Privacy Policy

The following outlines how long different categories of data are retained:

As a data subject, you have the following rights:

• Right of access (Art. 15): You may request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): You may request correction of inaccurate data.
• Right to erasure (Art. 17): You may request deletion of your personal data. Please note that chat messages and script execution logs are stored permanently and may not be fully erasable (see Section 6).
• Right to restriction (Art. 18): You may request that we restrict processing of your data.
• Right to data portability (Art. 20): You may request your data in a structured, machine-readable format.
• Right to object (Art. 21): You may object to processing based on legitimate interest.
• Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority (in Germany: your state's data protection authority).

To exercise any of these rights, contact us at [email protected].

You may request deletion of your account and associated personal data at any time by contacting us through one of the following channels:

Upon deletion, your account data is removed from the live database. Residual copies in encrypted rotating backups will be purged as the backup cycle completes. Please note that chat messages and script execution logs are retained permanently for moderation purposes and are not removed upon account deletion (see Section 6).

If you discover a security vulnerability in Exoliner, we encourage you to report it responsibly. Please see our Vulnerability Disclosure Policy for full details.

Our primary infrastructure is located in Germany (Hetzner). However, some third-party processors process data outside the EU/EEA. The following transfers occur:

Exoliner includes an AI-powered chat assistant. The following disclosures apply to the use of this feature:

• AI Provider: The AI chat assistant is powered by Mistral AI (Devstral 2 model), a French AI company headquartered in the EU.
• Data Transmitted: When you use the AI chat, only the text content of your messages is sent to Mistral AI's API for processing and response generation. No account data, personal information, usernames, e-mail addresses, or other identifiers are transmitted to Mistral.
• Usage Tracking: Each user receives $2.00 USD of free AI credits per month. Token usage (input and output tokens) is tracked to calculate costs against your monthly credit allowance. Credits reset automatically every 30 days.
• Session Caching: AI chat conversation history is cached server-side in Redis with a 1-hour TTL to maintain context within a session. After 1 hour of inactivity, the cached conversation is automatically deleted.
• Third-Party Retention: Chat message text content sent to Mistral AI is subject to Mistral's own privacy policy and data retention practices. As an EU-based company, Mistral AI is subject to GDPR. No personal data is included in these transmissions.
• GDPR Compliance: Mistral AI is headquartered in Paris, France. Data processing occurs within the EU, so no international data transfer outside the EEA is required for the AI chat feature.
• Recommendation: We strongly recommend that you do not include sensitive personal information, credentials, or confidential data in AI chat messages.