1. Who is responsible
MainAI, Copenhagen, Denmark, is the controller for account, billing and website data described here. For customer prompts and completions, MainAI is a processor acting on the customer organisation's instructions.
Privacy questions and data-subject requests: privacy@mainai.dk. We answer within one month, or tell you why an extension is needed.
2. What we collect
We keep the data set deliberately narrow. Inference content is not persisted by default.
- Account data: name, work email, hashed password, organisation, country, locale and email-verification state.
- Authentication and security data: hashed session tokens, hashed API keys, IP address, user agent, login attempts and audit events.
- Billing data: credit balance, ledger entries, VAT ID, billing address and Stripe identifiers. Card numbers stay with Stripe.
- Usage metadata: model, token counts, cache counts, latency, status code, request ID and organisation. Not prompt or completion bodies.
- Verification data for all accounts: legal name, registration number, country and submitted documents.
- Website data: the theme preference is stored in your browser. We run no third-party analytics or advertising pixels.
3. Why we use it
We process data to perform the contract, meet legal duties and pursue limited legitimate interests.
- Provide inference, issue keys and enforce limits — contract.
- Authenticate users, prevent abuse and investigate incidents — contract and legitimate interest.
- Meter usage, produce invoices and meet bookkeeping duties — contract and legal obligation.
- Run know-your-business checks on all accounts — legal obligation and legitimate interest.
- Send service email such as verification, reset and invoice notices — contract.
- Improve capacity planning from aggregate token and latency counts — legitimate interest.
4. Retention
Account records are deleted 30 days after closure. Usage metadata is kept for 24 months. Audit events are kept for 24 months. Invoices and ledger entries are kept for seven years under Danish bookkeeping law. Verification files are kept for five years after offboarding.
Backups roll for 30 days. Deleting a record removes it from live systems immediately and from backups within that window. Email tokens and expired sessions are purged after 30 days.
5. Subprocessors
We use a short list of EU-established providers. The current list, purpose and location sit on the sovereignty page. Customers receive 30 days' notice before a new subprocessor is added.
| Entity | Purpose | Location |
|---|---|---|
| MainAI | Inference hosting, EU ingress and operator access | Denmark |
| Stripe Payments Europe, Ltd. | Card payments, subscriptions and invoices | Ireland |
| Amazon Web Services EMEA SARL | Encrypted off-site database backups | EU region, Sweden |
| EU SMTP relay | Verification, reset and invoice email | European Union |
Current as of 25 October 2026. See the sovereignty page for change notice terms.
6. International transfers
The inference path stays in the EU. Some suppliers are US groups with EU contracting entities: Stripe Payments Europe and AWS EMEA. Where a transfer outside the EEA occurs, it relies on an adequacy decision or the European Commission's Standard Contractual Clauses with a transfer-impact assessment.
7. Your rights
Under the GDPR you may request access, correction, deletion, restriction, portability and objection. You may withdraw consent where processing relies on it. You can object to processing based on legitimate interest.
Send requests to privacy@mainai.dk. We may need to verify identity. If we get it wrong, complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark.
8. Security
Passwords use Argon2id. Sessions are opaque, hashed at rest and HttpOnly. API keys are shown once and stored as a hash plus a short prefix. The gateway has no public route. Service-to-service credentials live only in server runtime.
No system is perfect. If a breach affects personal data, we notify the supervisory authority within 72 hours where required and affected organisations without undue delay.
9. Data processing addendum
A DPA incorporating the Commission's Standard Contractual Clauses is available for all accounts. It covers processor obligations, subprocessor consent, breach notice, audit co-operation and deletion on exit.
Request the current DPA and a signed copy from privacy@mainai.dk. Self-serve prepaid customers accept the DPA by using the service.
11. Changes and contact
Material changes are announced by email or in the portal 14 days before they take effect. The effective date at the top always reflects the current version.
MainAI, Copenhagen, Denmark · privacy@mainai.dk.