Privacy Policy

Controller

anycast.io UG (haftungsbeschränkt)

Hintere Straße 125a, 90768 Fürth, Deutschland

Scope of this policy

We process personal data where necessary to operate the platform, provide sign-in and billing, support team functions and deliver the service securely.

This includes email addresses, account data, technical access data, usage data and content stored in threads, projects, research runs or storage functions.

Hosting and infrastructure

We operate the 2342.ai core platform on our own infrastructure at the Deutschherrnkarree in Nuremberg. Core-Backbone GmbH provides colocation and network connectivity. We do not use a third-party public cloud as the primary infrastructure for storing and delivering the core platform.

Server logs may contain IP addresses, timestamps, requested URLs, browser information and technical error data. This processing supports secure platform operations.

Authentication and account access

For sign-in, we process email address, session data and technical device data. Magic-link sign-in creates and verifies a time-limited token.

Session and access data are processed to enable sign-in, limit misuse and manage existing sessions.

Using the platform

When you use the platform, we process content from chats, projects, research runs, file uploads, vector stores and API calls. We also store the selected model, timestamps, token usage and cost information.

When you use an external model through our platform, data required for that processing is forwarded to the relevant provider.

Depending on the selected external model, Amazon Web Services EMEA SARL, Google Cloud EMEA Limited and Microsoft Ireland Operations Limited may be involved as providers or subprocessors.

For external models, processing location, retention and other conditions depend on the selected data path and applicable agreements. We do not make a blanket promise that every external AI request is processed exclusively in EU data centers. GLM 5.3 and GLM 5.3 Flash run through in-region routing exclusively at EU endpoints with zero data retention. GLM 5.2 and the Mistral route for GLM are external data paths with a training reservation and are locked by default.

For ad videos we research publicly available sources about your company (website, reviews, press) and store the resulting brand profile in your project, including names of people mentioned there, such as founders or reviewers, so you can review them. Images, speech and clips are generated on Microsoft Azure and Google Cloud in EU regions from content produced within the platform; names from the research are not passed on.

DPA, subprocessors and model choice

Our Data Processing Agreement and current subprocessor list are publicly available at 2342.ai/en/dpa and 2342.ai/en/subprocessors. Organization owners and admins can accept the current DPA electronically in the organization area and retrieve a record containing its version, timestamp and document fingerprint. The PDF generated at acceptance carries the processor's electronic countersignature.

Not every model is automatically suitable for every use of personal or confidential data. Controllers must choose a suitable model and data path based on purpose, contractual basis and data type. The model catalog labels data path, zero data retention and training reservation per model; the model datasheet at 2342.ai/en/model-datasheet summarizes provider, region and retention.

• DPA published at /en/dpa
• Subprocessor list published at /en/subprocessors
• Data path, zero data retention and training reservation labeled per model in catalog and datasheet
• Assess external data paths under the applicable agreements

Training, deletion and retention

2342.ai does not use customer data to train its own foundation models. Models whose provider reserves the right to train on inputs and outputs (currently GLM 5.2 and the Mistral route for GLM as Public Preview) are labeled as an external data path and locked by default.

Chats, files, vector stores, API logs and usage data may be retained for different periods depending on the feature and as necessary for operations, billing, security, team functions or legal obligations.

Customers can delete content and accounts. Statutory retention obligations, billing records and security logs may prevent the immediate deletion of every technical record.

• Chat and project data: retained for the product function until deletion or account termination
• Files and RAG/vector stores: retained until deleted by a user or admin
• API and usage logs: retained for operations, billing, misuse prevention and traceability
• Billing data: retained in accordance with statutory retention obligations

Teams and shared libraries

When you use team functions, we process team membership, roles, invitations and shared content such as prompt libraries or budget information.

Certain team data, including name, email address, role and team-related usage values, may be visible to authorized team members.

Payments and billing

For billing and payment processing, we process plan and usage data. Payment data itself is processed only through the payment service providers used for the relevant transaction.

Your rights

Subject to the GDPR, you have in particular the rights of access, rectification, erasure, restriction of processing, data portability and objection.

For privacy-related requests, use the contact details published in our imprint at 2342.ai/en/imprint.

• Article 15 GDPR: access
• Article 16 GDPR: rectification
• Article 17 GDPR: erasure
• Article 18 GDPR: restriction
• Article 20 GDPR: data portability
• Article 21 GDPR: objection