Privacy Policy
Last updated: September 25, 2026. How we handle your data and privacy.
Istidlal (“we”, “us”) runs the website https://istidlal.ai and the inference API at https://llm.istidlal.ai (the “Services”). The operator is zaraza tech. Registered office: 11 Rue Gabriel Bertillon, 91160 Longjumeau, France.
This notice explains what personal data we process. It is an informative notice and is not a contract.
1What We Commit To
- Inference runs in Belgium, in the European Union, on AMD and NVIDIA GPUs.
- We do not use your prompts, completions, or uploaded files to train or fine-tune models.
- We do not write prompt or completion text into spend logs.
- We do not sell personal data.
Business Customers: If we process data only on behalf of a business customer, that customer’s privacy notice applies to the individuals whose data appears in the prompts. This notice applies to you as the account holder and to visitors of our site.
2Personal Data We Collect
We collect information that you provide directly to us, as well as data gathered automatically when you use our Services.
Data You Give Us
- Account & Contact: Name, email address, company name, and API key identifiers.
- Billing Details: Collected securely by our payment processor. We do not store full credit card numbers.
- Support: Messages and technical inquiries sent to our support team.
- Prompts & Payloads: Files and prompts submitted to the API, and model replies. These are processed strictly to answer the request and are not kept as prompt logs.
Data Collected from Use of Services
- Connection Data: IP address, timestamp, user agent, and HTTP request status.
- Usage & Telemetry: Model name, token counts, latency metrics, and API key ID. This does not include the prompt or completion text.
We do not buy marketing lists. We do not ask you to log in with a social network.
3Why We Use It
We process personal data only when a valid legal basis applies:
| Purpose | Basis |
|---|---|
| Run the API and your account | Contract |
| Bill you and prevent abuse | Contract and legitimate interest |
| Keep the service secure | Legitimate interest |
| Reply to you | Contract or legitimate interest |
| Comply with law | Legal obligation |
We do not use your content for advertising profiles.
4How Long We Keep It
- Prompt and completion text exists only while the request is being served, including in GPU memory, then it is discarded. We do not retain it for training.
- Account data is kept for the life of the account and then deleted or anonymised within 30 days after you ask us to close it, unless we must keep a record for tax or legal claims.
- Billing records are kept for the period required by Belgian accounting law.
- Security logs that contain IP addresses and request metadata, not prompt text, are kept for up to 90 days.
5Who We Share It With
We share personal data only in limited circumstances:
- Infrastructure providers who host or route the service, including the public edge in front of the API. Model inference itself runs in Belgium.
- Payment and email providers, when you pay or when we write to you.
- Professional advisers and authorities, when the law requires it or when we must defend a claim.
A transfer outside the EU, if one happens, uses an adequacy decision or the European Commission’s standard contractual clauses. You can ask us for a copy of the safeguards. We do not sell or share personal data for cross-context advertising.
6Cookies & Tracking
The API does not use advertising cookies. The website may use strictly necessary cookies to keep a session, and a privacy-respecting measurement cookie if you have not refused it. You can block cookies in your browser. The site is not built to honour a “Do Not Track” header.
7Your Rights
If you are in the European Union or the United Kingdom, you hold specific statutory rights:
To exercise any of these rights, email [email protected]. We may ask you to prove you control the account. We reply within one month. You can also complain to the Belgian Data Protection Authority.
8Children
The Services are not for anyone under 16. If you believe a child has sent us personal data, email us and we will delete it.
9Data Security & Workload Privacy
We understand that the models, data, and workloads you run on our infrastructure are sensitive. We implement industry-standard technical and organizational measures to protect your information and compute environments.
We use access control, encryption in transit, and network isolation. While we monitor infrastructure health and resource utilization, we do not inspect the contents of your models or workloads. No method of transmission or storage is perfectly secure.
10Changes to This Privacy Notice
If we change this notice in a material way, we will update the date above and post the new text on https://istidlal.ai. Continued use after that date means you have seen the new notice.
Istidlal / zaraza tech
11 Rue Gabriel Bertillon, 91160 Longjumeau, France
If you have any questions, concerns, or requests regarding this Privacy Notice or our data practices, please contact us:
[email protected]