Privacy Policy

• We do not store the prompts you send to the inference API or the outputs you get back.
• We do not train models on your data, and we do not sell it.
• Your requests are processed on GPUs operated by independent providers, not in a data center we own. Section 3 says what that means.
• For each request we keep the figures we bill from: model, token counts, timing, the key used.

ParalonCloud is operated by NEUROSTACK SRL, a Romanian company. It is the controller of the personal data described here. For anything about your data, write to [email protected].

NEUROSTACK SRL
Registered office: Intrarea Gheorghe Simionescu nr. 19, ap. B26, Sector 1, Bucharest, Romania
Trade Register no. J2026015445003 · Tax ID (CUI) 54194976 · Share capital 500 RON

This covers /v1/chat/completions, /v1/responses, /v1/embeddings, /v1/classify and image generation.

• Not stored. Our gateway passes the request to a worker and the answer back. The content of neither is written to our database or to our logs. /v1/responses keeps no conversation state.
• Not used for training. We do not train or fine-tune models on what you send or receive.
• Where it runs. The model runs on a machine owned and operated by an independent provider, which may be in any country. The request is in that machine's memory, unencrypted, while it is being answered. We run the inference engine with request logging off and providers have no interface from us to read requests, but they control the hardware, and we cannot give a technical guarantee about a machine we do not own. Do not send data that must not leave an environment you control.
• Caching. The engine keeps recent prompts in GPU memory for a short time so that a repeated beginning is not computed twice. To send a repeat to the same worker we keep hashes of the start of the prompt, not the text.
• Web search. If you turn on web search for a request, the search query built from it is sent to public search engines through a search service we host.

What we do keep for every request:

• the API key and account it belongs to, the model, and which worker served it;
• input and output token counts, the cost, latency and time to first token;
• the status, and for a failed request the error;
• for free trial keys, the IP address of a refused request, to limit abuse.

These are billing and operations records. They stay for as long as the account does and for as long as accounting law requires us to be able to justify a charge.

A batch is the exception to section 3, because you upload a file and collect the result later. Input and output files are stored in our database. Their content is deleted 30 days after upload, and the per-line records of a finished batch after 7 days. You can delete a file earlier through the API.

A rented instance runs on a provider's machine. What you put on it is on hardware you do not control, as the Terms say. We do not read the contents of your instance. We keep the rental's record: the node, start and end, what it cost, and health checks.

Messages between a renter and a provider go through our chat. Each message is checked automatically before delivery, staff can read the thread to settle a dispute, and messages are deleted 30 days after the rental ends.

For a render job we store the files you upload and the frames produced, so that you can download the result.

• Sign-in. Your email address, and the name and picture your Google or GitHub account shares when you sign in with it. A connected Discord or X account, if you use one to unlock the free trial.
• Each sign-in. Time, IP address, country, browser and device type. We use them to secure accounts and to detect abuse of free trials.
• Support. Tickets and their attachments. Screenshots are deleted 90 days after a ticket is closed.
• The site assistant. Conversations with "Ask Paralon" are stored with your email, a hash of your IP address and your browser, so we can see what people ask. Deleted after 90 days without activity. The assistant answers with a model served on this network.
• Providers. The hardware details and network address of the machines you connect, their measurements and history, and the wallet you give us for payouts.
• Server logs. Technical logs of our own services, kept 14 days.

Card payments are handled by Stripe. Card numbers never reach our servers. We receive and keep the billing name, address and tax ID you enter at checkout, because Romanian law requires an invoice for each payment. Invoices are issued through our accounting provider and, where the law requires it, reported to the Romanian tax authority.

For crypto deposits and payouts we store the wallet addresses and transaction identifiers involved. Transactions on a public blockchain are public and cannot be deleted by anyone.

We set only the cookies needed to keep you signed in. There are no advertising cookies and no analytics cookies, and no third-party analytics script runs on the site.

We count visits ourselves. When a page opens it tells our own server which page, the site you came from, your country and approximate city, and your type of device. The city is the one our network provider estimates from your address, kept as a name and a position rounded to about 11 km. Your IP address and browser signature are used for a moment to compute a code that tells one visitor from another, and are not stored. The code changes every day, so it cannot follow you from one day to the next. If you are signed in, the visit is linked to your account, which is how we learn which sources bring customers. Page views are kept for 13 months. A browser that sends Do Not Track or Global Privacy Control is not counted at all.

• GPU providers: the requests and workloads they run, as described in sections 3 and 5.
• Stripe: card payments. Our accounting provider and accountant: invoices.
• Cloudflare: all traffic to the site and the API passes through its network.
• Google and GitHub: sign-in, if you choose it. Discord and X: only if you use them to unlock the free trial.
• Our hosting and storage providers.
• Authorities, when the law obliges us.

Some of these, and some providers, are outside the European Economic Area. Our vendors receive data under the data processing terms they publish. Providers are independent operators bound by our Terms, not processors under such an agreement, which is the reason for the advice in section 3.

To provide the service you asked for and to bill it (contract); to keep invoices and payment records (legal obligation); to secure the platform, prevent abuse and understand how the site is used (legitimate interest).

Under the GDPR you can ask for a copy of your personal data, have it corrected or deleted, restrict or object to its processing, and receive it in a portable form. Write to [email protected] from the address of your account. We answer within a month. Records we must keep by law, such as invoices, stay for the period the law sets.

You can also complain to the Romanian data protection authority (ANSPDCP, dataprotection.ro) or to the authority of the country you live in.

When this policy changes, the date at the top changes with it.