Privacy notice
This is a translation of the Italian text, which prevails in case of doubt.
Notice on the processing of personal data under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and the Italian Data Protection Code (D.Lgs. 196/2003), as amended by Legislative Decree 101/2018.
It explains how Internet One Srl processes personal data when you use AI Tokens: the ai-tokens.it website, the dashboard (my.ai-tokens.it), the chat (chat.ai-tokens.it), the documentation (wiki.ai-tokens.it) and the API (api.ai-tokens.it).
1. Data controller
Internet One Srl, a single-member company, Via Piemonte 95, 21100 Varese (Italy), VAT number IT02286170127.
For any question about your data and to exercise your rights: privacy@internet.one, or by certified email (PEC) to internetone@pec.it. Internet One Srl is not required to appoint a data protection officer (Art. 37 GDPR): requests are handled through this point of contact.
Data you send us on behalf of your users. If the requests you send to the API contain personal data of other people, you are the controller of that data. We process it on your behalf, as processor, only to provide you with the service. The rules are in section 9 of the terms of service.
2. What we keep, why and for how long
| Data | Why | For how long |
|---|---|---|
| Account: name, email address, language and settings. For invoices: company name or first and last name, address, VAT number or tax code (codice fiscale), SDI recipient code or PEC address. For the password we keep only a fingerprint (a hash) from which the password cannot be recovered | To manage your account and issue invoices | As long as the account exists |
| Credit: balance and transactions (top-ups and charges) | To keep track of your credit | As long as the account exists |
| Card top-ups: amount, VAT, date and the payment reference at Stripe. If you turn on automatic top-up, also the reference of the card that Stripe stores. Card numbers are handled only by Stripe: we do not see them | To add credit and issue the invoice | As long as the account exists; data that goes into invoices, 10 years |
| Invoices and accounting records | Tax and civil-law obligations | 10 years (art. 2220 of the Italian Civil Code) |
Usage records, one per request: date and time, API key, endpoint, model, the machine and zone that computed the response, input and output tokens, amount charged, response time, outcome, a request reference and the user field, if you send it. No text of requests or responses and no IP address |
To charge you and show you your usage | As long as the account exists |
Automatic model choices (the auto model): API key, the model chosen, the reason, the score, the estimated number of input tokens, whether tools or images were present, the time taken. No text |
To check and improve model selection | 90 days |
| Request log: endpoint, model, the request parameters with each message replaced by its length, status, error message, tokens and response time. The text of requests and responses only for an API key on which you turn on content retention (on the API Keys page): in that case it is encrypted | To detect malfunctions. The text, to help you debug your program | 30 days |
| Conversations in the chat. Messages are encrypted, titles are not | To show them to you again | Until you delete them, or as long as the account exists |
| Documents you upload: the file, its text split into parts and the vectors used to search it | To answer questions about your documents | Until you delete them, or as long as the account exists |
| Voices created in the Studio of the dashboard | So that you can listen to and download them | 2 hours. Voices created through the API are not stored |
Sign-ins through the API's /api/v1/auth endpoints: IP address and browser or app of each sign-in |
To keep you signed in and protect the account | Up to 90 days after the sign-in expires (it lasts 30 days) or is revoked |
| Page statistics: page, date and time, the domain you come from (never the full address), device type and a fingerprint that changes every day. No cookies and no IP address | To know which pages are used | 12 months |
| Server logs: IP address, requested address, browser and errors | To protect the service from abuse and fix malfunctions | 14 days |
| Proof of account deletion: email address, date and time, IP address and browser of the request | To be able to prove that we deleted the account | 12 months after deletion, or after you cancelled it |
| Emails you send us | To reply to you | For the time needed to handle your request. Emails that are accounting records: 10 years |
| Backup copies of the database | To recover data after a failure | One copy every night; the last 7 are kept, then deleted |
The API's user field is stored exactly as you send it. Use an identifier that has meaning only to you, not a name or an email address.
We do not use your requests, responses, conversations or documents to train models.
3. Where your data is processed
In Switzerland: your account, keys, credit, usage records, request log, conversations, documents, voices, logs and backup copies. They are on the service's servers, in the Internet One Srl environment (tenant) in the GigaKube cloud in Lugano. Every API request first reaches those servers, which forward it to a model. Switzerland ensures an adequate level of protection according to the European Commission (Decision 2000/518/EC), so the transfer requires no further safeguards (Art. 45 GDPR).
