How we use your data for AI

A language model cannot answer a question it has not been shown. Running the chat loop, executing a skill, or advancing a background job therefore requires sending the relevant context to a model provider and receiving a generated response. That request and response is the entire reason any of your data reaches a model provider. We do not copy your content to a provider for any other purpose, we do not retain it with a provider beyond the call, and we do not use it to build a product that benefits anyone but you.

This page describes the default behaviour of the platform for all plans. Where an enterprise agreement adds stricter terms, such as a zero-retention inference path or a named-region routing constraint, those terms control for that customer. The Subprocessors page carries the current, dated list of every provider in the path.

Terms used on this page have the following meanings. Capitalised terms not defined here carry the meaning given in the Data Processing Addendum or the GDPR.

A single request moves through a fixed sequence. Understanding it tells you exactly when data leaves the platform and when it does not.

• You submit a message, trigger a skill, or a scheduled job fires.
• The platform assembles the context: your input, the relevant slice of conversation history within the context window, retrieved memory, and any tool results already gathered. Assembly happens inside your workspace.
• The assembled prompt is sent over an encrypted channel to the model provider for the selected tier.
• The provider runs inference and returns a completion. The completion is not retained by the provider for its own purposes.
• The platform stores the exchange in your workspace so you can return to the thread, applies any rendering, and, where the step has external effect, routes it through the human approval gate before acting.

The table below states, for each class of data, whether it is sent for inference and whether it is stored in your workspace. Telemetry and billing data are never sent to a model provider.

To make past context findable, selected text is converted into numeric vectors through OpenAI's embedding endpoint and stored in your workspace. The embedding endpoint receives only the text being indexed, returns the vector, generates no chat content, and does not train on the input. Retrieval then runs locally against your own stored vectors using the hybrid approach documented in the Memory section of the product docs. Embeddings are bound to your workspace, are not shared across customers, and are deleted when the underlying content is deleted. An embedding is not reversible into the original text in any practical sense, but we treat it as personal data where it derives from personal data and protect it accordingly.

The platform is not designed to process special category personal data as defined in Article 9 of the GDPR, such as data revealing health, biometric identifiers, racial or ethnic origin, political opinions, religious beliefs, or sexual orientation. You should not submit special category data through the platform unless you have a lawful basis under Article 9 and have notified us in writing in advance. You are responsible for not pasting into a prompt anything you are not entitled to send to a third-party processor.

Data sent for inference travels over TLS to the provider. Provider credentials are scoped, stored in a managed secret store, and never exposed to the client. Request telemetry records the metadata of a call, the timestamp, the endpoint, the latency, and the status, but not the prompt payload as a logged artifact beyond what is needed to deliver and debug the response. The full set of technical and organisational measures, including encryption, access control, and logging, is on the Security page and is incorporated into the Data Processing Addendum.

Enterprise customers who need stricter guarantees than the default can request them in writing. Depending on plan and region, available options include a zero-retention inference path with a specific provider, constraints on which providers may be used, and a signed counterpart of the relevant terms. We will confirm what is available for your plan and region and document it in your agreement.

• Choose the model tier per conversation. The lite tier and the higher tiers are selectable in the product.
• Delete a message, a conversation, a project, or your entire account at any time. Deletion propagates to embeddings and stored context.
• Export your data before deleting it, for the duration of the retention window, in a portable format.
• Keep consequential actions behind a human approval gate. See Automated decisions and human oversight.
• Exercise your GDPR rights, including access, erasure, and objection, through privacy@51ultron.com or the account settings.

When the content you submit contains the personal data of other people, you act as the controller for that data and Ultron acts as your processor under the Data Processing Addendum. You are responsible for having a lawful basis to submit and process that data, for providing any notice the law requires to the people concerned, and for not submitting special category data without an Article 9 basis. The platform gives you the means to process; the lawfulness of a given input and use is your decision.

The provider list and the terms attached to each can change as the platform evolves. The Subprocessors page is the canonical, dated record. A material addition or replacement of a provider that touches Customer Personal Data is notified at least thirty days in advance, with a banner in the product and an email to customers who subscribed to subprocessor notifications, and you may object on reasonable data protection grounds as described in the Data Processing Addendum.

Questions about how your data is used for AI, requests for a zero-retention path, and data subject requests go to privacy@51ultron.com. For the full processing record, read the Subprocessors page, the Data Processing Addendum, and the Privacy Policy.