Privacy Policy

This Privacy Policy explains how Eden AI SAS (“Eden AI”, “we”) processes personal data as a controller: when you visit our websites, create and use an account, contact us, or when we communicate with current and prospective customers.

When our customers send data through the Service, such as prompts, files and outputs, we process it on their behalf as a processor. That processing is governed by our Data Processing Agreement (DPA) and summarised in Section 4. This Policy should be read together with our Terms of Service.

We do not use your data to train AI models and we do not sell personal data.

‍

1. Who we are

The controller is Eden AI SAS, a French simplified joint-stock company registered with the Lyon Trade and Companies Register under number 829 046 473, whose registered office is at 19 rue Louis Guérin, 69100 Villeurbanne, France.

Data protection contact: [email protected].

‍

2. Information we collect

• Account data: name, professional email, company, role, authentication data (including single sign-on and Google sign-in), organisation and team settings.
• Billing data: billing contacts, addresses, VAT number, invoices and payment identifiers. Card details are handled by Stripe; we do not store full card numbers.
• Usage data: timestamps, request volume, selected providers and models, token usage, costs, latency, API key and project identifiers.
• Technical data: IP address, browser type, device and system information, logs and security events.
• Communications: support requests, sales or partnership inquiries and the content of these exchanges.
• Business contact data: professional contact details obtained from you, from your organisation, at events or from publicly available professional sources, used to contact current and prospective customers.
• Website data: information collected through cookies and similar technologies, as described in Section 5.

‍

3. How we use data and legal bases

• Providing the Service and managing accounts, organisations and access – performance of a contract.
• Billing, invoicing and accounting – performance of a contract and compliance with legal obligations.
• Security, fraud and abuse prevention, reliability monitoring – our legitimate interest in securing the Service, and legal obligations where applicable.
• Support and responses to inquiries – performance of a contract or our legitimate interest in answering requests.
• Service communications, such as security notices, subprocessor changes and updates to our terms – performance of a contract and legal obligations.
• Product analytics and improvement of the Service, based on usage and technical data – our legitimate interest in improving the Service.
• Business-to-business marketing and prospecting, such as product updates, newsletters and outreach to professionals – our legitimate interest, or your consent where required by law. You can object at any time.
• Website analytics and functional cookies – your consent (see Section 5).
• Compliance with legal obligations and defence of legal claims – legal obligations and our legitimate interests.

‍

4. Data processed on behalf of our customers

For data sent through the Service, Eden AI acts as a processor under the DPA. In summary:

• request and response content from synchronous API calls is not stored by default;
• asynchronous job results are kept for up to seven (7) days for retrieval;
• content is retained longer only if the customer enables Log Retention or sends it to support;
• customer data is never used to train AI models and is never sold;
• customers control which providers, models and regions may process their data in Settings → Compliance, including Zero Data Retention and region restrictions, and Eden AI enforces these rules on every request. The EU endpoint keeps AI inference within the European Union.

If you are an end user of an application built by one of our customers, please contact that customer to exercise your rights. We will assist them as described in the DPA.

‍

6. Recipients

We share personal data only with:

• our service providers, acting as processors: hosting and infrastructure (Amazon Web Services, Cloudflare), databases and analytics (ClickHouse, Metabase), error monitoring (Sentry), identity and single sign-on (WorkOS), payments (Stripe), transactional email (Brevo), customer support (Intercom), and customer relationship management and sales tools. The subprocessors that process customer data are listed in Annex 2 of the DPA;
• the third-party AI providers that you select or enable, to fulfil your requests;
• professional advisers and auditors, and public authorities where required by law;
• a successor in the event of a merger, acquisition or sale of assets, subject to this Policy.

We do not sell personal data.

‍

7. International transfers

Our main infrastructure is hosted in the European Union (Amazon Web Services, Paris). Some providers process data outside the European Economic Area, mainly in the United States: Intercom (support), WorkOS (single sign-on), Stripe (payments), Metabase (AI-assisted analytics features) and the AI providers outside the EU that you select.

Where required, these transfers rely on an adequacy decision of the European Commission, the European Commission’s Standard Contractual Clauses or another legally recognised transfer mechanism. You can request more information at [email protected].

When you use our EU endpoint, request and response content is not routed to AI inference infrastructure outside the European Union (DPA, Section 12.2).

‍

8. Data retention

• Account data: for the life of the account, then up to three (3) years after its closure or last activity.
• Billing and accounting records: ten (10) years, as required by French commercial law.
• Usage data and technical logs: as long as necessary for billing, security and reliability, as stated in our documentation.
• Support conversations: for the duration of the customer relationship, then up to three (3) years.
• Prospect data: three (3) years from the last contact.
• Cookies: for the durations listed in Section 5.
• Data processed on behalf of customers: as described in Sections 6 and 16 of the DPA.

At the end of these periods, data is deleted or anonymised, unless a longer retention period is required by law or for the defence of legal claims.

‍

9. Security

We implement appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls and monitoring. Eden AI holds an ISO/IEC 27001:2022 certification, and our measures are described in Annex 5 of the DPA. No method of transmission, storage or processing can be guaranteed to be completely secure.

‍

10. Your rights

Under applicable data protection law, you have the right to access, correct and delete your personal data, to restrict or object to its processing, including at any time to direct marketing, and to data portability. Where processing is based on consent, you can withdraw it at any time. Under French law, you can also set instructions for the processing of your data after your death.

To exercise your rights, contact [email protected]. We may ask you to verify your identity and will reply within one month, which may be extended by two months for complex requests.

You also have the right to lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or with the supervisory authority of your country of residence.

‍

11. Automated decisions and minors

We do not take decisions producing legal or similarly significant effects based solely on automated processing. The Service is intended for professionals and is not directed at minors.

‍

12. Changes to this Policy

We may update this Privacy Policy. The current version is always available on this page with its last updated date, and we will notify material changes by email or in the Service.

‍

13. Contact

• Company: Eden AI SAS
• Registered office: 19 rue Louis Guérin, 69100 Villeurbanne, France
• Data protection contact:[email protected]
• Support:[email protected]