Privacy Policy

Privacy Policy

Draft pending counsel review — not legal advice, not in force until approved by the owner

This policy is a working draft. The categories, storage locations and periods below are taken from the operator’s trust documents (ops/docs/trust/), not retyped from memory. Reviewed by: (pending) · Reviewed on: (pending).

1. Who is who

• For customer content sent through the API, the operator ([[REGISTERED-ENTITY]]) acts as a processor and the customer as controller (or processor for its own customers). No service is offered that makes the operator a controller of customer content (source: ops/docs/trust/DPA-subprocessors.md §1).
• Account email and billing records are controller data the operator holds for its own account administration (source: ibid., §1).

2. What is processed

Source: ops/docs/trust/DPA-subprocessors.md §2.

Category	Examples	Why	Stored where
Account identifiers	email address, account id, session	sign-in and account management	acumen database, tcp host
API key identifiers	key id, label, scopes, created/revoked times	authentication and attribution	acumen database
Request metadata	timestamp, model, token count, latency, status, key id, upstream provider, truncated upstream error text	routing, billing, abuse prevention	acumen database and Prometheus metrics
Request and response content	prompts and completions	delivering the requested inference	in transit only in the router
Billing records	plan, usage totals, invoices	contract and accounting	acumen database / accounting records
Security correspondence	reports sent to security@	handling a disclosure	postmaster mailbox

The “in transit only” row is a design statement: the upstream provider necessarily receives the content to serve the request, and an operator can enable diagnostic logging, which is off by default and covered by the retention schedule (source: ibid., §2). The optional exact-match cache that once wrote complete response bodies to the database was disabled on 2026-10-20 and its 134 stored rows deleted (source: ops/docs/trust/retention-schedule.md, “Row 5 in detail”).

3. Where data lives

Service data is stored in Germany, on a Hetzner host (availability zone fsn1-dc14, region eu-central, Falkenstein); see the sub-processors register (source: ops/docs/trust/DPA-subprocessors.md §4).

4. Security measures

TLS at the edge for every public host; operator surfaces bind loopback or the tailnet only; per-customer revocable API keys; the operator console is not reachable from the public internet; host firewalling, a deterministic deployment gate and an append-only harness ledger; metrics and logs bounded by the retention schedule with no content scraped into the observability stack (source: ops/docs/trust/DPA-subprocessors.md §7). Known gap, stated plainly: the acumen database has no scheduled off-host backup (source: ibid., §7).

5. Retention

Per-category periods, erasure latency and deletion methods are published in the retention policy. Security reports and disclosure correspondence are kept for three years; other business correspondence for 24 months (source: ops/docs/trust/retention-schedule.md, rows 10-11).

6. Your rights and contact

For access, correction or deletion requests, contact security@tcp.systems; assistance with data-subject requests is a DPA term (source: ops/docs/trust/DPA-subprocessors.md §3.8 and §9). This site itself sets no tracking cookies: see the cookie policy.