The models run in Italy and in Switzerland. The country of each model and of each of its variants is shown in the price list on the website, on the Models page of the dashboard and in the X-Zona header of responses; each usage record stores the zone.
| Zone | Location |
|---|---|
| IT-1 | Varese, Internet One data center |
| IT-2 | Legnano |
| IT-3 | Milan, Equinix ML5 |
| CH-1 | Lugano, GigaKube cloud |
| CH-3 | Switzerland |
Some of these machines are owned by third parties, but we manage them entirely ourselves: the owners have no access to the data that passes through them.
- The request and the response travel between the service's servers and the machine that computes the response through an encrypted tunnel. The machine that computes the response stores neither the request nor the response.
- If you limit a key to one country in the dashboard, its text requests go only to machines in that country. Embeddings, rerank and speech synthesis currently run in Switzerland for all keys.
- Automatic model selection. With the
automodel, a small model of ours in Switzerland reads the last message of the request to choose the model that responds. For a key limited to one country, a machine in that country reads it. It stores nothing of what it reads.
4. Recipients of the data
| Who | For what purpose | Data |
|---|---|---|
| Stripe Payments Europe Ltd, Dublin (Ireland) | Processes card payments on its payment page and stores the card for automatic top-up, if you turn it on | Name, email address, amount, card details |
| SMTP2GO | Sends the service emails (address confirmation, password reset) from its access point in the European Union | Your email address and the content of those emails |
| Cloudflare | DNS for ai-tokens.it: tells browsers the address of our servers. Traffic does not pass through Cloudflare | DNS queries |
The data in section 2 is processed by Internet One Srl, in its own environment. The providers above that process data on our behalf are appointed as processors under Art. 28 GDPR. For fraud checks and legal obligations on payments, Stripe acts as an independent controller, under its privacy notice. The info@internetone.it mailbox is on Internet One Srl's mail servers. Data may be disclosed to judicial and public security authorities on lawful request. It may also be disclosed to the professionals who assist us on legal, tax and accounting matters.
Cloudflare is a company based in the United States. Stripe may transfer payment data to its parent company Stripe, Inc., in the United States. Both participate in the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795). No other data leaves the European Union and Switzerland.
5. Legal bases
- Contract (Art. 6(1)(b) GDPR): your account, credit, the requests you send, usage records, service emails.
- Legal obligations (Art. 6(1)(c)): invoices and accounting records.
- Legitimate interest (Art. 6(1)(f)): the request log, server logs and page statistics, to protect the service and fix its malfunctions; proof of account deletion.
Providing account and billing data is necessary for us to provide the service: without it, we cannot open the account.
6. Your rights
At any time you can request access to your data, rectification, erasure, restriction of processing and portability, and you can object to processing based on our legitimate interest (Arts. 15-22 GDPR). Write to privacy@internet.one or by PEC to internetone@pec.it. We reply within 30 days.
You delete conversations and documents yourself, in the chat and in the dashboard. You delete the whole account as described in section 7.
You have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).
7. If you delete your account
You delete it yourself, with your password, on the Account page of the dashboard.
- Immediately the account is deactivated: you can no longer sign in and your API keys stop working.
- For 30 days the data remains, in case you change your mind. To reactivate the account, write to info@internetone.it.
- After 30 days we delete your name, email address, password, billing data, conversations, documents, keys, credit and transactions, usage records, request log and API sign-ins. A row without personal data remains, so that invoices stay linked.
- What remains: invoices for the 10 years required by law; proof of deletion for 12 months.
- Backup copies are overwritten: within a further 7 days your data disappears from them too.
8. Security
We process data with technical and organisational measures appropriate to the risk (Art. 32 GDPR):
- all service addresses work only over HTTPS;
- passwords and API keys are stored only as fingerprints, from which they cannot be reconstructed;
- chat messages and the request text kept for keys that ask for it are encrypted by the application before they reach the database;
- the database and the file store accept connections only from the service's servers;
- traffic between our machines passes through encrypted tunnels.
If a personal data breach poses a risk to your rights, we notify the Garante within 72 hours and, if the risk is high, we also inform you (Arts. 33 and 34 GDPR).
9. Automated decisions
We do not make decisions based solely on automated processing that produce legal effects concerning you (Art. 22 GDPR). Automatic model selection only decides which model responds to a request.
10. Cookies
Only the technical cookies necessary for the service: they are listed on the Cookies page.
11. Changes
The date at the top shows when this version took effect. Before a change that affects how we use your data, we will tell you by email.