Privacy policy.

§01Who we are

snowLEX Oy, Helsinki, Finland, operates the snowLEX Developer Platform and is the data controller for the personal data described in this policy — your account, billing and API request metadata. For personal data contained in the content you send to the API, we act as your processor instead; that processing is governed by the Data Processing Agreement (see §07).

§02What we process

Operating the platform requires the following categories of data:

• Account data — name, email address, hashed credentials, organization membership and role.
• API key metadata — key label, scopes, rate limit and spend-cap settings, creation and last-use timestamps. Keys themselves are stored only as hashes.
• Request metadata — request id, timestamp, model, token counts, cost, status and error code for each API call. IP addresses are processed transiently for rate limiting and abuse prevention.
• Billing records — top-ups, charges and invoicing data. Payments are processed by Stripe; we never store full card numbers.
• Support communication — messages you send us, including any request ids you quote.

§03Prompts and completions

The content of your API requests — prompts and the generated answers — is processed transiently to produce the response and is not stored by the platform gateway. It is not used to train models. What we retain about each request is the charge record described in §02: token counts, cost and status — not the text.

§04Purposes and legal bases

• Providing the Service — authentication, metering, billing (performance of a contract, GDPR Art. 6(1)(b));
• Bookkeeping and tax records (legal obligation, Art. 6(1)(c));
• Security, rate limiting and abuse prevention (legitimate interests, Art. 6(1)(f));
• Service communication, such as notices about changes or incidents (contract and legitimate interests).

§05Retention

• Account data: for the life of the account, then deleted or anonymized within a reasonable period after closure.
• Charge and transaction records: retained as required by Finnish bookkeeping law (generally six years).
• Per-request metadata: retained for as long as needed to resolve billing disputes and protect the platform, then deleted or aggregated.
• Transiently processed content (§03) is not retained at all.

§06Recipients and processing location

Data is processed within the EU/EEA. We share it only with the service providers needed to run the platform — hosting, model inference, payments, email and storage — listed with their roles and locations at /legal/subprocessors, and with authorities where the law requires it. We do not sell personal data.

§07When we act as processor

If the content you submit to the API contains personal data, you are the controller of that data and we process it only as your processor, on your documented instructions, as set out in the Data Processing Agreement. This policy does not apply to that content beyond what the DPA provides.

§08Your rights

Under the GDPR you may request access to, rectification or erasure of your personal data, restriction of or objection to its processing, and a portable copy of data you provided. Where processing is based on consent, you may withdraw it at any time.

To exercise these rights, contact us via the snowLEX contact page. You also have the right to lodge a complaint with the Finnish supervisory authority, the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto).

§09Changes to this policy

We update this policy when the platform's processing changes. Material changes are announced via the console or email before they take effect; the effective date above always reflects the current version.