Privacy notice

How we process data for the website, Dashboard, billing and API.

Last updated: 8 September 2026

Controller and contact

Innovius UG (haftungsbeschränkt), Elbestraße 1A, 14513 Teltow, Germany, is responsible for the customer and website administration described here. Send privacy requests to info@innovius.ai.

Account and login

We use your business email to send a time-limited login link. Dashboard requires a signed session cookie and a cookie protecting against forged form requests. These are necessary for the requested function. Sessions expire after 24 hours by default, login links after 15 minutes. Used links cannot be reused.

The service stores a pseudonymous customer ID, the Stripe customer association, API key verification and revocation data, and purchase, license and usage associations. API keys are not stored in plaintext in the account database. For abuse prevention, we temporarily process IP addresses and login frequency.

Billing and entitlement activation

Stripe processes billing, company and payment data you enter at checkout and in the customer portal. Full card details are not passed to our API. Stripe provides invoices and manages payments and subscriptions. Depending on the processing, Stripe acts as a processor or independent controller, for example for statutory payment and fraud-prevention duties. Details: Stripe Privacy Center.

RevenueCat receives the pseudonymous customer ID and purchase references to verify purchases and manage entitlements. API request content is not sent to Stripe or RevenueCat for billing. RevenueCat information: Data processing and Privacy.

API content and local installation

For the cloud API, we process submitted content to detect and replace personal data on behalf of your company. The Data processing agreement describes this processing. Synchronous content is processed in memory for the request. Asynchronous jobs store inputs and results encrypted; inputs are removed after processing and remaining job content no later than 24 hours after submission. Job content is excluded from routine logs and backups and is not used for model training.

Offline inference content remains on your infrastructure. For activation, Innovius receives an installation ID, its public key and the association with paid capacity. Activation contains no text content. Your company is responsible for local administration.

Hosting, email and recipients

Managed inference runs on STACKIT in Germany. The corporate website is hosted by United Domains. SMTP2GO, provided by Sand Dune Mail Ltd., sends login and service messages. Support messages are forwarded to our company mailbox. Please do not send API keys or unnecessary personal example data to support. SMTP2GO privacy information.

Billing and communications providers may process data outside the EEA. Their contractual data protection terms and, where required, appropriate transfer safeguards apply, particularly EU standard contractual clauses or relevant adequacy decisions. You may request information and copies of safeguards applicable to your data. German inference hosting does not mean all billing and email data is processed exclusively in Germany.

Purposes, legal bases and retention

Pre-contract steps, contract performance and handling requests rely on Article 6(1)(b) GDPR where you are the contracting party. For a business customer’s employees and operational security, we rely on Article 6(1)(f): legitimate interests in business communication, secure services and abuse prevention. Statutory billing and evidence obligations rely on Article 6(1)(c).

Account, purchase and usage associations are retained while needed to provide active entitlements, prove consumed capacity or resolve open matters. We delete or anonymize unnecessary data unless legal retention duties apply. Invoices and tax documents follow applicable statutory retention periods. Support messages are deleted after closure and necessary evidence periods. The chosen operating model and service require the described data; without it we cannot provide an account, invoice or processing order.

Your rights

Subject to legal requirements, you have rights of access, rectification, erasure, restriction and portability. You may object to processing based on legitimate interests for reasons relating to your situation. Consent may be withdrawn for the future. We make no solely automated decisions with legal or similarly significant effects using your account data.

You may complain to a data protection authority, in particular the Brandenburg Commissioner for Data Protection and Access to Information. If data subjects contact us about API job content, we assist the responsible business customer in handling their request.