Privacy Policy
This policy covers personal data processed in connection with the MADD LLM API at llm.madd.im. It is a business-to-business service. Our other products, including the DomaAI application, have their own privacy policy at madd.im/privacy-policy.html.
1. Who we are
MADD Marcin Kisielinski, sole trader registered in the Polish CEIDG register, ul. Kajki 10-12, 10-547 Olsztyn, Poland, VAT ID (NIP) PL7422297084, REGON 545106682. Contact for privacy matters: prywatnosc@madd.im.
2. Our role
When our customers (for example OpenRouter) send us requests that contain personal data of their users, we act as a processor on behalf of that customer. We process such content only to generate the requested response and do not retain it, as described in the Data Policy.
We act as a controller for the business contact details of our customers (names and e-mail addresses of contact persons, invoicing data) and for request metadata used for billing.
3. Data we process as a controller
- Account data: e-mail address, optional name, language, and, if you sign in with Google, your Google account identifier, name and e-mail. Used to provide the account and to sign you in (Art. 6(1)(b) GDPR). Sign-in codes are stored only as one-way hashes and expire after 10 minutes. Sessions use a single strictly necessary cookie.
- Business contact and invoicing data (name or company name, address, VAT ID), to conclude and perform the contract (Art. 6(1)(b) GDPR) and to meet tax obligations, including issuing invoices and sending them to the Polish KSeF system (Art. 6(1)(c) GDPR). VAT IDs of EU businesses are checked in the European Commission VIES service.
- Payment data: card payments are processed by Stripe. We receive the payment status and amount, never the full card number.
- Request metadata listed in the Data Policy (no content), for billing and service reliability, based on our legitimate interest (Art. 6(1)(f) GDPR).
4. Infrastructure providers (subprocessors)
| Provider | Purpose | Location |
|---|---|---|
| Runpod, Inc. | Rented GPU servers that run the models | Datacenters as declared per model in /v1/models |
| OVH SAS | API gateway server | European Union |
| Cloudflare, Inc. | DNS and network protection | Global network |
| Stripe Payments Europe, Ltd. | Card payments for prepaid credits | European Union, United States |
| inFakt sp. z o.o. | Issuing invoices and sending them to KSeF | Poland |
| OVH SAS (e-mail) | Sending sign-in codes | European Union |
| Google Ireland Ltd. | Optional sign-in with Google | European Union, United States |
Where data is transferred outside the European Economic Area, we rely on the European Commission's Standard Contractual Clauses or an adequacy decision, as offered by the provider.
5. Retention
Request content: not retained. Metadata and invoicing data: up to 5 years after the end of the year in which the related invoice was issued, as required by Polish tax law. Account data: until you close the account, then deleted except data we must keep for invoicing. Business contact data: for the duration of the business relationship and then until claims become time-barred.
6. Your rights
You have the right to access, rectify, erase, and restrict processing of your personal data, to object to processing based on legitimate interest, and to data portability. You can also lodge a complaint with the Polish supervisory authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa). Write to prywatnosc@madd.im to exercise your rights.
7. Changes
We will publish changes on this page and notify customers with active API keys about material changes.