Privacy Policy

1. Who is responsible

DeepAPI is operated by DADA INDUSTRIES sp. z o.o.. For anything privacy-related, contact support@deepapi.co.

2. What we collect

• Account and application data. Name, email address, phone number, role, application answers, and sign-in records when you apply for access or create an account.
• Usage and billing data. API request metadata (which capability was called, when, status, cost), credit balance and transaction history, and API key records. Our credit ledger is append-only, so billing history is kept permanently.
• Request content. The inputs your agents send and the results we return are stored so we can deliver results, prevent double-billing on retries, and audit charges. During early access we also retain and use this data to improve the product quickly, debug problems, and detect abuse (see section 6).
• Technical data. IP addresses and similar logs used for security, rate limiting, and abuse prevention.

Data your agents collect from the public web passes through DeepAPI on your instructions. You are responsible for what you collect and how you use it. Do not send us sensitive personal data (for example health, biometric, or similarly protected data) unless we have agreed in writing to process it.

3. How we use data

To run the service, bill usage, keep the platform secure, prevent abuse, improve the product, and contact you about your account or the waitlist. We do not sell your personal data.

4. Legal bases

We process personal data on these legal bases:

• Contract. To provide the account, API, and billing you asked for.
• Legitimate interests. To keep the platform secure, prevent abuse, and (during early access) improve the product.
• Legal obligation. To meet accounting, tax, and other legal duties.
• Consent. Where we ask for it. You can withdraw consent at any time.

5. Subprocessors

We use third-party service providers in these categories to process data on our behalf:

• Cloud hosting and infrastructure (application serving, database, authentication).
• Public web data collection.
• Email sending and inbox infrastructure.
• AI model providers for research and generation.
• Address lookup for checkout.

DeepAPI's core infrastructure (API and database) runs on ISO 27001 / SOC 2 certified cloud infrastructure in Europe (Germany and Switzerland). Some providers we use are outside the EU. Where we transfer personal data to those providers, we rely on the European Commission's standard contractual clauses.

A current list of our subprocessors is available on request at support@deepapi.co. We may update our providers as the service evolves.

6. How long we keep data

Account, usage, and billing records are kept for as long as you have an account and afterwards as long as needed for accounting, security, and legal obligations.

DeepAPI is in early access. During this period we do not apply fixed retention windows to request content: we keep it so we can improve the product quickly, debug problems, and catch abuse and bad actors. At general release we will review this policy and set firm, privacy-focused retention limits, and we will give notice when that happens. You can request deletion of your content at any time (section 9).

7. Security

We use appropriate technical and organizational measures to protect personal data. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

8. Cookies

We use essential cookies for authentication and UI preferences. We use cookieless analytics, so no consent banner is required.

9. Your rights and deletion

You can ask us to delete your data at any time: email support@deepapi.co and we will delete your request content, account, and waitlist data. Billing ledger records that we must keep for accounting or legal reasons are retained even after deletion.

Under the GDPR you also have the right to access your personal data, correct it, delete it, restrict processing, object to processing, receive a copy in a portable form, and withdraw consent where we rely on it. We will respond within the time the law requires.

You have the right to complain to the Polish supervisory authority, UODO (Urząd Ochrony Danych Osobowych).

10. Changes

If this policy changes materially, we will give notice (for example by email or in the dashboard) and update the date above.