Privacy and Retention of the MuninCloud Flexible API

1. Who processes the data and in what role

In accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD):

1.1. The content of requests. As regards any personal data contained in what the Customer sends to the API and what the API returns, the Customer is the controller and Bogarra Integrated SL (tax ID B13627971, Calle General Aguilera N10 5A, 13001 Ciudad Real, Spain; trading as MuninCloud) acts only as processor (art. 28 GDPR), to carry out the request and nothing else. The processing contract (art. 28(3) GDPR) is clause 15 of the terms of service, which the Customer accepts when signing up.

1.2. The account, payments and metadata. As regards account data, payment data and usage metadata (sections 3 and 4), Bogarra Integrated SL is the controller.

2. The content of requests: not stored

2.1. No prompts or responses stored. The content of requests and responses is not written to disk or to the logs: it is processed in the engine's memory. While the engine is working, it may remain for a time in its working memory (the prefix cache, which speeds up requests that begin the same way): that memory is isolated per account, nobody reads it, it is not copied anywhere and it is overwritten as the engine is used.

2.2. No transfer to third parties. Content is processed with models that MuninCloud runs on its servers; it is not sent to any external artificial intelligence provider.

2.3. Training. Neither the content nor the outputs are used to train, fine-tune or improve any model, MuninCloud's or anyone else's.

3. The metadata of each request

3.1. What is recorded. For each request only the following is recorded: the account and the key, the model, the input and output tokens, the duration, the response code, the request identifier (X-Request-Id) and the source IP address, which is deleted after 90 days. Never the content.

3.2. What for. To charge usage against the balance, to answer the Customer's queries about a specific request (with its X-Request-Id), for the usage caps and the security of the service, and to invoice the marketplaces through which usage arrives.

3.3. Legal basis. Performance of the contract with the Customer (art. 6(1)(b) GDPR) and, for security and abuse prevention, the legitimate interest of Bogarra Integrated SL (art. 6(1)(f) GDPR).

3.4. Retention period. The metadata of each request is kept for 12 months; after that, only the totals per account and month are kept. Once the account is closed and has no balance left (expired or refunded), those totals are kept for 12 more months and then anonymised: only the sum per channel and month remains, without the account.

3.5. The IP at the entrance. Before reaching the API, each request goes through MuninCloud's entrance proxy and its automatic blocking system (Terms, clause 9.4), which record the source IP address for the security of the service (art. 6(1)(f) GDPR). The proxy's access logs are rotated every week and the last 4 are kept (about 5 weeks); its error logs, every week, the last 10 (about 11 weeks). The automatic blocking system keeps its alerts with the IP for 7 days and shares the IP of attackers with CrowdSec SAS (20 rue Maurice Arnoux, 92120 Montrouge, France), which processes it as joint controller with MuninCloud to protect its members and, according to its policy, keeps it for up to 3 months (up to one year for the analysis of an attack, before anonymising it).

4. Account and payment data

4.1. What is processed. The data the Customer provides when topping up (name or company name, tax ID or VAT number, email address, country and postcode), the reference of each payment and the invoices issued. They are required to enter into the contract: without them the top-up cannot be made nor its invoice issued.

4.2. For each key. Its fingerprint (never the key), the list of allowed IP addresses if the Customer sets one, and its creation, revocation and last-use dates.

4.3. Payments. They are handled by Bogarra Integrated SL's ERP through Stripe; card details are kept by Stripe and MuninCloud only keeps the payment reference.

4.4. The VIES check. The VAT number of a Customer from another EU Member State is checked in VIES, the European Commission's system, with Bogarra Integrated SL's VAT number as requester. The consultation number returned by VIES is kept as evidence of the check for the tax authorities.

4.5. Legal basis. Performance of the contract (art. 6(1)(b) GDPR) and compliance with Bogarra Integrated SL's tax and accounting obligations (art. 6(1)(c) GDPR).

4.6. Retention period. Account data and the data of its keys, while the account is open or has a balance; after that they are deleted or anonymised, except those that must be kept with the invoices. Invoices, their tax data and the VIES evidence, for six years from the last entry made in the books (Spanish Commercial Code, art. 30.1), and in any case for as long as the tax authority's right to audit them has not become time-barred: four years from the day after the end of the period for filing the return in which they were included (General Tax Law, arts. 66.a, 67.1 and 70.1), or ten if they support tax bases, amounts or deductions that are offset or applied later (arts. 66 bis.2 and 70.3).

5. Who else receives data

Transfers outside the European Economic Area. For a company in Spain, Stripe's service is provided by Stripe Payments Europe, Limited (Ireland, within the EEA); any later transfers by Stripe to its US companies are covered, according to its privacy policy, by the EU-U.S. Data Privacy Framework and the European Commission's standard contractual clauses. Hetzner (clause 6) and VIES process the data within the European Union. Today the API does not transfer personal data outside the EEA. The marketplaces (OpenRouter, Inc. and Hugging Face, Inc., in the USA) are not yet an open channel. Through that channel the content of requests would arrive from the marketplace and the response would go back to it, outside the EEA: before the channel of a US marketplace is opened, MuninCloud will sign with it the standard data protection clauses adopted by the European Commission (art. 46(2)(c) GDPR), as a safeguard under Chapter V of the GDPR (arts. 44 to 49), and until then that channel is not opened. Before the first request arrives through it, this policy will state which data it receives.

6. Where processing takes place

The API gateway (the node requests go through before reaching the engine) and model inference are in Germany, in Hetzner's data centres in Falkenstein (FSN1). The location of each model is published in its location field in GET /v1/models.

7. Security

Keys are stored only as fingerprints; the engine can only be reached from the API gateway, over the private network; the gateway runs without privileges and does not write the content of requests anywhere.

8. Responsibility for the source data

The Customer warrants that it has a legal basis to process the personal data it sends to the API and, if it sends them on behalf of third parties, that it has informed those people. MuninCloud is not liable for the lawfulness of the content sent by the Customer.

9. Rights

Anyone may exercise their rights of access, rectification, erasure, objection, restriction of processing and portability (arts. 15 to 22 GDPR) by writing to rgpd@munincloud.com, and has the right to lodge a complaint with the Spanish Data Protection Agency (AEPD). As MuninCloud does not store the content of requests, it cannot give access to it or delete it: it does not have it. Requests are answered within one month of receipt, extendable by a further two months where necessary, taking into account the complexity and number of requests; any extension is notified within the first month (art. 12(3) GDPR).

Updates

23 October 2026 — publication of the privacy policy of the MuninCloud Flexible API.