Privacy Policy

Effective 2026-10-27.

1. Who is responsible

Controller within the meaning of the GDPR: Nikolay Kopylov, trading as Nikolay Kopylov Softwareentwicklung (alpenware), Lehrer-Wirth-Straße 42, 81829 München, Germany. Privacy contact: legal@unwindly.app.

2. What this policy covers, and our two roles

Alpenware Inference provides an API that runs open-weight language models for business customers, including inference marketplaces and model routers that pass requests from their own users to us. This policy covers:

• visits to this website (inference.alpenware.org);
• data about our business customers and contacts;
• technical metadata about API requests.

For these, we are the controller. For the content of API requests (prompts, files, images and generated outputs) we act only as a processor on behalf of our customer, under our Data Processing Agreement. If you use an app or marketplace that sends your requests to us, that provider is responsible for your data and its privacy policy applies; please contact them first. We will support them in answering your request.

3. Visiting this website

When you open a page, the web server records your IP address, date and time, the page requested, the referring page, your browser's user agent and the response status. We use this to deliver the website and to detect and defend against attacks (legitimate interest, Art. 6(1)(f) GDPR). These logs are deleted after 14 days unless they are needed to investigate a specific security incident.

This website sets no cookies, uses no analytics or advertising tools, loads no third-party fonts or scripts and contains no social media plugins.

4. Business customers and contacts

When you contact us or become a customer, we process names, business email addresses, company and billing details, and our correspondence. We use them to answer enquiries, to conclude and perform the contract (Art. 6(1)(b) GDPR), to communicate with business partners (Art. 6(1)(f) GDPR) and to meet accounting and tax retention duties (Art. 6(1)(c) GDPR in conjunction with § 147 AO). Contract and correspondence data is deleted when it is no longer needed; accounting records are kept for the statutory retention period.

5. API request metadata

For every API request we record technical metadata, but never its content:

• time, request ID, model and API key identifier;
• number of input and output tokens, latency and response status or error code;
• the IP address of the system that sent the request.

When requests come through a marketplace or router, that IP address belongs to the marketplace's servers, not to its end users.

We use this metadata to bill usage, to plan capacity and to detect abuse and attacks (Art. 6(1)(b) and (f) GDPR). Request-level metadata is deleted after 30 days. Aggregated usage figures per customer, without IP addresses, are kept as accounting records for the statutory retention period.

6. Content of API requests (prompts and outputs)

We process request content only to generate the response, and only as a processor:

• Content is held in server memory while the request is processed. It is not written to disk, databases or logs.
• To speed up repeated requests, the inference engine may keep intermediate data (a cache of the processed prompt) in GPU or server memory for a short time. This cache is not readable as text, is overwritten automatically and is lost on every restart.
• Content is never used to train or improve models, never sold or shared, and not reviewed by humans. The only exception is an example that a customer sends us voluntarily in a support request.

7. Recipients and processors

We use the following service providers, each bound by a data processing agreement:

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: Dedicated GPU servers that run the inference API. Location: Germany or Finland (EU).
• DigitalOcean, LLC, 105 Edgeview Drive, Suite 425, Broomfield, CO 80021, USA: Hosting of this website (inference.alpenware.org). Location: Frankfurt am Main, Germany (EU data centre region).
• Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, Netherlands: Business email. Location: EU (Zoho EU data centres).

We do not pass personal data to anyone else unless we are legally obliged to do so, for example to law enforcement authorities on the basis of a court order.

8. Transfers outside the EU

API traffic and its content are processed only in the EU. Our website host DigitalOcean is a US company. The website runs in its Frankfurt region, and any access from the USA is covered by the EU-U.S. Data Privacy Framework and the EU Standard Contractual Clauses (Art. 45 and 46 GDPR).

9. Security

All connections are encrypted with TLS. Our technical and organisational measures are described in Annex II of the DPA.

10. Your rights

You have the right to:

• access your data (Art. 15 GDPR);
• rectification (Art. 16 GDPR) and erasure (Art. 17 GDPR);
• restriction of processing (Art. 18 GDPR);
• data portability (Art. 20 GDPR);
• object at any time to processing based on Art. 6(1)(f) GDPR, on grounds relating to your particular situation (Art. 21 GDPR).

Write to legal@unwindly.app. You may also complain to a supervisory authority. Ours is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Ansbach (Promenade 18, 91522 Ansbach, Germany).

11. Other information

We do not make automated decisions about you within the meaning of Art. 22 GDPR and do not create profiles. You are not obliged to provide personal data. Without the contract data in section 4, however, we cannot conclude a contract with you.

12. Changes

We update this policy when our processing changes. The current version is always available on this page, with its effective date.