Draft pending legal review. It describes how Naos works today.

Privacy

How we process your data in Naos, what happens to the code and the messages you send to the assistant, where your conversations are kept and what your rights are.

1. Data controller

• Company name: REVOLUCIÓN TECH, S.L.
• Trade name: Naos (inferencekey)
• Tax id (NIF): B99565657
• Registered address: C. de José Pellicer Ossau, 9, 50003 Zaragoza (España)
• Registry details: Registro Mercantil de Zaragoza, tomo 4452, folio 186, hoja Z-66796, inscripción 1ª
• Contact email: sales@inferencekey.com

REVOLUCIÓN TECH, S.L. provides Naos and also inferencekey, the platform your requests to the model go through: both belong to the same company.

2. Your Inputs and Outputs

We call Inputs what you send to the assistant: your messages, the code and files it reads from your folder and the output of the commands you approve. We call Outputs what the model sends back: text, code and the changes and commands it proposes.

Inputs and Outputs are yours. We process them only to provide the service: take the Inputs to the model and bring the Outputs back to you. Legal basis: performance of a contract (art. 6.1.b GDPR).

We do not train models on your Inputs or your Outputs, nor use them to improve the service, neither we nor inferencekey. inferencekey runs the model on its own servers: your Inputs and Outputs are not sent to any external model provider, as section 7 explains.

What inferencekey keeps of each request: the date and time, the key that made it (its id and its prefix), the endpoint it went to, the project and the workload, the model, how many input tokens (and how many of them were served from the cache) and output tokens, whether it ended well or with an error and its reference cost. It does not keep the content of the Inputs or the Outputs.

The Naos server does not keep that content either: the web chat takes your message to the model and brings the answer back without storing it. Its technical logs record your user id and how many characters go each way, never the text.

3. What other data we process and why

Account data. Your email, the hash of your password (argon2id; never the password in clear), your language and your sessions (only the hash of the cookie token, for 30 days), to create and manage your account. Legal basis: performance of a contract (art. 6.1.b GDPR).

Subscription and payments. Payments are processed by Stripe, which gives us back the reference of your customer and your subscription; we keep those references, the plan and its status. We do not keep your card details. Stripe asks for your billing address to work out the VAT of your country. Legal basis: performance of a contract and legal obligation (arts. 6.1.b and 6.1.c GDPR).

Connected devices. For each device you connect (naos code or VS Code) we keep the name the device sends, the id and prefix of its key and a hash of the key: only your device has the key in clear. The web chat key is stored encrypted, so the server can use it when you chat. Legal basis: performance of a contract.

Usage. To apply the caps of your plan we keep, for each hour, how many tokens you used (input, input served from cache and output) and their cost. Legal basis: performance of a contract.

Request to start at once. When you subscribe to a plan we keep that you ticked the box asking for it to start now and acknowledging when the right of withdrawal is lost: your email at that moment, the exact text of the box you accepted, the plan, the date and time, the terms version and the language of the page. It is the proof of your request (arts. 98.8 and 103.a of the Spanish consumer protection act, TRLGDCU). Legal basis: legal obligation and performance of a contract (arts. 6.1.c and 6.1.b GDPR).

Technical logs and security. The Naos server records your user id in its technical logs for some operations, such as logging in or chatting, to detect faults and abuse. To stop brute force attacks it counts, only in memory and for 15 minutes, the login and sign-up attempts per IP address and per email, and the client login code exchanges per IP address; none of that is written to disk. Legal basis: legitimate interest in the security of the service (art. 6.1.f GDPR).

4. Where your conversations are kept and how to delete them

Your conversations are never kept on the Naos server or in inferencekey: they stay on your computer or in your browser, and you delete them. inferencekey runs the model on its own servers and processes the Inputs and Outputs of each request only to generate the answer, without keeping their content (section 7).

