withholding consent, and anonymisation, blocking or deletion of unnecessary, excessive or unlawfully processed data. You may withdraw consent, request deletion of data processed on that basis subject to legal exceptions, and request review of a solely automated decision where the LGPD gives you that right. Contact us for details of applicable international-transfer safeguards or to exercise rights. You may petition the Brazilian National Data Protection Authority (ANPD) as provided by law.
12 Japan
Where Japan’s Act on the Protection of Personal Information (APPI) applies, you may request disclosure, correction or supplementation of retained personal data, or request that we stop its use or provision to third parties, or delete it, where the Act permits. Sections 4 to 6 explain uses, recipients and transfers. Before disclosing personal data to a third party overseas where consent is required, we will provide the information the APPI requires and obtain consent, subject to applicable exceptions or other permitted arrangements. You may ask us about the recipient and safeguards before submitting a request to a model.
13 Cookies children and policy changes
Our Cookie Policy explains essential browser storage, optional categories and controls. We ask for consent before using optional technologies that require it. The Service is for people aged 18 and over. If you believe a child opened an account or submitted data, contact us so we can investigate and take any required action.
We publish policy updates with a new effective date and provide further notice before a material change where required by law.
Contact
TALDERMONT LIMITED
Hong Kong Business Registration Number 81573444
Unit 704C, 7/F, Block 3, Nan Fung Industrial City, 18 Tin Hau Road, Tuen Mun, N.T., Hong Kong
For privacy requests and complaints, email info@taldermont.com