Privacy & Data Policy — DiscreteStack Inference API
At a glance
- We never train models on your prompts, completions, or other content.
- Prompts, completions, and other content are never persisted (zero data retention); they are processed in volatile memory only.
- Request metadata never contains your content and is kept for a maximum of 90 days.
- All processing stays in the EU. DiscreteStack is a European company with no US parent or subsidiary.
- ISO/IEC 27001, ISO 9001, and ISO/IEC 42001 certified; SOC 2 Type 2 report available on request.
- Privacy contact: Yanita Hristova, DPO — yanita.hristova@discretestack.com
1. Scope
This policy describes how DiscreteStack AD ("DiscreteStack", "we", "us") processes data in connection with the DiscreteStack inference API available at api.discretestack.eu (the "Service"), including inference requests routed to the Service through third-party platforms such as OpenRouter.
The Service provides hosted inference on open-weight models, with Compact and Max model classes, and accepts text and image inputs to generate text outputs through /chat/completions, /responses, and /messages-compatible interfaces.
This policy covers the Service and related account, billing, and administrative data. It is separate from our website privacy policy (https://discretestack.com/privacy-policy), which governs the discretestack.com website. For customers, the binding processing terms are set out in the DiscreteStack API Subscription Agreement and the DiscreteStack Data Processing Agreement (DPA); this page summarises them for the public.
2. Our role under the GDPR
- Content — as processor or subprocessor. For the inputs you send to the API ("Content") and the outputs generated, we act as a data processor under Article 28 GDPR, on behalf of the customer or platform whose documented instructions we follow. When requests reach us through a platform such as OpenRouter, we act as a processor or subprocessor within that chain, and that platform's own privacy policy also applies to your use.
- Metadata and administration — as independent controller. To the extent we determine the purposes of permitted request-metadata processing (operation, analytics, benchmarking, and Service improvement) and of account, invoice, and contract administration, we act as an independent data controller and are responsible for the lawful basis, transparency, and other controller obligations for that processing.
- We process Content only to deliver the inference requested, and only on documented instructions (the Agreement, the DPA, and your API requests).
3. Data we process
Content
- Inputs: prompts, images, and messages, and their cached representations (held in volatile memory only).
- Outputs: generated text.
Content may contain personal data, such as names, contact details, identifiers, and information about individuals. Data subjects may include your users, staff, and customers, or other individuals referenced in Content.
Request metadata (never includes Content)
- Identifiers, timestamps, model identifiers, request settings, usage counters, and completion or error status.
Account, billing, and administrative data (direct customers only)
- Name, email, company name, billing details, contract records, and API keys.
We do not sell personal data, we do not use it for advertising, and Content is never shared with third parties.
4. Prompts, completions, and training
No training on customer data. We do not train, fine-tune, or otherwise improve any model using Content, and neither Content nor metadata is ever used for model training. Content is processed only to deliver the inference you request.
No persistent storage — zero data retention. Content and its cached representations are never logged and never written to persistent storage, including disks and backups. Processing and caching happen transiently in volatile memory; non-cached Content is discarded after we process the request and return the response. Requests are isolated, and caches are partitioned per user, so one user's cached data can never be accessed or reused by another user. Each cache entry is deleted after 15 minutes of inactivity or two hours from its creation, whichever occurs first. Because Content is not retained, we cannot retrieve past prompts, images, or completions once a response has been delivered. Our operational monitoring runs in metadata-only mode.
Metadata retention. We retain non-content request metadata for no more than 90 days from generation, solely for operation, analytics, benchmarking, and Service improvement. Metadata never includes Content. Account, invoice, and contract records may be retained for administration and legal obligations, without Content.
5. Retention summary
| Data | Retention |
|---|---|
| Content (inputs, outputs, cached representations) | Never persisted. Processed in volatile memory; non-cached Content discarded after the response; cache entries deleted after 15 minutes of inactivity or 2 hours from creation, whichever comes first |
| Request metadata (no Content) | No more than 90 days |
| API keys | Kept while active; can be rotated or revoked at any time |
| Account, invoice, and contract records | For administration and as required by applicable legal obligations (without Content) |
6. Location, sovereignty, and subprocessors
All processing and storage of Content, caches, and request metadata — by DiscreteStack and by its subprocessors, including remote administrative access — takes place within the EU. No processing of this data outside the EU is permitted. DiscreteStack is a European company with no US parent or subsidiary.
We use EU-based subprocessors only, such as data centre and colocation partners. Our subprocessor register forms part of the DPA and initially includes Neterra EOOD (colocation, Sofia, Bulgaria). Customers receive at least 30 calendar days' notice before any subprocessor is added or replaced, and may object on reasonable data protection grounds.
7. Security and breach notification
We maintain technical and organisational measures appropriate to the risks of the processing under Article 32 GDPR, including:
- authenticated access restricted to authorised personnel, bound by confidentiality obligations;
- appropriate encryption and isolation of requests;
- the cache and retention controls described in this policy;
- protected facilities and operational monitoring without Content logging;
- incident response, and availability and recovery measures that do not retain Content.
We maintain ISO/IEC 27001, ISO 9001, and ISO/IEC 42001 certifications. A SOC 2 Type 2 report is available on request under confidentiality. In the event of a personal data breach affecting customer data, we notify affected customers without undue delay and provide the information available about the breach's nature, affected data, likely consequences, and remedial measures.
8. Your rights (GDPR)
Where we act as an independent controller (account, invoice, and contract administration, and permitted metadata processing), you have the rights of access, rectification, erasure, restriction of processing, data portability, and objection. To exercise them, contact our DPO at yanita.hristova@discretestack.com. We respond within 30 days. You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (www.cpdp.bg) or your local supervisory authority.
Where we act as a processor or subprocessor (Content), the customer or platform that instructed us is the controller of that data. We assist them in meeting their obligations — including data subject requests, impact assessments, and audits — as required by law. Since we never persist Content, no prompts or outputs can be retrieved from us. An enterprise DPA with audit, assistance, and verification commitments is available to API customers.
9. Changes
We may update this policy from time to time. Material changes will be published on this page with an updated version number and date.
10. Contact
DiscreteStack AD
Registration number 208519764 · VAT BG208519764
Registered office: 18 Stefanka str., 3001 Vratsa, Bulgaria
Data Protection Officer: Yanita Hristova — yanita.hristova@discretestack.com
Legal notices: legal@discretestack.com
Support: technical.support@discretestack.com