Privacy Policy — UPGREAT AI
Version 1.0 — Effective 12 June 2026
This Privacy Policy explains how SustAInable BV, registered office Lammerstraat 13, 9000 Gent, company number 1038.977.886, VAT BE 1038.977.886 ("UPGREAT", "we") processes personal data in connection with the upgreat.ai website and services (the "Services"), in accordance with Regulation (EU) 2016/679 ("GDPR") and the Belgian Act of 30 July 2018.
Privacy contact: privacy@upgreat.ai
1. Roles: controller vs. processor
- For account, billing, website and support data, UPGREAT is the controller.
- For content submitted to the Inference API (prompts and generated responses) by business customers, the customer is the controller and UPGREAT acts as processor under the Data Processing Agreement (upgreat.ai/legal/dpa). Consumers using the API for personal purposes remain responsible for any personal data of third parties they submit.
2. What we process — and what we deliberately don't
2.1 We do NOT store prompts or responses
The content you send to the Inference API (Input) and the content generated (Output) is processed transiently in memory for the sole purpose of generating your response. It is not logged, not stored, and never used to train, fine-tune or improve any model. No human at UPGREAT reads your prompts or responses.
2.2 API usage metadata
For each API request we record only:
| Data | Purpose |
|---|---|
| Timestamp | Billing, capacity planning |
| Model identifier | Billing |
| Account/user identifier (API key reference) | Billing, abuse prevention |
| Token counts (input/output) | Billing |
Legal basis: performance of the contract (art. 6(1)(b) GDPR) and our legitimate interest in securing and operating the platform (art. 6(1)(f)).
2.3 Account and billing data
Name, e-mail address, company name and VAT number (business customers), address, payment and invoicing details, account settings. Legal basis: performance of the contract (art. 6(1)(b)) and legal obligations regarding invoicing, accounting and tax (art. 6(1)(c)).
2.4 Support and communications
Correspondence with our support and the information you provide in it. Legal basis: performance of the contract (art. 6(1)(b)) and legitimate interest in handling enquiries (art. 6(1)(f)).
2.5 Website data
The upgreat.ai website currently uses no analytics and no tracking cookies. Only technically necessary processing (server logs containing IP address, user agent and requested URL) takes place for security and operation, retained as set out in section 5. Legal basis: legitimate interest (art. 6(1)(f)).
If we introduce analytics, we will use a self-hosted, cookieless solution (Plausible) processing aggregated statistics on our own EU infrastructure, and will update this policy accordingly.
3. Data location and sovereignty
All processing takes place on infrastructure owned and operated by UPGREAT and its infrastructure subprocessor, located in datacenter facilities in Belgium and Iceland (EEA), including edge datacenter deployments within buildings of the Upgrade Estate group in Belgium. For physical security reasons, UPGREAT does not publicly disclose specific facility names or addresses. No personal data is transferred outside the European Economic Area. No US-headquartered cloud or model provider is involved in the delivery of the Services.
4. Recipients and subprocessors
We share personal data only with:
| Recipient | Role | Data |
|---|---|---|
| Limoengroen BV (BE 0840.067.015, Belgium) | Network and infrastructure operations (AS205924) | Infrastructure-level data; subprocessor under the DPA |
| Upgrade Estate Group BV (BE 0400.927.922, Belgium) and Upgrade Estate NV (BE 0840.066.124, Belgium) | Contracted personnel for platform operations and administration | Access to platform systems as strictly necessary; subprocessors under the DPA |
| Datacenter facility providers (Belgium / Iceland — EEA) | Physical hosting only | No logical access to data |
| Professional advisers, auditors, authorities | Where legally required | As strictly necessary |
We do not sell personal data and do not share it with advertisers. The current subprocessor list is maintained at upgreat.ai/legal/subprocessors. Payments are accepted in cryptocurrency without the involvement of US-based payment service providers; if a payment service provider is engaged in the future, it will be added to the subprocessor list before processing any personal data.
5. Retention
| Data | Retention |
|---|---|
| Prompts / responses (Input/Output) | Not stored |
| API usage metadata | Duration of the customer relationship; billing-relevant records per the line below |
| Invoices and accounting records | Up to 10 years (Belgian tax and accounting law) |
| Account data | Deleted within 90 days after account termination |
| Support correspondence | 24 months after closure of the ticket |
| Server logs | Customers: duration of the customer relationship; other visitors: max. 30 days |
6. Security
Measures include: TLS encryption in transit, role-based access control with strong authentication, network segmentation, controlled and audited change management, monitoring and alerting, and physical security at certified datacenter facilities. Details for business customers are set out in the DPA (Annex: technical and organisational measures).
7. Your rights
You have the right to access, rectification, erasure, restriction, data portability, and objection (including to processing based on legitimate interest), and the right to withdraw consent where processing is based on consent. We do not engage in automated decision-making producing legal effects concerning you.
Exercise your rights via privacy@upgreat.ai. We respond within one month. You may lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit, Rue de la Presse 35, 1000 Brussels, gegevensbeschermingsautoriteit.be) or the supervisory authority of your habitual residence.
8. Children
The Services are not directed at persons under 18 and we do not knowingly process their data.
9. Changes
We may update this policy. Material changes will be announced on the Platform and, for account holders, by e-mail, at least 30 days before taking effect. The current version is always available at upgreat.ai/legal/privacy.