Data Protection

Privacy Policy

Effective Date: May 15, 2026 — Last Updated: May 15, 2026

This Privacy Policy is drafted in compliance with Algerian Law No. 18-07 of June 10, 2018 on the protection of natural persons with regard to the processing of personal data.

1. Scope of This Policy

This Privacy Policy applies to all personal data collected and processed through the DEVUP AI platform (devupai.com), including the website, AI inference API Gateway, developer dashboard, and all associated services.

By using the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein, in accordance with Article 7 of Law 18-07.

2. Personal Data We Collect

2.1 Data You Provide Directly

• Account Information: Email address, name (if provided), and authentication credentials (password hash or OAuth provider identifier such as GitHub).
• Billing Information:Payment method details (processed securely through local payment gateways — CIB, Eddahabia, BaridiMob). DEVUP AI does not store full card numbers.
• Support Communications: Any information you provide when contacting our support team.

2.2 Data Collected Automatically

• API Usage Metadata: Timestamps, token counts (prompt and completion), model used, response latency, HTTP status codes, and cost per request. This metadata does NOT include the content of your prompts or completions.
• Technical Data: IP address, browser type, device type, operating system, and referral URL when accessing the dashboard.
• Session Data: Authentication tokens and session identifiers necessary for secure access.

2.3 Data We Do NOT Collect

DEVUP AI does NOT collect, store, or retain the content of your API prompts or completions. Inference data (your inputs and model outputs) is processed transiently on our rented GPU infrastructure and is immediately discarded. It is never written to any persistent database, log file, or storage system.

3. Legal Basis for Processing

In accordance with Articles 7 and 9 of Law 18-07, we process your personal data on the following legal bases:

• Contractual Necessity (Article 7): Processing is necessary for the performance of the contract between you and DEVUP AI (i.e., providing the AI inference Service as described in our Terms of Service).
• Consent (Article 7): Where required, you provide explicit consent at the time of account registration or data collection.
• Legitimate Interest: Processing necessary for the legitimate interests of DEVUP AI, such as fraud prevention, platform security, and service improvement, provided these interests do not override your fundamental rights.
• Legal Obligation: Processing required to comply with Algerian tax, commercial, or regulatory obligations.

4. Purposes of Data Processing

Your personal data is processed for the following purposes:

• Account creation, authentication, and management.
• Providing, maintaining, and improving the AI inference gateway service.
• Billing, invoicing, and transaction processing in Algerian Dinar (DZD).
• Usage metering and real-time analytics displayed on your dashboard.
• Platform security, abuse detection, and rate limit enforcement.
• Responding to your support requests and communications.
• Complying with legal and regulatory obligations under Algerian law.

5. AI Model Training — No-Training Guarantee

DEVUP AI categorically guarantees that it does NOT use any user data — including prompts, completions, API metadata, or any derivative thereof — to train, fine-tune, distill, or otherwise improve any artificial intelligence model.

Because DEVUP AI operates its own rented GPU infrastructure running open-source models, it maintains full control over the inference pipeline. No user data is shared with or retained by third-party model providers.

6. Infrastructure Architecture and Data Flow

DEVUP AI rents dedicated GPU clusters in international data centers to host and natively execute open-source AI models. The data flow for every inference request is as follows:

• Step 1 — Transmission: Your API request (containing the prompt) is transmitted over an encrypted TLS 1.3 connection from the Platform to the designated GPU cluster.
• Step 2 — Processing: The prompt is loaded into volatile GPU memory (VRAM/RAM) for inference execution by the hosted open-source model.
• Step 3 — Response: The generated completion is returned to you over the same encrypted channel.
• Step 4 — Caching (Transient):A hashed representation of the prompt may be retained in volatile memory for 5–10 minutes to enable prompt caching, then automatically purged.
• Step 5 — Purge: All inference data is evicted from volatile memory. No data is ever written to persistent disk storage, databases, or file systems on any foreign server.

7. Transient Prompt Caching

The Platform employs a transient, in-memory prompt caching mechanism designed exclusively to reduce inference latency:

• Ephemeral Storage: Cached data resides solely in volatile memory (RAM) and is never written to persistent disk storage.
• Time-Limited:Cache entries automatically expire after 5–10 minutes, or upon system restart, whichever occurs first.
• User Isolation: Cache entries are strictly scoped to individual user sessions. No cross-user data leakage is possible.
• No Training Use: Cached data is never used for model training, analytics aggregation, or any purpose other than reducing latency for the requesting user.

8. Data Sharing and Third-Party Disclosure

DEVUP AI does not sell, rent, or trade your personal data. We may share limited data with the following categories of recipients:

• GPU Infrastructure Sub-Processors: Rented GPU servers receive inference data transiently for processing. DEVUP AI maintains exclusive application-layer control over inference workloads. We utilize industry-standard infrastructure sub-processors (e.g., cloud hosting, databases) that are strictly bound by Data Processing Agreements (DPAs).
• Payment Processors: Billing data is shared with local payment processors (SATIM network for CIB/Eddahabia) to process your payments securely.
• Hosting Providers: Technical data may be processed by our hosting and infrastructure providers (e.g., Vercel, Supabase) for the purpose of delivering the Platform dashboard and API gateway.
• Legal Authorities: We may disclose personal data if required to do so by law, regulation, or valid legal process issued by a competent Algerian authority.