• naos code: in ~/.naos/sessions (or in $NAOS_HOME/sessions if you changed the naos folder), with everything that was said and the files that were read. To delete them, close naos and run naos forget: it deletes that folder and what naos keeps about them outside it.
• VS Code extension: in ~/.naos/vscode/data (or in $NAOS_HOME/vscode/data). You delete them from History, one by one or all at once.
• Web chat: in your browser's local storage (localStorage). You delete them with «Delete» on each conversation or by clearing this site's data in your browser.

5. Cookies and storage in your browser

We use two technical cookies, strictly necessary for the service you ask for and therefore exempt from consent (art. 22.2 LSSI): naos_session, which keeps you signed in, and naos_csrf, which protects the forms. The web chat keeps your conversations in the browser's local storage, as explained above.

We use no advertising or analytics cookies, and the site loads nothing from other domains.

6. No analytics or telemetry

Neither the site nor the Naos clients send analytics, telemetry or error reports. naos code starts its base, DeepSeek Harness, with telemetry turned off and without its online services. The VS Code extension comes without Cline's telemetry keys and with its telemetry setting off. VS Code has its own telemetry, from Microsoft, which you decide in the VS Code settings.

7. Recipients and international transfers

inferencekey, of the same company: receives your Inputs encrypted in transit (TLS), measures the usage and generates the Outputs with the model. inferencekey runs the model on its own servers.

No external model providers. Your Inputs and Outputs are not sent to any external model provider or other third party to generate the answers, and the model does not take them to third countries: there are no international transfers of your Inputs and Outputs because of the model. Nobody trains models on them.

Stripe, which processes payments and the billing address under its own privacy policy.

Hosting. The Naos site and inferencekey run on servers of REVOLUCIÓN TECH, S.L. itself in Spain, with no third party hosting providers or content delivery networks.

8. Security

Everything travels encrypted in transit (TLS). Passwords are stored with argon2id and access keys only as a hash, except the web chat key, which is stored encrypted.

9. Retention

Each piece of data is kept only as long as its purpose needs:

• Account data (email, password hash, language), connected devices and their keys: while the account exists. They are deleted with it.
• Sessions: 30 days from when you log in; then they expire.
• Billing data (Stripe references, plan and status): in Naos, while the account exists; deleting it deletes them, and in Stripe we delete your customer and detach the saved card, which can no longer be charged. Stripe keeps the invoices and payments for the legal period, with its own copy of your email, name and billing address, and each payment with the card details it was paid with (last digits, expiry, name and billing address).
• Request to start at once (the email at that moment, the accepted text, plan, date, terms version and language): 6 years from the contract, the period of art. 30 of the Spanish Commercial Code, also if you delete the account, as proof of that request. If that request does not end in a contract (for example, you leave the payment or later subscribe to another plan), it is deleted after 30 days.
• Hourly usage in Naos and per request metrics in inferencekey: 13 months. Usage older than 13 months is deleted automatically.
• Server technical logs: 30 days.
• Login or sign-up attempts per IP and per email: 15 minutes, only in memory.
• Conversations: we do not keep them, neither we nor inferencekey, which runs the model on its own servers (sections 4 and 7).

When you ask for erasure we delete your account and all its data in Naos, except the record of your request to start at once, which we keep for 6 years as proof of that request and to defend ourselves against claims. The technical logs and the inferencekey metrics linked to your key are deleted automatically when their periods end (30 days and 13 months). In Stripe we delete your customer and detach the saved card, which can no longer be charged, after cancelling the subscription and after any refund; the invoices and payments stay there for the legal period, each payment with the card details it was paid with.

10. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction, portability and not to be subject to automated decisions by writing to sales@inferencekey.com.

If you think we did not handle your request properly, you can complain to the Spanish Data Protection Agency (AEPD).

• Spanish Data Protection Agency (www.aepd.es)

11. Changes to this policy

We may update this policy to adapt it to legal or service changes, for example if where the model runs changes. We will publish any relevant change here.