9. International Data Transfers

In accordance with Articles 44–45 of Law 18-07, DEVUP AI discloses the following regarding international data transfers:

Your inference data (prompts and completions) is transmitted to GPU servers located outside of Algeria for the sole purpose of performing AI inference computation. These transfers are governed by the following safeguards:

• Strictly Temporary:Inference data exists on foreign servers exclusively in volatile memory (RAM/VRAM) for the duration of processing and transient caching (maximum 5–10 minutes). It is never written to persistent storage abroad.
• Contractual Necessity: These transfers are necessary for the performance of the contract between you and DEVUP AI, as the core inference service requires GPU compute resources not yet available domestically at the required scale.
• Application-Layer Control: DEVUP AI maintains exclusive application-layer control over inference workloads on rented GPU clusters. We utilize industry-standard infrastructure sub-processors that are strictly bound by Data Processing Agreements (DPAs) to ensure compliance with Law 18-07.
• Encryption: All data in transit is encrypted using TLS 1.3. Data at rest on foreign servers does not exist, as inference data is never persisted to disk.
• No Retention Abroad: Once inference is complete and the transient cache expires, absolutely no user data remains on any foreign server.

Account data, billing records, and usage metadata are stored on database servers provided by Supabase. DEVUP AI selects providers that maintain adequate data protection standards consistent with the requirements of Law 18-07.

10. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this Policy:

• Account Data: Retained for the duration of your account and for thirty (30) days after account deletion to allow for recovery.
• API Usage Logs (Metadata Only): Retained for twelve (12) months for billing reconciliation and analytics, then automatically purged.
• Billing Records: Retained for ten (10) years as required by Algerian commercial and tax regulations.
• Inference Data (Prompts/Completions): Not retained. Processed transiently in volatile memory and immediately discarded.

11. Data Security Measures

In accordance with Article 41 of Law 18-07, DEVUP AI implements appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit using TLS 1.3.
• API key hashing using SHA-256 (raw keys are never stored).
• Scoped JWT authentication with automatic token expiration and rotation.
• Role-based access control (RBAC) for administrative functions.
• Rate limiting and anomaly detection to prevent unauthorized access.
• Dedicated GPU infrastructure with application-layer access control and sub-processor DPAs governing physical infrastructure providers.

12. Your Rights Under Law 18-07

Under Algerian Law 18-07, you have the following rights regarding your personal data:

• Right of Access (Article 34): You have the right to request confirmation of whether your personal data is being processed and to obtain a copy of such data.
• Right of Rectification (Article 35): You have the right to request the correction of inaccurate or incomplete personal data.
• Right of Erasure (Article 36): You have the right to request the deletion of your personal data when it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations.
• Right to Object (Article 37): You have the right to object to the processing of your personal data for legitimate reasons relating to your personal situation.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, please contact us at support@devupai.com. We will respond to your request within thirty (30) days as required by Law 18-07.

13. Regulatory Framework — Algerian Data Protection Authority (ANPDP)

DEVUP AI processes personal data in accordance with the regulatory framework established by the Algerian National Authority for the Protection of Personal Data (ANPDP), the independent authority created under Article 22 of Law 18-07 to oversee data protection compliance in Algeria. DEVUP AI is committed to meeting the standards set by this framework.

If you believe that your data protection rights have been violated, you have the right to lodge a complaint with the ANPDP. We encourage you to contact us first at support@devupai.com so that we may attempt to resolve your concern directly.

14. Cookies and Local Storage

The Platform uses strictly necessary cookies and local storage for:

• Authentication: Session cookies to maintain your logged-in state.
• Security: CSRF tokens and authentication state.

DEVUP AI does not use advertising cookies, third-party tracking pixels, or behavioral analytics cookies. No data is shared with advertising networks.

15. Children's Privacy

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that personal data has been collected from a child under 18, we will take steps to delete such data promptly.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or regulatory guidance. We will notify you of material changes by posting the updated Policy on the Platform and updating the "Last Updated" date.

Your continued use of the Service after the publication of the revised Privacy Policy constitutes your acceptance of the changes.

17. Governing Law and Jurisdiction

This Privacy Policy shall be governed by and construed in accordance with the laws of the People's Democratic Republic of Algeria, in particular Law 18-07 on the protection of personal data.

Any dispute arising from this Policy shall be submitted to the exclusive jurisdiction of the competent Courts of Algiers.

18. Data Controller — Legal Notice and Contact Information

The data controller responsible for the processing of your personal data on the DEVUP AI platform is:

• Full Name: BAL Mohamed Abdessalem
• Legal Status:Auto-entrepreneur — Artificial Intelligence Systems Development
• Registration Number: 100605190202125689
• Platform:DEVUP AI — devupai.com
• Email: support@devupai.com

For matters concerning the regulatory framework governing data protection in Algeria, refer to the ANPDP (Algerian National Authority for the Protection of Personal Data).